Privacy Policy & Data Processing Agreement

Last Updated: 2/15/2024

At Creative Herding, we believe that your data belongs to you. Our business model is built on transparency and trust. We provide the tools for you to manage your business, and we do not profit from your personal information.

This policy is designed to comply with the General Data Protection Regulation (GDPR) and other global privacy standards.

Our Philosophy on Data

We operate on the principle of "data minimization." We do not collect, track, or store any information that is not strictly necessary for the functionality of our software. We do not sell, rent, or trade your data to third parties for any reason.

Roles and Responsibilities

Under the GDPR, it is important to define our role in handling your data:

As a Data Controller: We are the controller of the account information you provide to us (e.g., your name, email, and billing details) used to manage your subscription.
As a Data Processor: When you use our tools to store data about your own clients or projects, you are the Data Controller and we are the Data Processor. We process this data only on your instructions and for the sole purpose of providing the service.

Information We Collect & Legal Basis for Processing

GDPR requires us to have a "legal basis" for processing your data. We rely on the following:

Data Type	Purpose	Legal Basis
Account Data (Name, Email)	To create your account and provide access.	Contractual Necessity
Billing Information	To process payments for the service.	Contractual Necessity
Business Data (CRM/Project/Invoicing data)	To store and organize your business info.	Contractual Necessity (as Processor)
System Logs (IP addresses)	To prevent fraud and ensure security.	Legitimate Interest

Tracking and Cookies

We value your anonymity when you visit our website.

No Tracking Cookies: We do not use tracking cookies, advertising pixels, or third-party analytics tools that identify you or track your behavior across the web.
Essential Cookies: We only use "strictly necessary" cookies (e.g., session tokens) that allow you to stay logged into your account. These do not track your identity or personal habits.

Data Storage and International Transfers

Your data is stored on secure servers located in the United States.

Because we transfer data outside of the European Economic Area (EEA), we ensure a similar degree of protection is afforded to it by implementing Standard Contractual Clauses (SCCs) approved by the European Commission, or relying on other recognized adequacy frameworks.

Data Retention

We retain your account information for as long as your account is active. Business data entered into the system is retained until you delete it or terminate your account. Upon request, we will permanently purge all associated data from our active databases and backups within 30 days.

Your Rights (GDPR)

Depending on your location, you have the following rights regarding your personal data:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request that we correct inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data.
Right to Data Portability: You can request a transfer of your data to another service in a machine-readable format.
Right to Object: You can object to our processing of your data based on legitimate interests.

Third-Party Service Providers

We do not sell your data. We use a limited number of trusted infrastructure providers (e.g., Stripe / AWS / Azure) to maintain our service. These providers are bound by strict data processing agreements and are prohibited from using your data for any purpose other than providing the infrastructure we pay for.

Data Processing Agreement (DPA)

For our business customers who are Data Controllers under GDPR, we are can sign a formal Data Processing Agreement (DPA) to ensure your compliance requirements are met. Please contact us to request a copy of our DPA.

Contact Us

If you have questions about this policy, wish to lodge a complaint or exercise any of these rights, please contact us.