Privacy Policy

Creeklog is used by businesses — a shop, a factory, a publisher — each with its own workspace. That changes who decides what happens to the data:

• Data the business puts into Creeklog— camera images of its sites and workers, photos of its shoppers, its catalogue, its documents. The business decides why and how this data is used; under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) it is the Data Fiduciary, and we process the data on its behalf and on its instructions. If you are a worker, a shopper or a visitor of one of our customers, please contact that business first; we will help it answer you.
• Data about our own customers and users — the people who sign up, sign in and pay, and visitors to our website. For this data we are the Data Fiduciary.

• Account details: name, work email, company, role in the workspace, password (stored only as a one-way hash), and an optional profile picture.
• Content you provide: websites and documents you connect, catalogue pictures, brand kits, settings, and the questions asked of your AI assistant.
• Camera and photo data that a business sends to Safety Vision or Photobooth — see sections 3 and 4.
• Usage and security logs: what was done, by whom, from which source (web, app or API), when, and from which IP address — for example who opened a shopper photo or acknowledged an incident.
• Device details for the apps: device model and operating system, and a push-notification token if you allow notifications.
• Billing details: plan, AI-credit balance and invoices. Card or bank details are handled by the payment provider, not stored by us.
• Messages to us: what you send through the contact form or by email.

The Creeklog Safetyapp lets a business's site supervisors see and act on safety incidents detected from its cameras (missing helmet or vest, restricted zones, line crossing and similar). It is for staff of businesses that use Safety Vision; accounts are created by the business, not in the app.

Data handled for the business:

• Images and short clips from the business's cameras, the incidents found in them, who reviewed or acknowledged each one, and alert-delivery records (kept 180 days).
• Face recognition (optional, off by default). If the business switches it on, it can enrol named people. We store a mathematical template of the face (encrypted), the enrolment photo, and where and when the person was seen. This is biometric data: the business must give notice to, and obtain consent from, the people it enrols, and can erase a person completely at any time. Every view of an enrolment photo and every change is recorded in an audit log kept two years.
• Number plates (optional, off by default) read by gate cameras, kept for the business's chosen retention period.

Creeklog Photobooth lets clothing and jewellery stores show shoppers how pieces look on them. It is used by store staff (and, where a store chooses, by shoppers in its showroom); accounts are created by the store.

• Jewellery try-on happens entirely on the phone. Face and wrist positions are found on the device (Google ML Kit, on-device), and make-up and beauty effects are drawn on the device. Live camera frames are not uploaded or stored. A photo you take of a look stays on your phone unless you share it. We record only that a piece was tried, by which staff account, and when.
• Clothing try-onneeds the shopper's photo and the shopper's agreement, which the app asks for every time. The photo is uploaded over an encrypted connection, combined with the garment picture by an AI image service (our own servers, or an AI provider such as OpenAI acting as our sub-processor), and the generated picture is stored for the store. Generated pictures are labelled as AI-generated.
• Shopper photos and generated pictures are deleted automatically after 30 days by default, and the store can delete them at any time. Every time someone opens a shopper photo is written to the store's activity log (kept 2 years, without any pictures).
• Photobooth is not meant for children. A store must have a parent or guardian's consent before taking a photo of anyone under 18.

• To provide the services: answer questions, render content, detect incidents, show try-ons, send alerts.
• To keep accounts and data secure, prevent abuse, and investigate problems.
• To bill for plans and AI credits, and to provide support.
• To tell you about changes to the services. Marketing emails only with your agreement, and you can stop them any time.
• To meet legal obligations.

We do not sell or rent personal data. We share it only with service providers who process it for us under contract:

• Amazon Web Services — hosting, storage and email, in the Mumbai (India) region.
• AI model providers such as OpenAI — to generate answers, content and clothing try-on pictures. They receive only what a request needs and, under their API terms, do not use it to train their models.
• Google Firebase Cloud Messaging — to deliver push notifications to the Creeklog Safety app.
• Payment providers — when you pay us.

We may disclose data where the law requires it, to protect people's safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Our servers and storage are in India (AWS Mumbai). Some AI providers process requests on servers outside India; when a feature uses them, only the data that request needs is sent, over an encrypted connection, and not kept by the provider longer than its terms allow. We do not transfer data to any country the Government of India has restricted.

A business can delete its data sooner from its dashboard, or by asking us.

• Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest for stored files.
• Face templates stored encrypted; API keys and passwords stored only as one-way hashes.
• Each business's data kept in its own database; role-based access inside a workspace (owner, admin, editor, viewer).
• Audit logs of sensitive actions, including every opening of a shopper or enrolment photo.

Under the DPDP Act and other laws that apply to you, you can ask to:

• get a summary of the personal data we hold about you and how it is used;
• correct, complete or update it;
• erase it, or withdraw consent you gave (this does not affect what was done before you withdrew);
• nominate someone to exercise these rights if you die or cannot act;
• have a grievance addressed.

Email connect@oadbox.comfrom the address on your account. If your data is in a business's workspace (you are its worker or shopper), we will pass your request to that business and help it respond. To delete an app account, see Account & data deletion.

Our services are for businesses and are not directed at children. App accounts are for people aged 18 or over. We do not knowingly collect personal data from children except where a business has the verifiable consent of a parent or guardian (for example, a shopper under 18 in a Photobooth showroom).

The website does not use advertising or analytics trackers. The Creeklog platform uses a strictly necessary cookie to keep you signed in. The mobile apps store your sign-in securely on the device (Keychain on iOS, Keystore on Android).

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell account owners by email or in the product before it takes effect.

For privacy questions, requests or complaints, write to our Grievance Officer at connect@oadbox.com, Oadbox, Bengaluru, Karnataka, India. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.