Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data relating to individuals who interact with CreatorCity, including:

• Account holders who register for and use the studio
• Members of a team workspace whose details are submitted by the organization that holds the workspace
• Visitors to creatorcity.ai
• Creators who list an avatar on the marketplace or maintain a public creator profile
• Brands and individuals who post or apply to work on the work marketplace
• Individuals who contact us by email or through support channels
• Marketing contacts

This Privacy Policy does not replace any specific PDPA notice issued at the point of collection, and it does not replace the terms that govern subscriptions, credits, and use of the service.

2. Definition of Personal Data

"Personal Data" means any information that relates directly or indirectly to an identifiable individual, including:

• Name, email address, and login identifiers
• Profile information, such as your handle, display name, avatar image, bio, and any content you choose to publish on a public creator profile
• Content you upload to the studio, including product images, reference images, video, and audio
• Prompts, briefs, and generation settings you submit, and the media the studio generates for you
• Subscription, credit, and transaction records, including invoices and payment references (payment cards are processed by Stripe — we never hold your card number)
• Team workspace records, including membership, roles, seat usage, and per-member credit caps
• Work-marketplace records, including postings, applications, and identity- or company-verification status
• Correspondence with us, including support requests and email threads
• Online identifiers such as IP address, device and browser information, and application usage logs
• Marketing preferences and engagement data

"Sensitive Personal Data" under the PDPA includes biometric data. Recordings or images of a person's face or voice used to create an avatar or voice clone may constitute sensitive personal data. Section 7 sets out how we handle avatar and clone material.

3. Collection of Personal Data

We collect personal data through the following means:

• Account registration, whether by email or through a third-party sign-in provider you choose (which shares your name, email, and avatar image with us)
• Your use of the studio: uploads, prompts, and generated results
• Checkout and billing flows operated with Stripe when you buy a plan or credit pack
• Team workspaces, where the workspace owner supplies member emails to send invitations
• Avatar creation, marketplace listings, and the identity-verification steps attached to them
• Work-marketplace postings and applications
• Support requests and email correspondence
• Cookies and similar technologies that are strictly necessary to keep you signed in and secure, as described in section 14

We collect personal data fairly and for the purposes set out below. We do not purchase personal data from data brokers.

4. Purpose of Processing

Personal data is processed for the following purposes:

• Creating and administering your account and, where applicable, your team workspace
• Operating the studio: running generations you request, storing your uploads and results in your asset library, and organising them into projects
• Charging and refunding credits, processing subscription and top-up payments, and maintaining accounting and tax records
• Operating the avatar marketplace and public creator profiles you opt in to
• Operating the work marketplace, including verification checks that make postings and applications trustworthy
• Responding to enquiries and providing support
• Sending service messages such as receipts, credit and subscription notices, and security alerts
• Sending marketing communications about the product where you have consented
• Moderating content and enforcing our terms, including detecting and preventing fraud, abuse, and security incidents
• Maintaining and improving the service, including diagnostics and aggregated usage analysis
• Complying with legal, regulatory, tax, and contractual obligations

Personal data will not be processed for purposes incompatible with those stated above unless required or permitted by law.

5. Legal Basis for Processing

We process personal data on one or more of the following grounds:

• Your consent, including your explicit consent to the transfer of personal data outside Malaysia and to the creation of an avatar or voice clone from your likeness
• Performance of a contract with you or with the organization that holds your team workspace, or steps taken at your request before entering into a contract
• Compliance with legal or regulatory obligations, including tax and record-keeping requirements
• Processing that is necessary for our legitimate business operations, including security, fraud prevention, moderation, and improvement of the service, where the PDPA permits processing on that ground and where the processing is reasonable and does not prejudice your rights

For users located in the European Union, the United Kingdom, or California, section 17 sets out additional rights and the corresponding legal bases.

6. Members of a Team Workspace

Team plans are held by an organization that invites its own people into a shared workspace. The following applies to those arrangements.

Where the details come from. The workspace owner supplies your email address so that we can send you an invitation. Your account is created only when you accept. We rely on that organization having a lawful basis for the disclosure and having informed you of it.

What the organization can see. Workspace admins can see your membership, role, credit usage drawn from the shared pool, and work created in shared workspace projects. They do not see your password or your personal account activity outside the workspace.

Your rights are unaffected. You may contact us directly using the details in section 21 to access or correct your personal data, regardless of who pays for your seat.

7. Avatars, Voice Clones, and Biometric Data

The studio can create AI avatars, including clones built from recordings of a real person's face or voice. Because facial images and voice recordings may constitute biometric data, we treat clone source material as sensitive personal data.

Consent. A clone is created only from material you submit with your explicit consent, and only of your own likeness or a likeness you have documented rights to use. Creating a clone of another person without authority is a breach of our terms and grounds for account action.

Marketplace listings. Listing an avatar on the marketplace is optional and separate from creating one. Identity verification may be required before a listing goes live, so that licensed likenesses on the marketplace are genuine.

Withdrawal. You may delete an avatar or withdraw consent at any time using your account settings or the contact details in section 21. On withdrawal we stop further use and delete the clone and its source material from systems under our control, though media already generated with it and delivered to other users may persist in their libraries.

8. Third-Party AI Providers

Generation runs on third-party AI models. When you submit a generation, the prompt and any reference media needed for that job are transmitted to the relevant provider to render the output. Providers we use include ByteDance/Volcano Engine (Seedance), MiniMax, PixVerse, and OpenAI-class image model providers; the current set can change as we add or retire models.

Providers process this material to fulfil the generation request under contracts with us. Do not include personal data about other people, confidential client material, or anything covered by an obligation of confidentiality in prompts or uploads unless you have the right to use it.

9. Disclosure of Personal Data

Personal data may be disclosed on a need-to-know basis to:

• Authorised personnel within Lemon Sky Edge Sdn Bhd and its group companies
• Infrastructure and database providers — Supabase hosts our application database and authentication
• Storage and media delivery providers — Cloudflare stores uploads and generated media (R2) and streams video (Stream)
• Payment providers — Stripe processes subscription and credit-pack payments; we never hold payment card numbers
• Email providers — Resend delivers transactional and marketing email
• AI generation providers, as described in section 8
• The organization that holds your team workspace, as described in section 6
• Other users, where you choose to publish: a public creator profile, a marketplace avatar listing, a community-board post, or a work-marketplace posting or application is visible to its intended audience by design
• Professional advisors, including legal, accounting, and audit services
• Government, regulatory, or law enforcement authorities where required by law
• An acquirer or successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy continuing to apply

All third parties acting on our behalf are engaged under contracts that require appropriate security measures and processing in accordance with applicable data protection laws.

CreatorCity does not sell personal data to third parties.

10. Cross-Border Transfers

Our service providers operate outside Malaysia. Personal data, including account details, uploads, prompts, and generated media, is transferred to and processed in the jurisdictions where those providers operate — principally the United States, where Supabase, Cloudflare, Stripe, and Resend process data, and the jurisdictions where our AI generation providers run the models used for your generations. If we engage a provider in a materially different jurisdiction, we will update this Privacy Policy before that provider is used.

Before transferring personal data outside Malaysia we rely on one or more of the following, as required by the Personal Data Protection Guidelines on Cross-Border Transfer of Personal Data:

• Your explicit consent, given after you have been informed of the class of recipient and the purpose of the transfer
• The transfer being necessary to perform our contract with you, or to take steps at your request before entering into that contract
• Contractual protections with the recipient, based on recognised model contractual clauses, together with due diligence on the recipient's safeguards
• An assessment that the destination provides an adequate level of protection, where that assessment has been carried out and remains current

We maintain a record of the recipients, destination countries, categories of data, and purposes of each transfer. You may request a summary of the current recipient categories using the contact details in section 21.

11. Data Security

We apply technical and organisational measures appropriate to the nature and sensitivity of the data, including access controls and role-based permissions, row-level security on our database, encryption of data in transit, signed URLs for private media (customer uploads are private by default), restricted administrative access, logging, and contractual security obligations on our processors.

No system is completely secure. You are responsible for keeping your login credentials confidential and for notifying us promptly of any suspected unauthorised access to your account.

12. Data Breach Notification

Where a personal data breach occurs that causes or is likely to cause significant harm, or that affects more than 1,000 data subjects, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours of becoming aware of the breach. Where the breach is likely to cause significant harm to you, we will notify you without unnecessary delay and within 7 days of notifying the Commissioner.

13. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

When no longer required, personal data is securely deleted, destroyed, or anonymised.

14. Cookies, Analytics, and Advertising Technologies

CreatorCity uses cookies that are strictly necessary to operate the service — keeping you signed in and protecting your session. We do not run third-party advertising tracking technologies.

If we add analytics or advertising technologies, including tags from platforms such as Meta, Google, TikTok, or LinkedIn, we will publish a cookie notice and a consent control before those technologies are activated, and we will update this section first.

Where you click through to a third-party service from our site, including Stripe's checkout, that service sets its own cookies under its own policy.

15. Marketing Communications

We send marketing communications only where you have opted in. Consent is collected separately and is never bundled with account registration or acceptance of our terms.

Every marketing message contains an unsubscribe link. You may also withdraw consent, or serve a written notice requiring us to stop processing your personal data for direct marketing, by writing to the address in section 21. We will act on such a notice within a reasonable period and will not resume direct marketing without fresh consent.

Messages relating to your account and purchases, including receipts, credit notices, subscription changes, and security alerts, are service messages rather than marketing, and continue while you hold an account.

16. Data Subject Rights

Subject to applicable law, you have the right to:

• Request access to your personal data
• Request correction of inaccurate, incomplete, misleading, or out-of-date data
• Withdraw consent where processing is based on consent, including consent to an avatar or voice clone of your likeness
• Request that we limit or stop processing where legally permitted, including for direct marketing
• Request that your personal data be transmitted to another data controller, where that is technically feasible
• Lodge a complaint with the Personal Data Protection Commissioner, Malaysia

Requests should be made in writing using the contact details in section 21. We may need to verify your identity before acting. We respond within the period required by the PDPA. Withdrawing consent may affect our ability to provide the service to you.

17. Users Outside Malaysia

European Union and United Kingdom. Where the GDPR or UK GDPR applies to you, our lawful bases are contract performance for delivery of the service, consent for marketing, for biometric clone material, and for cross-border transfer where consent is relied on, legal obligation for financial records, and legitimate interests for security, moderation, and service improvement. You also have the rights of erasure, restriction, objection, and portability, and the right to complain to your local supervisory authority.

California. We do not sell personal information for money, and we do not share personal information for cross-context behavioural advertising. If that changes we will publish an opt-out control and update this section. California residents may contact us at any time using the details in section 21.

18. Children

CreatorCity is offered to individuals aged 18 and over and to organizations. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided personal data to us, contact us using the details in section 21 and we will delete it.

19. Third-Party Websites and Platforms

Our site and emails contain links to third-party websites and platforms, including payment pages and social platforms where users publish their generated work. We are not responsible for the privacy practices or content of those services. Review their privacy policies separately.

20. Amendments to This Privacy Policy

We may amend this Privacy Policy to reflect changes in law, technology, or our business practices. Updated versions are published on this page with a revised effective date. Where a change materially affects how we use your personal data, we will notify account holders by email before it takes effect.

21. Contact Information

For questions, requests, or complaints relating to this Privacy Policy or the handling of personal data, contact:

Lemon Sky Edge Sdn Bhd
Email: privacy@creatorcity.ai
Address: M2-10-07 8Trium Tower, Jalan Cempaka SD 12/5, Bandar Sri Damansara, 52200 Kuala Lumpur, Malaysia
Data Protection Officer: Cheah Hon Seng, privacy@creatorcity.ai

You may also contact the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia, at pdp.gov.my.