Privacy Policy
Updated:
Privacy Policy
Last updated: 15/10/2026
This Privacy Policy explains how Kimu Labs SL, trading as Creonda (“we”, “us”, or “our”), collects, uses, and protects your personal data when you visit our website (creonda.com), use our platform (app.creonda.com), or find Creonda creators through a supported AI assistant. We are committed to handling your data responsibly and in compliance with the GDPR and applicable Spanish and EU data protection law.
1. Who We Are (Data Controller)
Kimu Labs SL (trading as Creonda) is the data controller responsible for your personal data.
Address: Konporte kalea 30, local 12D, 48992 Getxo, Bizkaia, Spain
Email: support@creonda.com
Phone: +34 628 887 303
2. The Data We Collect
From Organizations (brands and agencies), we collect:
Name, company name, job title, email address, and phone number
Campaign briefs, requirements, product and project texts, and uploaded files
Billing information (processed via Stripe; we do not store card details)
Communications sent via the platform (messages, feedback, approvals)
From Creators, we collect:
Account data: first and last name, email address, password (stored as a hash), Google account ID if you sign in with Google, two-factor authentication settings, interface language, and account status
Contact and address data: phone number, postal address, website, Instagram and TikTok handles, and preferred contact method
Profile data: profile photo, bio, date of birth, gender, city and country, languages and dialects, profession, experience, niches, content formats, starting price, availability status, pitch video, portfolio videos and casting photos, and brands you have worked with
Casting questionnaire answers you choose to provide, covering appearance (such as tattoos, piercings, glasses), equipment, filming settings and home environment, mobility and vehicles, interests, who can appear on camera (partner, children, pets), whether you are a parent, the paid-media usage you allow, and your content preferences and comfort settings (for example attire, faceless content, alcohol or food content, and whether you are available for pregnancy-related content). All questionnaire answers are optional.
Couple Connect data: the linked partner profile and relationship type, if you use this feature
Instagram data, if you connect your Instagram account: user ID, username, account type, follower and media counts, average views, likes and comments, and an access token used to refresh these statistics
Tax identification number (Steuernummer, USt-IdNr, NIF, or equivalent), VAT status, and chamber-of-commerce number where applicable
Invoices uploaded to or generated on the platform (containing name, address, tax ID, and bank details)
Payment and bank details (IBAN, payment email) for payout via Stripe
Platform activity: applications, running and completed jobs, client ratings and reviews, response times, Top Choice status, onboarding progress, and internal quality assessments
Referral and marketing data: your referral code, who referred you, how you heard about us, and your email preferences
Content files, video submissions, chat messages, and communications sent via the platform
From all visitors, we collect:
IP address and browser/device information
Pages visited, time on site, and navigation patterns (via analytics, where you consent)
Data submitted through forms (demo requests, contact messages, newsletter sign-ups)
Cookie data (see our Cookie Policy)
Server log data: when you use app.creonda.com or our API, our web servers record your IP address, request time, requested URL (including any referral parameters in the link you followed), status code, referrer, and browser user agent. Application error logs may contain the failing URL and, in some cases, a user ID.
If you arrive from an AI assistant result: the referral values and search-reference code contained in the link, as described in section 4
3. How We Use Your Data
To operate the platform:
Matching brands with appropriate creators. Legal basis: Contract performance
Facilitating briefing, messaging, feedback, and content delivery. Legal basis: Contract performance
Processing payments, holding escrow, and triggering payouts. Legal basis: Contract performance
Receiving, validating, and storing creator invoices for payment processing and tax compliance. Legal basis: Contract performance / Legal obligation
Issuing invoices to Organizations for the full Order value. Legal basis: Contract performance / Legal obligation
Showing optional casting questionnaire answers on your profile so brands can assess fit. Legal basis: Contract performance; for answers that could reveal health-related information (such as availability for pregnancy-related content), your explicit consent, given when you answer the optional question
Providing AI-powered features (creator search, script generation, brand information, support chatbot). Legal basis: Contract performance / Legitimate interest
Displaying Instagram statistics on your profile, if you connect your account. Legal basis: Consent
Keeping server and application logs to operate, debug and secure the service. Legal basis: Legitimate interest (service security and integrity)
To make creators discoverable through AI assistants (see section 4):
Providing selected public creator-profile information to supported AI assistants. Legal basis: Contract performance (creators join Creonda to be found by brands) and Legitimate interest: our interest in operating and promoting the marketplace and the creator’s interest in being found, balanced by sharing only information already published on the public profile, excluding contact and sensitive data, and offering an opt-out
Recording integration search requests to operate, improve and account for the service. Legal basis: Legitimate interest
Preventing abuse of the integration through rate limiting. Legal basis: Legitimate interest (service security)
Measuring visits and signups that come from AI results. Legal basis: Consent
To comply with legal obligations:
DAC-7 reporting of Creator transaction data to tax authorities. Legal basis: Legal obligation
Retention of invoices and transaction records for tax compliance. Legal basis: Legal obligation
Cooperation with competent authorities where required. Legal basis: Legal obligation
To communicate with you:
Sending transactional and onboarding emails about your account and orders. Legal basis: Contract performance
Responding to enquiries and providing support. Legal basis: Legitimate interest / Consent
Sending platform updates and marketing emails (where opted in). Legal basis: Consent
To improve our service:
Analysing usage patterns with analytics cookies. Legal basis: Consent
Using aggregated and anonymised statistics. Legal basis: Legitimate interest
Where we rely on legitimate interests, you can object at any time (see section 7).
4. AI-Powered Features and Automated Processing
We use artificial intelligence for several features: the creator AI search, the script writer, brand information, suggested replies for our support team, and the support chatbot. These features are powered by Google’s Gemini API and Anthropic’s Claude API (see section 5). Prompts sent to these providers can contain briefs, product and project texts, and chat messages. No fully automated decision-making with legal or similarly significant effects takes place without human involvement. You have the right to request human review of any AI-assisted process that affects you. Contact us at support@creonda.com to do so.
Creonda in AI assistants
Creonda provides an integration that lets businesses discover creators through supported AI assistants. At launch, this integration is available in ChatGPT (OpenAI). Other AI assistants that support the open MCP standard, such as Claude (Anthropic), may connect to the same interface and receive exactly the same information under the same limits. Kimu Labs SL operates this integration. It provides selected public creator-profile information and links to profiles on app.creonda.com. The integration is read-only: an AI assistant can search and view profiles, but cannot create orders, send messages, or change anything on the platform.
Creator information shared
Everything shared through the integration is information that is already visible on your public Creonda profile. Depending on the search and the information published on the profile, results may include:
Profile and content: first name, age and age range, gender, city, country, languages, dialects, niches, content formats, permitted paid-media use, which people or pets can appear on camera, Couple Connect availability, bio and profession (with email addresses, links, handles and long numbers removed automatically), and the reasons the creator matched the search.
Production and background: equipment, filming settings, home energy systems, mobility and vehicles, housing and outdoor spaces, interests, and published appearance details such as tattoos, piercings and glasses.
Household and linked profiles: whether you are a parent and whether children or a partner can appear on camera (yes/no only); for linked Couple Connect creators, the partner’s first name, relationship type and public-profile link, provided the partner is also an approved adult creator. The number and ages of children are never shared.
Commercial information: starting price and its basis, rating average and count, completed jobs, years of experience, Top Choice status, availability status and status text, typical response time, aggregate Instagram follower count and average views, likes and comments (only if you connected Instagram and chose to show it), and brands you have worked with and their websites.
Media and links: profile photo, pitch video, up to five portfolio videos, casting photos with captions, and a link to your public Creonda profile. Public-profile and media URLs contain your public profile name.
Information excluded and AI providers
The integration never shares your surname, email address, phone number, address or postcode, date of birth (only your computed age), social media handles, review texts, earnings, payout, bank or tax data, internal ratings or notes, children’s ages, your content preference and comfort answers, pregnancy-related answers, account timestamps, or internal database identifiers. We automatically remove contact details from creator-written text; automated filtering may not remove every detail embedded in text or media.
The AI-assistant provider receives the information needed to display results to its users and handles it as an independent controller under its own terms and privacy notice. We receive the search filters the assistant sends and, from ChatGPT, a pseudonymous user identifier that we hash in memory for rate limiting and discard within about two minutes.
Creators can exclude their profile from AI assistants at any time in their profile settings or by contacting support@creonda.com.
Search records and security
For each integration request, we record the tool used, the assistant label, the requested language, the filter values the assistant sent (including filter values we could not match), the result count, the public profile names of up to the first 20 creators shown, processing time, status and a random reference code. We record the word count of a free-text query, not the query itself. Filter values may still contain information supplied in the request. Search records do not contain IP addresses, user agents or assistant-account identifiers and are deleted after 400 days.
For abuse prevention, our rate limiter keeps short-lived counters keyed by hashes of the API key, the assistant label combined with the calling server’s IP address, or the hashed pseudonymous user identifier. These counters expire with their time window and are deleted within two days.
Visits and signups from AI results
Links in AI results contain a random search-reference code and referral parameters. With your consent to attribution measurement, we use the creonda_attrib cookie for up to 90 days to store these values and a random browser identifier. A visit record contains the referral values, the landing path (without query string), the creator profile visited, the language, and a hash of the browser identifier combined with the search, so visits from one browser through different searches cannot be linked. Visit records exclude IP addresses and user agents and are deleted after 400 days.
If you subsequently create an account, with the applicable attribution consent we attach the first recorded AI-referral source (source, medium, campaign, search reference, landing path and time) to that account to understand which channel brought you to Creonda. This account record excludes the browser identifier, so it cannot be joined to your anonymous visits. It is removed on request or when the account is deleted. Mandatory retention of invoices and transaction records is separate.
This attribution measurement applies to AI-referral visits by visitors who are not logged in. Website server logs are separate from these records and are described in sections 2 and 6. A session cookie may also remember the language supplied in a referral link, as described in our Cookie Policy.
Your choices
You can refuse or withdraw attribution consent through Cookie settings on app.creonda.com. Withdrawal stops future consent-based attribution processing without affecting the lawfulness of processing before withdrawal. For access, correction, deletion or an objection to processing based on legitimate interests, use the contact in section 7 of this policy. Creators can use that contact for questions or requests concerning visibility in AI assistants.
5. Who We Share Your Data With
We do not sell your personal data. We may share it with the following providers:
Hosting and infrastructure
Amazon Web Services EMEA SARL (Luxembourg), region Frankfurt, Germany: hosting of the platform, API, database, media storage (videos, photos, avatars) and video processing.
Framer (website hosting): to serve the marketing website at creonda.com.
Payments and invoicing
Stripe Payments Europe Ltd (Ireland): payment processing and creator payouts. Card data is handled only by Stripe.
Invopop S.L. (Spain): invoicing and tax compliance through the TicketBAI/BATUZ system.
Communication
Twilio SendGrid (Twilio Inc., USA): transactional emails (recipient address, name and email content).
Customer.io: onboarding email sequences.
Cal.com (USA): demo bookings via the website.
AI providers
Google (Google Ireland Ltd / Google LLC, USA), Gemini API: creator AI search, script writer, brand information and support reply suggestions.
Anthropic PBC (USA), Claude API: support chatbot and fallback for the creator AI search.
OpenAI (OpenAI Ireland Ltd / OpenAI LLC, USA): provider of ChatGPT, through which the creator discovery integration is offered. OpenAI sends us the user’s search filters and receives the public creator-profile information described in section 4, which it handles under its own terms and privacy notice.
Other MCP-compatible AI assistant providers (for example Anthropic for Claude), if a user connects such an assistant to our integration: same information and same pattern as above.
Other services
Google Ireland Ltd: Sign-in with Google, Google Tag Manager and the analytics and advertising tags configured in it (only with your consent), Google Drive file import (optional), and YouTube embeds in privacy-enhanced mode.
Meta Platforms Ireland Ltd (Instagram Graph API): to retrieve Instagram statistics for creators who connect their account.
Providers that process personal data on our behalf are contractually required to process your data only as instructed and in compliance with GDPR. AI-assistant providers such as OpenAI act as independent controllers for the data they receive. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (see section 11).
6. How Long We Keep Your Data
Account and profile data: retained for the duration of your relationship with us, plus up to 6 years after account closure (to comply with Spanish commercial and tax law, Art. 30 Código de Comercio).
Invoices and transaction records: retained for 6 years to meet legal and financial obligations.
Creator invoices uploaded to the platform: retained for 6 years regardless of account closure or deletion requests.
Marketing consent records: retained until you unsubscribe, then for a further 2 years as proof of consent.
Website analytics data: retained in aggregated form for up to 26 months.
Support and contact messages: retained for up to 2 years after your last communication.
Web server access logs and application logs: retained for 14 days.
AI-assistant search records and AI-referral visit records: deleted after 400 days by an automated nightly job.
Abuse-prevention counters for the AI-assistant integration: deleted within two days.
AI-referral attribution cookie (creonda_attrib): up to 90 days.
AI-referral source attached to an account: removed on request or when the account is deleted.
Where a specific period is stated above for AI-assistant records, that period applies in place of the general account and profile retention period. When data is no longer needed, it is securely deleted or anonymised.
7. Your Rights Under GDPR
As a data subject, you have the following rights:
Right of access: request a copy of the personal data we hold about you.
Right to rectification: ask us to correct inaccurate or incomplete data.
Right to erasure: request deletion of your data, subject to legal retention obligations (e.g. invoices must be retained for 6 years).
Right to restrict processing: ask us to limit how we use your data in certain circumstances.
Right to data portability: request your data in a structured, machine-readable format.
Right to object: object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at support@creonda.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.
8. DAC-7 Tax Reporting
In compliance with EU Directive 2021/514 (DAC-7), we are required to collect and report certain information about Creators and their transactions to the relevant tax authorities annually. This includes: the Creator’s identity, address, tax identification number, bank account details, and total consideration received through the Platform during the reporting period. By using the Platform as a Creator, you acknowledge this reporting obligation.
9. Cookies
Our website and platform use cookies. Cookies that are not strictly necessary, including analytics tags and the AI-referral attribution cookie, are set only after you consent. For detailed information on the cookies used and how to manage your preferences, please refer to our Cookie Policy at creonda.com/terms/cookie-policy. On app.creonda.com you can change your choices at any time through Cookie settings.
10. Data Security
We implement appropriate technical and organisational measures to protect your data, including encrypted data transmission (HTTPS), hashed passwords, optional two-factor authentication, access controls, allow-listing of the data that can leave the platform through the AI-assistant integration, and secure hosting infrastructure in the EU. In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the relevant supervisory authority as required by GDPR.
11. International Data Transfers
Our platform, database and media are hosted in the EU (Frankfurt, Germany). Some of our providers are based outside the EEA or may transfer data there: Anthropic (USA), Google LLC (USA, for the Gemini API), OpenAI LLC (USA, for the ChatGPT integration), Twilio SendGrid (USA), and Cal.com (USA). Stripe Payments Europe Ltd (Ireland) may transfer data to its US affiliates under its own safeguards. In each case, we rely on appropriate safeguards: the provider’s certification under the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Where you use another AI assistant to access Creonda, the location of that assistant’s provider depends on the service you choose.
12. Children and Minors
Creonda is intended for businesses and adult content creators. Creator accounts are only available to people aged 18 or over, and we do not knowingly create accounts for or collect personal data from anyone under 18. Only creators with a verified adult date of birth are shown through the AI-assistant integration, and a Couple Connect partner under 18 is never named.
Content produced on the platform may, at a brand’s request, show a child, for example a creator’s own child. Creators may only include a minor in content if they are the child’s parent or legal guardian or have that person’s consent, and they are responsible for complying with applicable rules on children in advertising productions. We process such footage only as part of the content delivered through the platform, and we never share children’s ages or identities through the AI-assistant integration.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will update the ‘Last updated’ date and, where appropriate, notify you by email or via the platform.