Privacy policy

Who is responsible for your data

Make Creati is a sole proprietorship operating from Tampa, Florida, United States, and is the controller of the personal data described here.

For any privacy question, request, or complaint: info@makecreati.com. A postal address for formal correspondence is available on request.

The short version

Your PDFs are processed in your own browser and are not uploaded to our servers. We do not read, scan, sell, or train anything on your documents.

We collect the minimum needed to run an account and take payment: an email address, order records, and basic technical logs. Card details go to our payment processor and never reach us.

Your documents

Documents you open in the editor are read and edited entirely inside your browser using local processing. They are stored in your browser's local storage (IndexedDB) on your own device.

That means: we cannot see them, they are not backed up by us, and clearing your browser data or switching browser or device removes them. If you need a copy, download it.

If a future feature requires server-side processing, it will be clearly labelled and optional, and this policy will be updated before it is switched on.

Account information

If you create an account we store the email address you provide and a securely hashed password. We use it to sign you in, show your purchase history, and contact you about your account or a support request.

We do not send marketing email unless you separately opt in, and every marketing message includes an unsubscribe link.

Payments

Payments are handled by PayPal. When you pay, you are on PayPal's own payment pages and enter your card or PayPal details there. Make Creati never receives, sees, or stores your full card number.

We receive a confirmation that a payment succeeded, the amount, the plan, and a transaction reference, which we keep as your order record and for tax and accounting purposes.

PayPal processes your data as an independent controller under its own privacy policy at paypal.com. If you pay by card as a guest, PayPal still handles those details, not us.

Cookies and similar technologies

Strictly necessary: a session cookie to keep you signed in, and an entitlement cookie recording what you have paid for. The site cannot work without these and they are not used for advertising.

Local storage: your documents, cart contents, order history, and support requests are held in your browser's own storage rather than on our servers.

First-party visitor measurement: we count visits ourselves, on our own server, without a cookie and without sending that count to a third party. See the next section for exactly what is counted.

Google measurement: Google Analytics and Google Ads may use cookies or similar identifiers to help us understand public-page visits, editor starts, and whether an advert led to a purchase. It is on unless you switch it off from Privacy choices in the footer, and personalized advertising stays off.

You can clear or block cookies in your browser. Blocking the strictly necessary ones will stop sign-in and purchases from working.

How we count visitors

We keep a first-party count of how many people visit, which pages they open, and which website sent them, so we know whether the service is being found and used. This count is measured by our own server, sets no tracking cookie, and is not sent to another company.

We do not store a record of your individual visit. To count one person once per day without identifying them, we combine your IP address, your browser's user agent, a secret held only on our server, and today's date, and convert that into an irreversible code. Because the date forms part of it, the same person produces an unrelated code tomorrow, so there is no way for us to follow anyone from one day to the next, or to work backwards from a code to a person.

What is kept is a daily total: how many visits, which page addresses were opened, which website referred them, and whether the device was a phone, tablet or computer. Web addresses are recorded without anything after the question mark, and any document identifier in the address is removed before the address is stored. No document, document name, or document content is ever recorded.

This first-party count is separate from Google measurement and continues whether Google measurement is on or off. If you use an ad or tracker blocker it may stop either count, and the site works exactly the same either way.

Google measurement

One Google tag sends Google Analytics public-page visits, the public page where an editor was started, and confirmed purchase value and currency. Google Ads also receives a confirmed, non-simulated purchase so an advert can be measured. Google may receive standard technical information such as browser, device, approximate location, and recognized campaign identifiers such as Google click IDs or UTM parameters. Arbitrary query parameters are removed from the events we send.

We do not send PDF contents, file names, file sizes, document identifiers, email addresses, private account or admin page views, support details, or payment-return query strings to Google Analytics. Editor activity after a document opens stays in the first-party count described above.

Google measurement is on by default. If you switch it off from Privacy choices in the footer, the Google script is not requested on later pages and no browser measurement is sent to Google. The choice is kept in local storage as mc_google_measurement, and switching off also removes Google measurement cookies that this site can access.

Advertising and Google

We advertise this service, including through Google Ads. Google can use its measurement identifiers to attribute a confirmed purchase to an advert. Make Creati keeps Google Signals and personalized advertising disabled for this measurement.

You can switch Google measurement off at any time from Privacy choices in the footer. You can also manage personalised advertising in Google's Ads Settings and third-party vendor cookies via aboutads.info/choices.

We do not share your documents, document contents, or file names with any advertising partner. Advertising measurement is limited to public-page visits, a generic editor-start event, and confirmed purchase details needed for attribution.

Technical logs

Our hosting provider records standard server logs: IP address, timestamp, page requested, browser and operating system. These are used to keep the service running, investigate faults, and detect abuse.

Logs are retained for a short operational period and then deleted. They are not used to build a profile of you.

Who we share data with

Service providers who make the product work: our hosting provider, our payment processor (PayPal), and our email provider (Postmark) for transactional messages such as receipts and password resets. Each is bound to use the data only to provide that service.

Legal requirements: we may disclose information where we are required to by law, or to establish, exercise, or defend legal claims.

We do not sell personal information, and we do not share it with data brokers.

How long we keep things

Documents: on your device only, until you delete them or clear your browser data. We hold no copy.

Account records: while your account is open, and for a reasonable period afterwards to handle disputes.

Order and payment records: retained for the period required by tax and accounting law in the jurisdiction we operate in.

Support requests: kept while they are relevant to helping you, then deleted.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can also object to certain processing and withdraw any consent you have given.

Florida residents: the Florida Digital Bill of Rights applies to larger businesses and does not currently cover an operation this size, but we honour access and deletion requests from anyone who asks, regardless of where they live.

Depending on where you live you may have additional rights, including under the UK and EU GDPR, and under US state privacy laws such as the CCPA/CPRA. Californian residents have the right to know, to delete, to correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined.

To exercise any of these, contact info@makecreati.com. We will respond within the period the applicable law requires. You may also complain to your local data protection authority.

Children

This service is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact us and we will delete it.

Security

Traffic to and from the site is encrypted in transit. Passwords are stored hashed, never in plain text. Access to systems holding personal data is limited to those who need it.

Because documents stay on your device, the most important security control is your own: use a device and browser you trust, and do not leave sensitive documents in a shared browser profile.

Changes and contact

If we change this policy materially we will update the date on this page and, where the change affects how your data is used, tell you directly.

Questions, requests, or complaints: info@makecreati.com. Please do not send passwords, card numbers, or identity documents by email.