CreateX Privacy Policy

01Scope and roles

This policy covers every feature of the Service (chat and AI assistants, work and tasks, meetings, files, reports, org insights, automations, mail and the admin console), whether you use it on the web, the desktop app or the mobile app, and this website.

The Customer's administrators create employee accounts and decide org structure, roles and feature switches; we process data on the Customer's instructions and under this policy. For the limited data we collect from website visitors, and for the device and diagnostic information we collect directly to run the desktop and mobile apps, we act as the controller.

02Information we collect

We collect only what is needed to provide the Service, mainly:

• Account information: name, work email, phone number, department, position and reporting line entered by your administrator; the avatar and preferences you set yourself.
• Business content: conversations, tasks, schedules, meeting details, meeting recordings and transcripts, minutes, reports, files and their metadata that you create or that arise from your use of the Service.
• Content captured with device features in the mobile app (permission is requested only when you use the feature; see section 7): photos you take with the camera, photos you pick from your library, files you choose on your phone, and audio recorded by the microphone for voice input and meeting recordings.
• Push notification token: the device token the mobile app receives when it registers with Apple Push Notification service or Firebase Cloud Messaging. It is tied to your sign-in session, used only to deliver notifications to that phone, and deleted when you log out.
• Device and diagnostic information: device type and operating system, app version, display language, and diagnostic information when the app runs into an error (such as the error type, time and app version), used for compatibility, update prompts and troubleshooting.
• Desktop app: the computer's name, operating system, app version, online status, the work folder you choose, and the content of files your assistant reads when you ask it to work on that computer.
• Consent records: your answers to the Personal Information Collection Statement and the AI services notice, with their version and time, kept as a record.
• Mail data: when you or your administrator connect a company mailbox, the mailbox connection credentials, message contents and attachments.
• Third-party meeting platform data: when you authorize Zoom or Tencent Meeting, the authorization tokens and your platform user identifier returned by the platform, basic details of meetings you create through the Service (meeting ID, link, time) and the cloud transcript after a meeting ends.
• Technical information: login IP address, browser type, access times, request and error logs, used for security and troubleshooting.
• Usage information: number of AI calls, credits consumed and the model used, for Customer billing and usage reporting.

This website uses a single cookie to remember your language choice. It uses no advertising or behavioral tracking cookies. The mobile app does not read your contacts or location and does not use advertising identifiers.

03How we use information

• To provide and maintain the Service, including letting your AI assistant look up and organize information within your permissions.
• To generate AI content: the context needed for the current task is sent to third-party AI service providers (see section 6) to produce replies, minutes, task drafts and similar output. We never use your data to train or fine-tune models.
• To send notifications to your devices about new messages, AI replies, digital staff results and work reminders.
• For authentication, access control, account security and abuse prevention.
• For billing, usage metering and reconciliation as requested by the Customer.
• To respond to support requests from you or the Customer.
• To comply with applicable law and regulatory requirements.

We do not use your personal information for direct marketing and we do not sell it.

04Third-party integrations (including Zoom and Tencent Meeting)

The Service can integrate with third-party platforms. An integration is enabled only after you or your administrator explicitly authorize it, and it requests only the minimum permissions needed for the feature.

• Zoom: used to create Zoom meetings from the Service, read the details of meetings you created, and, after a meeting ends, retrieve the cloud recording transcript to generate minutes. We store the authorization tokens (encrypted), your Zoom user ID, the meeting ID and join link, and the transcript text. We do not join meetings on your behalf and do not read meetings or recordings unrelated to the Service.
• Tencent Meeting: same purpose and data scope as above, through the Tencent Meeting open platform authorization APIs.
• Company mailbox: reads messages and attachments through the connection you configure, to support mail triage and filing attachments.
• Customer-built tools (MCP servers): configured by the Customer's administrators; the Service calls them only as authorized by the Customer.

You can disconnect Zoom or Tencent Meeting at any time under Settings › Meeting settings; the authorization tokens are deleted immediately. You can also revoke access from the platform's own app management page. When you uninstall the app from the Zoom App Marketplace, Zoom sends us a deauthorization notice and we delete the tokens and platform user identifier associated with that authorization within 10 days. Minutes already generated are the Customer's business records and are kept or deleted under section 5.

05Storage, retention and deletion

• Location: the Service's servers, databases, file storage and backups are in Hong Kong.
• Transfers: to deliver the corresponding features, data is transferred only as necessary to third-party AI service providers (see section 6), push notification services (see section 7) and third-party meeting platforms, which may process it outside Hong Kong; each is required to protect it to a standard no lower than this policy.
• Retention: data is kept for the duration of the Customer's subscription; the Customer can delete or export its data at any time. After termination we delete all of the Customer's business data within 30 days, except where the law requires retention.
• Account closure: employee accounts are created, disabled and deleted by the Customer's administrators; the app has no self-service account deletion. A disabled account can no longer sign in, its sessions on every device end immediately, and its push notification tokens are deleted.
• Backups: the database is backed up daily; backup copies are retained on a 7-day / 4-week / 6-month schedule and then automatically destroyed.
• Meeting recordings: after transcription and minutes generation, raw recordings are retained or deleted according to the Customer's settings.

06Third-party AI services

The Service's AI features rely on the following categories of third-party providers: large language models (replies, drafts, minutes and file content), speech recognition (turning voice input and meeting recordings into text), web search (when public web information is needed) and document parsing (for files in the company knowledge base).

Only what is needed for the request at hand is sent to them: your message and its context, files and images you provide, voice and recordings, the content of local files read by the desktop app, and search terms generated from your question. These providers may process it outside Hong Kong.

The mobile app shows the AI services notice after you sign in and before you start using it, and can be used only after you agree. You can withdraw consent at any time in the app under Me → Privacy & policies; until you agree again, the app on that phone cannot be used. Withdrawal applies only to the app on that phone: the web and desktop apps do not ask for this consent, and AI processing there does not stop when you withdraw. AI output can be wrong — check it before relying on it. See the AI services notice for details.

07Mobile app permissions and notifications

The mobile app asks for these permissions only when you use the related feature; declining one does not affect the others:

• Camera: to take photos and send them as attachments.
• Microphone: for voice input and meeting recordings. A meeting recording continues while the screen is locked or you switch to another app, until you stop or pause it.
• Photos: to pick photos from your library as attachments; HEIC photos are converted to JPEG on the phone before upload.
• Files: to choose files on your phone as attachments, or to save files to your phone.
• Notifications: delivered through Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android). A notification's title and preview pass through these services on the way to your phone.

You can change these permissions at any time in your phone's settings, and turn off notification previews on the lock screen in its notification settings.

08Security measures

• HTTPS (TLS) encryption for all traffic.
• Data of different customers is isolated at the database layer by enforced row-level security policies.
• Passwords are stored as salted argon2id hashes; login attempts are rate-limited; changing your password ends your sessions on every device.
• Third-party tokens and connection credentials are stored with AES-256-GCM encryption and never displayed in plaintext.
• Files are accessed through short-lived authorized links; files, meetings and tasks are visible only to their participants.
• AI assistants inherit exactly your permissions, and every write action runs only after your confirmation.

No system can guarantee absolute security. If a security incident involving personal information occurs, we will notify the Customer and affected users as required by law.

09Your rights

Under applicable law (including the Hong Kong Personal Data (Privacy) Ordinance and, where applicable, the PRC Personal Information Protection Law and similar laws), you have the following rights regarding your personal information:

• Access and copies: to see the personal information we hold about you and obtain a copy.
• Correction: you can edit your profile under Settings or under Profile in the mobile app; other information can be corrected on request through your administrator or us.
• Deletion: to request deletion of your personal information; the Customer can delete employee accounts and related data from the admin console.
• Withdrawal of authorization and consent: to disconnect third-party integrations, withdraw consent to AI services in the mobile app, or withdraw other authorizations at any time.
• Export: the Customer can request an export of its business data.
• Complaint: to lodge a complaint with us or with a competent supervisory authority (in Hong Kong, the Office of the Privacy Commissioner for Personal Data).

Because the Service is provisioned by the Customer for its employees, some requests are handled after confirmation by the Customer. We respond to requests within 30 days. See the Personal Information Collection Statement for how to make an access or correction request.

10Minors

The Service is intended for employees of business customers and not for minors. If we learn that we have collected a minor's personal information without the required guardian consent, we will delete it promptly.

11Changes to this policy

We may update this policy from time to time. For material changes we notify you in the Service or through your administrator and update the effective date at the top; the mobile app asks you to read and confirm it again. Continued use of the Service after a change means you accept the updated policy.