Personal Data Protection Notice

1. Collection of Personal Data

Lemon Sky Edge Sdn Bhd ("CreatorCity", "we", "our", or "us") collects and processes personal data provided by you, or provided about you by the organization that holds your team workspace, when you interact with us through CreatorCity.ai, including:

• Registering an account, whether by email or through a third-party sign-in provider
• Using the studio: uploading product and reference media, submitting prompts, and generating video, image, or audio
• Buying a subscription plan or credit pack through Stripe
• Accepting an invitation to a team workspace
• Creating an avatar, listing it on the marketplace, or completing identity verification
• Publishing a public creator profile or posting to the community board
• Posting or applying to work on the work marketplace
• Contacting us by email or through support channels
• Visiting our website, where strictly necessary cookies keep you signed in and secure

2. Types of Personal Data Collected

The personal data collected may include:

• Name, email address, and login identifiers
• Profile details, including your handle, display name, avatar image, and bio
• Uploads, prompts, generation settings, and the media generated for you
• Subscription, credit, and transaction records, including invoices and payment references (payment cards are processed by Stripe — we never hold your card number)
• Team workspace membership, roles, and credit usage
• Work-marketplace postings, applications, and verification status
• Technical data such as IP address, device information, and application usage logs
• Correspondence with us, and marketing preferences

Sensitive personal data, which under the PDPA includes biometric data, will only be collected where lawful and necessary. Recordings or images of a face or voice submitted to create an avatar or voice clone may constitute sensitive personal data; they are collected only with your explicit consent, used only to create and run the avatar you requested, and deleted when the avatar is deleted or consent is withdrawn.

3. Purpose of Collection and Processing

Your personal data is collected and processed for the following purposes:

• Creating and administering your account and team workspace
• Running the generations you request and storing the results in your asset library
• Charging and refunding credits, processing payments, and maintaining accounting and tax records
• Operating the avatar marketplace, public creator profiles, the community board, and the work marketplace, where you choose to use them
• Responding to enquiries and providing support
• Sending service messages such as receipts, credit notices, and security alerts
• Sending marketing communications where you have consented
• Moderating content, enforcing our terms, and detecting and preventing fraud, misuse, and security incidents
• Complying with legal, regulatory, tax, and contractual obligations

Your personal data will not be processed for purposes other than those stated above unless required or permitted by law.

4. Mandatory or Voluntary Disclosure

The provision of your personal data is voluntary, unless otherwise stated.

Certain personal data is mandatory where it is required to:

• Create and secure your account, namely your email address and login identifiers
• Process a payment or issue an invoice
• Verify identity where a marketplace listing or work posting requires it
• Comply with legal, regulatory, or tax requirements

If you do not provide personal data that is required for these purposes, we will be unable to register you, process your payment, publish your listing, or respond to your enquiry.

Consent to create an avatar or voice clone from your likeness, and consent to receive marketing, are always voluntary and are never a condition of using the studio.

5. Disclosure of Personal Data

Your personal data may be disclosed to:

• Authorised personnel within Lemon Sky Edge Sdn Bhd and its group companies, on a need-to-know basis
• Supabase, which hosts our database and authentication
• Cloudflare, which stores uploads and generated media and streams video
• Stripe, which processes payments
• Resend, which delivers transactional and marketing email
• AI generation providers, which process the prompt and reference media for a generation in order to render it, including ByteDance/Volcano Engine (Seedance), MiniMax, PixVerse, and OpenAI-class image model providers
• The organization that holds your team workspace, in respect of your membership, role, and usage of the shared credit pool
• Other users, where you choose to publish a profile, listing, post, or application that is visible by design
• Professional advisors, including legal, accounting, and audit services
• Regulatory, governmental, or law enforcement authorities where required by law

CreatorCity does not sell personal data to third parties.

6. Transfer of Personal Data Outside Malaysia

Our service providers operate outside Malaysia. Your personal data will be transferred to and processed in the jurisdictions where those providers operate — principally the United States, where Supabase, Cloudflare, Stripe, and Resend process data, and the jurisdictions where our AI generation providers run their models. If we engage a provider in a materially different jurisdiction, we will update this Notice and our Privacy Policy before that provider is used.

We carry out these transfers on the basis of your consent, the necessity of the transfer to perform our contract with you, and contractual protections with each recipient, and we keep a record of the recipients, destination countries, categories of data, and purposes involved. Full detail is set out in our Privacy Policy.

7. Data Security and Retention

We take reasonable technical and organisational measures to safeguard personal data against unauthorised access, disclosure, loss, or misuse, including access controls, row-level security on our database, encryption in transit, private-by-default storage for your uploads with signed access URLs, and restricted handling of avatar and voice-clone source material.

Personal data is retained only for as long as necessary to fulfil the stated purposes or to comply with legal obligations, after which it is securely deleted, destroyed, or anonymised. Billing records are retained for 7 years as required by Malaysian tax and company law. Retention periods for each category of data are set out in our Privacy Policy.

8. Data Subject Rights

Subject to the PDPA, you have the right to:

• Request access to your personal data
• Request correction of inaccurate, incomplete, misleading, or out-of-date personal data
• Withdraw your consent to processing, where processing is based on consent, including consent to an avatar or voice clone of your likeness
• Limit or stop processing of your personal data for direct marketing
• Request that your personal data be transmitted to another data controller, where technically feasible

Requests must be made in writing using the contact details below. Withdrawal of consent may affect our ability to provide the service to you.

9. Consent

By providing your personal data to CreatorCity, registering an account, or using the service, you consent to the collection, processing, disclosure, and transfer of your personal data in accordance with this PDPA Notice, including the transfer of your personal data outside Malaysia as described in section 6.

Where you provide personal data belonging to another individual, including where you invite members to a team workspace, you confirm that you have that individual's consent and have informed them of this Notice.

Consent to create an avatar or voice clone from your likeness, and consent to receive marketing communications, are each collected separately, are optional, and may be withdrawn at any time without affecting your use of the studio.

10. Updates to This PDPA Notice

We may amend this PDPA Notice from time to time. Any material change will be published on our website or communicated through other appropriate channels, and the updated version takes effect upon publication unless otherwise stated.

11. Contact Information

For any enquiry, request, or complaint relating to your personal data or this PDPA Notice, contact:

Lemon Sky Edge Sdn Bhd
Email: privacy@creatorcity.ai
Address: M2-10-07 8Trium Tower, Jalan Cempaka SD 12/5, Bandar Sri Damansara, 52200 Kuala Lumpur, Malaysia
Data Protection Officer: Cheah Hon Seng, privacy@creatorcity.ai

You may also refer a complaint to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia, at pdp.gov.my.