Privacy Policy

This policy explains what personal information Creative Advisor collects, why, who we share it with, and the choices you have. We’ve tried to write it in plain English. If something is unclear, email us at privacy@creativeadvisor.com.

1. Who we are and what this policy covers

“Creative Advisor”, “we”, “us” and “our” mean Creative Advisor LLC, a New York limited liability company, of 276 5th Avenue, Suite 704-3136, New York, NY 10001, United States.

This policy covers:

• Our website at www.creativeadvisor.com, including the call-booking form and the waitlist;
• Our blog at www.creativeadvisor.com/blog; and
• Our app at app.creativeadvisor.com, including Press Room, Brand Manager and First Pass (together, the “App”).

Together these are the “Services”.

Where we operate. We’re a US company, and we operate the Services from the United States. Our blog is read worldwide, so section 9 explains its cookie choices, including for visitors in Europe.

Important: data inside a workspace belongs to the workspace customer. Agencies and teams use the App to manage information about their own clients, brands and media contacts. For that information we act as a service provider on the customer’s behalf. The customer decides what goes in, and its own privacy notice applies. We also use it, under our agreement with the customer, to improve the App (see section 5). If you’re an agency’s client, or someone mentioned in a workspace, see sections 6 and 7.

2. The short version

• We collect what you give us, a small amount of technical data, and what our customers put into their workspaces.
• We don’t sell your personal information, and we don’t use it for targeted advertising.
• We learn from how the App is used, to make it better. We train our own models on usage data and on de-identified or aggregated data, and on a customer’s identifiable content only if that customer opts in. We don’t share one customer’s content with another, our AI providers’ terms don’t let them train on it, and we never sell it (section 5).
• Our website and the App don’t use analytics or advertising cookies. The blog uses Google Analytics, subject to the cookie settings described in section 9.
• You can ask us to access, correct, export or delete your information at any time (see section 12).

3. Information we collect

3.1 When you visit our website

• Booking a call. The booking form asks for your first and last name, email address, LinkedIn profile, website, and a short written answer. We email your answers to our team so we can prepare for the call. We don’t store them in a database. Then we send you to our Google Calendar booking page. Google collects the details you enter there, and the booking becomes an event in our calendar.
• Joining the waitlist. We collect your email address, which signup form you used, and when you signed up. If you choose to add them, we also collect your name, company, and whether you’re an agency or an in-house team. To stop abuse, we use your IP address briefly to limit repeated signups. We turn it into a one-way scrambled code (a keyed hash) before storing it and delete that code after 24 hours. We never store your raw IP address for the waitlist.
• Technical data. Like any website, our hosting provider (Vercel) receives your IP address, browser type and the pages you request, and keeps them in its server logs.

3.2 When you read our blog

• Analytics. The blog uses Google Tag Manager and Google Analytics 4 to understand how people use it: pages viewed, time on page, approximate location (city or region), device and browser, and the site that referred you. We also measure clicks on links to partner sites: the link, its text and the page it was on. See section 9 for cookies and how to opt out.
• Security. The blog is protected by Cloudflare, which may set cookies to block bots and malicious traffic.
• Fonts. The blog loads fonts from Google Fonts, so your browser sends your IP address to Google.
• Links to other companies. Some links on the blog take you to other companies’ websites, and we may be paid if you sign up or buy (see “How we make money” on the blog). Those companies may use their own cookies once you arrive.
• Requests. If you use the blog’s “Do Not Sell / remove me” form, we collect your name and email address to process your request.

3.3 When you use the App

Account information

• What we collect. Your email address, password (stored only in hashed form), display name and optional profile photo, the workspaces you belong to and your role in each. We also record when you were last active.
• Who can see it. Your teammates in a workspace can see your name and email address.
• Profile photos. These are stored so that anyone who has the link can view them.

Content you and your workspace add (“Customer Content”). This is information you or your teammates enter, upload or create in the App. It includes:

• client and brand profiles, bios, press kits and headshots;
• notes, outreach logs, comments and draft responses;
• transcripts, articles, social posts and other material added to Memory;
• coverage records and spreadsheets you import;
• LinkedIn post history and writing samples used by First Pass;
• brand names, competitors and tracked questions in Brand Manager;
• and the AI-generated results the App produces from all of this.

Information about people who aren’t App users. Customer Content often includes information about other people. Examples are a client’s biography, or the names, outlets, public profile links and contact routes of journalists, podcast hosts and producers. See section 7.

Activity data. We keep an activity log of actions in a workspace (for example “draft submitted” or “opportunity shared”), with who did it and when. We also keep records of AI tasks the App runs, including their inputs and outputs. We use these to run the features, show history, fix problems and understand costs.

Device and log data

• What our providers receive. Our hosting, database and sign-in providers (Vercel and Supabase) receive your IP address, browser details and request logs.
• Your browser. The App stores your sign-in session and a few settings in your browser’s local storage. Examples are your theme, layout and last-selected client, and an unsent First Pass brief, which is cleared when you submit it or sign out.
• Brand Manager icons. When Brand Manager shows website icons for cited sources, your browser fetches them from Google.

3.4 Information from other sources

• Public web. At a customer’s request, the App’s research features search the public web for opportunities that match a client. Examples are podcast directories, show pages and episode guest lists. They record the names and public details of shows, hosts and guests (see section 7).
• Journalist request services. We receive digest emails from public PR-request services, which list journalists’ requests along with their name, outlet and how to respond. We use them to find opportunities that match our customers’ clients.
• AI answer engines. Brand Manager records what services like ChatGPT, Gemini, Claude and Google’s AI Overviews say in response to questions our customers track. Those answers may mention people or companies.

4. How we use information

We don’t make decisions about you that have legal or similarly significant effects using automated processing alone.

Aggregated insights and research. We combine information across workspaces into aggregated, de-identified statistics, such as trends in media opportunities, outreach and AI visibility. We use them to improve the App, to give customers benchmarks, and to publish research. We don’t publish figures that identify any person, customer, client or brand. We commit not to try to re-identify de-identified data.

5. How the App uses AI

• Which providers. Many App features send information to third-party AI providers to generate results. We currently use Anthropic (Claude), OpenAI, and Google (Gemini).
• What we send. We send only what a feature needs, such as a client’s profile, relevant Memory, writing samples or a brief.
• Search providers for AI answers. To check Google’s AI Overviews, we send the tracked question, country and language to search-data providers (DataForSEO or SerpAPI).
• Our AI providers don’t train on your data. We use these providers under business terms that don’t allow them to train their models on our customers’ data. They may keep data for a limited time for safety and abuse monitoring, as their terms allow.
• Monitoring AI answer engines. Brand Manager asks AI services questions through their official APIs (or, for Google AI Overviews, through a licensed search-data provider). It doesn’t use anyone’s personal accounts and doesn’t scrape consumer apps. The services receive only the question text, country and language, not your brand profile.
• Matching across workspaces. When we receive journalist requests, we check each request against the clients of every workspace that uses that feature, so each workspace sees opportunities that fit its clients. To do this, our AI provider processes short client profiles from several workspaces together. The feature is designed so each workspace sees only matches for its own clients and never sees another workspace’s clients.
• Accuracy. AI output can be wrong, incomplete or out of date. It should be reviewed by a person before it’s relied on or published.

How we improve the App

We learn from how the App is used so we can make it better for everyone. This includes:

• Usage data, such as which features are used, which suggestions are accepted or rejected, ratings, match outcomes, timings and errors;
• Patterns and trends across workspaces, drawn from aggregated or de-identified data, to improve the App’s features, defaults and recommendations;
• Training and testing our own models and features on usage data and on de-identified or aggregated data. We train on a customer’s identifiable Customer Content only if that customer opts in in its agreement with us.

What we promise, whatever your plan:

• we don’t share one customer’s Customer Content with another customer, or tell other customers which clients a customer works with or which questions it tracks;
• features that learn from many workspaces are designed not to reproduce one customer’s content in another’s results;
• we won’t publish anything that identifies a person, customer, client or brand without permission;
• our AI providers’ terms don’t allow them to train on Customer Content; and
• we never sell it.

6. Agencies, teams and their clients

Who controls workspace data

• Agency workspaces are run by an agency (our customer) for its own clients. Team workspaces are run by a company for its own people and brands.
• The workspace customer controls the information in its workspace. We process it on the customer’s behalf, under our agreement with them. That agreement also lets us use it, in aggregated or de-identified form, to improve and develop the App (section 5).
• If you’re an agency’s client, your agency is responsible for your information in its workspace. Please contact your agency first with questions or requests. If you contact us, we’ll pass your request to them or help them respond.

Client portals

• An agency can invite its clients to a client portal. There a client can see opportunities their agency shares, respond, comment, update their press kit, and add coverage and content.
• Everything a client enters in the portal is visible to that agency’s staff.
• Press-kit headshots are stored so that anyone who has the link can view them.

If you leave

• If you delete your App account, your agency or team keeps the records it holds about you: client profile, press kit, drafts, Memory and coverage history.
• You can ask the agency or team to delete those records, or ask us to help.

Creative Advisor staff access

• A small number of authorized Creative Advisor staff can access workspaces. They use this access to operate, support and secure the App, to investigate problems, and when the law requires it.
• Support access. If you want our help inside your workspace, you can also invite our support account, which you can remove at any time.
• Automated processing is separate. Automated features, such as research, matching and AI processing, run without a person looking at your workspace. They are described in section 5.
• Test environment. With our customers’ permission, we may keep a copy of workspace data in a separate test environment. We use it to check changes before they reach the App. It is hosted by the same provider in the same region, access is restricted to authorized staff, and it can’t send email.

7. Journalists, hosts and other people mentioned in the App

The App helps people find and track media opportunities, so workspaces hold information about journalists, editors, podcast hosts, producers and guests.

What it is and where it comes from

• It is usually professional and publicly available: names, outlets, beats, public profile links, past appearances, and the response route a journalist published with a request.
• It comes from public web pages, from journalists’ own requests on PR-request services, and from what our customers enter.
• Where it is used:
  • Research results and contacts saved by a workspace stay in that workspace, apart from the aggregated or de-identified uses described in section 5.
  • Journalist requests we receive are stored by Creative Advisor and shown only to workspaces whose clients match.
• The App doesn’t email journalists. Users contact them, if at all, from their own email.
• Improving matching. We may use journalist requests we receive, which journalists publish to find sources, to improve matching and in aggregated research about how media requests work.

8. Who we share information with

We don’t sell personal information or share it for cross-context behavioral advertising. We share it only as follows.

Service providers that process data for us under contracts that limit their use of it:

Inside a workspace. Information in a workspace is visible to that workspace’s members according to their role. In agency workspaces, it is also visible to the client it relates to, through their portal.

Email senders and replies. App notification emails show the agency’s name and set “reply-to” to the person who took the action, so recipients can see who it came from.

Legal and safety. We disclose information when we believe in good faith that the law requires it, or to protect the rights, property or safety of our users, the public or Creative Advisor.

Business changes. If Creative Advisor is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. If so, it stays subject to this policy’s protections.

Aggregated research. We may publish aggregated, de-identified findings (section 4). We don’t publish findings that identify any person, customer, client or brand.

With your direction. We share information when you ask us to.

9. Cookies and similar technologies

• Website pages (outside the blog) and the App: no analytics or advertising cookies. The App keeps your sign-in session and preferences in your browser’s local storage. This is strictly necessary for it to work, and clearing your browser storage signs you out.
• Blog:
  • Strictly necessary: consent-preference cookies (wpconsent_preferences, wpconsent_geolocation, 30 days) and Cloudflare security cookies (for example __cf_bm, cf_clearance, which last for the session or up to 30 minutes).
  • Statistics: Google Analytics cookies (_ga, _ga_*, up to 2 years in your browser; Google Analytics keeps visit-level data for 2 months).
    • Visitors in the EU, UK and the rest of Europe see a banner with Accept, Reject and Manage preferences. Nothing runs until they accept.
    • Other visitors see a notice, and analytics runs unless they turn it off with Manage preferences.
  • Your cookie choice. When you make a choice, we keep a record of it for 1 year to show what you agreed to: the choice, the date, your country and a shortened (anonymized) IP address.
  • Signed-in WordPress staff only: WordPress login cookies.
  • Full list and settings: the blog’s Cookie Policy lists every cookie, and you can change your choice at any time from “Cookie settings” in the blog footer. You can also block cookies in your browser, or install Google’s Analytics opt-out add-on.
• Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a choice to turn off statistics and marketing cookies on the blog.

10. Emails

• Emails we send:
  • App users receive service emails: invitations, sign-in links, password resets and activity notifications.
  • Notification emails can include the text of drafts and comments. You can turn notification emails off with the unsubscribe link in any of them. Account and security emails can’t be turned off while you have an account.
• Newsletters and marketing emails. We send these only to people who sign up for them, or, where the law allows, to customers about similar services.
  • Every marketing email has an unsubscribe link and our mailing address.
  • Unsubscribing from marketing doesn’t stop account and security emails.
• We never email non-users. We don’t send email on your behalf to people who aren’t App users.

11. How long we keep information

We may keep information longer when the law requires it, or to resolve disputes and enforce our agreements.

12. Your rights and choices

Some US state laws give people rights over their personal information. We offer these to everyone, wherever you live. You can ask us to:

• access the personal information we hold about you and get a copy;
• correct it;
• delete it; and
• stop sending you marketing emails.

You can also opt out of the “sale” or “sharing” of personal information or targeted advertising, but we don’t do these things.

Deleting your information doesn’t remove aggregated or de-identified data, because it can’t be linked back to you.

How to make a request

• Email privacy@creativeadvisor.com.
• You can also delete your App account yourself from the Account page.
• We’ll respond within 30 days (45 days where state law allows), and we may need to confirm your identity first.
• You can use an authorized agent. We won’t treat you differently for exercising your rights.
• If we can’t fulfil a request, we’ll tell you why. Where we handle the information on a customer’s behalf (see section 6), we’ll send your request to that customer.
• Exports. You can export some information yourself as a spreadsheet, such as coverage records and Brand Manager results. For anything else, email us.

Appeals. If we deny your request, you can appeal by replying to our decision.

13. Deleting your App account

When you delete your account from the Account page, we delete your sign-in, profile and workspace memberships. The following is not deleted:

• Records your agency or team keeps. Records an agency or team holds about you, such as your client profile, press kit, drafts, Memory and coverage, stay with that workspace (see section 6).
• Your activity log entries. These stay, with your name removed.
• Comments you posted. These stay in the workspace.
• Your profile photo. Email us to have it removed.
• A record that you accepted our Terms and this policy. We keep the version and date, linked to an internal ID rather than your name or email, so we can show what was agreed.

If you’re the only admin of a workspace, you’ll need to make someone else an admin, or ask us to close the workspace, before you can delete your account.

14. Security

• Protections in place:
  • encryption in transit;
  • database rules that keep each workspace’s data separate;
  • hashed passwords and invitation codes; and
  • access limited to staff who need it.
• No system is perfectly secure. If a breach affects your information, we’ll notify you as the law requires.

15. Where we process information

We’re based in the United States, we operate the Services from the United States, and our providers store and process information in the United States. Your database records are stored in Oregon. If you use the Services from outside the US, your information will be processed in the US, where privacy laws may differ from those where you live.

16. Children

The Services are for business use and aren’t directed to children. You must be at least 18 to use them. We don’t knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we’ll delete it.

17. Changes to this policy

We’ll post any changes here and update the “Last updated” date. If a change is material, we’ll give at least 30 days’ notice before it takes effect. App users will be notified by email or in the App; others will see a notice on the website. Changes required by law, or that only add new features, can take effect immediately.

18. Contact us

Creative Advisor LLC
276 5th Avenue, Suite 704-3136, New York, NY 10001, United States
Privacy questions and requests: privacy@creativeadvisor.com
General: hello@creativeadvisor.com