Privacy Policy
This policy explains how Creative Creatures processes information when agencies use the platform and connect third-party services, including Zoom.
1. Information we process
We process account and profile information supplied during registration, such as name, email address, agency identity, authentication information, and workspace configuration. We also process diagnostic, goal, scorecard, leadership, financial-evidence, and integration data that a user chooses to provide or connect.
2. Zoom information
When a user authorizes Zoom, Creative Creatures receives the connected user's Zoom user ID, Zoom account ID, name, email address, user type, timezone, granted scopes, OAuth access token, OAuth refresh token, and token expiration time.
When the user opens the Zoom manager, Creative Creatures retrieves meeting information needed to display and manage that user's meetings: meeting ID, topic, status, start time, duration, timezone, agenda, join URL, waiting-room setting, and join-before-host setting.
Meeting information is requested from Zoom when the user opens or refreshes the Zoom manager. Creative Creatures stores the encrypted OAuth connection, not a permanent copy of the meeting roster. The integration does not request recordings, transcripts, chat messages, attendance reports, camera data, or microphone data.
3. How information is used
- Authenticate users and keep agency workspaces separated.
- Provide scorecards, goals, leadership workspaces, Monitor dashboards, and connected-service features.
- List, create, update, and delete meetings at the user's direction.
- Protect the service, diagnose errors, prevent abuse, and meet legal obligations.
4. Legal bases
Where applicable, information is processed to perform our agreement with the user, based on consent for optional integrations, for legitimate interests in operating and securing the service, and to comply with law.
5. Service providers and disclosure
We use infrastructure and database providers to host the application and store account-scoped records. These providers process information only to deliver their contracted services. We may disclose information when legally required, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards.
Creative Creatures does not sell Zoom user data and does not use Zoom user data for advertising.
6. Security
OAuth tokens are encrypted using AES-256-GCM before database storage. Integration tables are server-only, row-level security is enabled, and browser users cannot read token records directly. Traffic is protected with HTTPS. No system can guarantee absolute security.
7. Retention and deletion
The Zoom connection record is retained while the agency keeps the integration connected. Disconnecting Zoom attempts to revoke the authorization and deletes the stored connection record. Users may also request deletion of their Creative Creatures account and associated data by contacting support. Records may be retained when required by law, security, fraud prevention, or legitimate dispute resolution.
8. Choices and rights
Users can disconnect Zoom at any time from Integrations. Depending on location, users may request access, correction, deletion, restriction, portability, or objection. We may need to verify identity and authority over the relevant agency workspace.
9. International processing
Information may be processed in countries other than the user's country. Where required, appropriate contractual or legal transfer safeguards are used.
10. Children
Creative Creatures is a business service and is not directed to children under 16.
11. Changes
We may update this policy when the service, integrations, or legal requirements change. The effective date above identifies the current version.
12. Contact
Privacy questions and requests can be sent to creature@creativecreatures.org.