Privacy Policy

Last updated July 1, 2026 Version 1.0

This privacy policy for Zestworld Inc., doing business as CreatorAPI ("Zestworld," "CreatorAPI," "Company," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

Visit our website at https://creatorapi.ai, or any website of ours that links to this privacy policy
Create an account on, or use, the CreatorAPI platform (the "Platform") — as a creator who licenses their name, image, voice, and likeness for the generation of advertising and marketing content, or as a brand, agency, or advertiser that subscribes to generate that content
Engage with us in other related ways, including any sales, marketing, or events

Because our Services involve creating digital replicas of a creator's voice and likeness, we collect and process biometric information from creators. Section 6 (Biometric Information Policy) explains exactly how we handle it. This privacy policy is incorporated by reference into our Creator Terms of Service and Brand Terms of Service (together, the "Terms"); capitalized terms not defined here have the meanings given in the Terms. In particular: "Variants" are the AI-generated advertising and marketing content produced from a creator's Likeness; a "Creator License" is the specific, per-engagement consent and license terms that a creator reviews and approves through the Platform; "Usage Guidelines" are the content rules and restrictions a creator sets; and a creator's "Likeness" means their name, image, voice, and other identifiable personal attributes. In this policy, a "Brand" is a brand, agency, or other advertiser using the Platform, and a "brand user" is an individual accessing the Platform on a Brand's behalf.

Questions or concerns? Reading this privacy policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at team@creatorapi.ai.

SUMMARY OF KEY POINTS

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with CreatorAPI and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? Yes. If you are a creator, we process your voice, facial imagery, and likeness — and the digital replica generated from them — which is sensitive personal information, and biometric information under state biometric laws. We do so only with your explicit, written consent, and only to generate the Variants you approve through your Creator Licenses (plus, if you separately opt in, the limited marketing use described in the Terms). See Section 6.

Do we sell your personal information or use it to train AI models? No. We do not sell personal information — including biometric information — and we do not use your biometric information, Creator Materials, or digital replica to train general-purpose AI or machine-learning models. Variants are generated by our third-party AI Providers, which are contractually barred from training on your data as well. See Section 5.

What do Brands receive? Your profile information and the finished Variants generated under Creator Licenses you approve — never your raw source materials, voice or facial data, or digital replica. Your profile is visible to Brands on the Platform so they can discover you and propose engagements (see Section 4).

What happens when a creator leaves? When a creator closes their account or withdraws consent such that no approved Creator License remains active, we delete their biometric information and digital replica — across our systems, backups, and service providers — within 15 days, except where the law requires longer retention (see Sections 6 and 9). We will confirm the deletion upon your written request.

Do you receive any information from third parties? We may receive information from service providers (such as identity verification and payment confirmation), from Brands (Creator Materials uploaded toward a proposed engagement — held, unused, until you approve; see Section 1), and from public social profiles used to populate creator profiles.

How do you process my information? We process your information to provide, improve, and administer our Services, generate and deliver approved Variants, maintain consent and licensing records, communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so. (See Section 2.)

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information — with heightened protection for biometric information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. (See Section 10.)

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information — and creators can revoke consent and trigger deletion of their biometric data and replica at any time. (See Sections 6, 12, and 14.)

How do I exercise my rights? The easiest way is to email us at team@creatorapi.ai with the subject "Privacy Request." We will consider and act upon any request in accordance with applicable data protection laws.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
HOW DO WE USE AI — AND WHAT WE DON'T DO (NO TRAINING)
BIOMETRIC INFORMATION POLICY
DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK FEATURES
DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
DO WE MAKE UPDATES TO THIS POLICY?
HOW CAN YOU CONTACT US ABOUT THIS POLICY?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us — and, if you are a creator, the voice, image, and likeness materials you license through the Platform.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, join our waitlist, participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

names
phone numbers
email addresses
usernames
passwords
contact preferences
contact or authentication data
billing addresses
date of birth or age confirmation
profile details (such as your handle, bio, photo, and links) — for creators, your profile is visible to Brands on the Platform for discovery, as described in Section 4
for brand users: company name, role, and business contact details

Creator Materials and Biometric Information (creators only). If you are a creator, we collect the source footage, audio, voice recordings, images, and other assets that you — or a Brand — upload or provide for generating Variants ("Creator Materials"), together with your voice, facial imagery, and likeness and the digital replica generated from them. This is sensitive personal information, and biometric information under state biometric laws; we handle it as described in Section 6 (Biometric Information Policy). If a Brand uploads Creator Materials in connection with a proposed engagement before you have approved it, we hold those materials solely to present the proposed engagement to you: we do not create a replica or generate anything from them unless and until you approve the applicable Creator License, and if you decline the engagement, or do not approve it within 60 days, we delete them. Creator Materials must not include any other identifiable person unless the uploader holds verified rights to, and consent from, that person; if you are not a CreatorAPI user and believe your voice or likeness appears in content on our Services, see Section 12 (Non-users).

Consent and Licensing Records. We keep time-stamped records of the Creator Licenses you review and approve, your Usage Guidelines, per-Variant approvals or rejections, and your opt-outs and revocations — so you can always see what you have authorized, for whom, and when. Section 9 describes how long we keep these records; Section 6 describes what happens to the parts of them that are biometric.

Identity Information. Where appropriate, we may ask you for an image of your government-issued ID (in accordance with applicable laws) or other verification information, a selfie or liveness check when we verify your ID, and/or a recorded consent statement — recorded live by you personally (not uploaded from existing footage), confirming that you are the person depicted in the Creator Materials and that you consent to a digital replica of your voice and likeness. This verification is separate from, and in addition to, your acceptance of the Terms. Where we use third parties to process identity information ("identity-verification providers"), verification data is stored by them; any biometric elements of it (such as a selfie or liveness scan) are deleted on the 15-day schedule in Section 6, and any non-biometric verification records are retained only as long as needed and as described in Section 9.

Payment Data (brand users only). We may collect data necessary to process your payment if you purchase a Subscription, such as your payment instrument number and the security code associated with your payment instrument. All payment data is stored by Stripe; you may find their privacy policy here: https://stripe.com/privacy. We receive limited billing records (such as plan, transaction amounts, and card type/last four digits) — we do not store full payment-card numbers. Creators: your compensation is agreed and paid directly between you and the Brand, outside the Platform, so we do not collect your payment or bank information.

Parent/Guardian Information. If a creator is under 18, we collect the name, contact details, and consent records of the parent or legal guardian who agreed to the Terms on the creator's behalf (see Section 11).

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services (including generation requests and approvals given), and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies (see Section 7).

The information we collect includes:

Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services, recorded in log files — such as your IP address, device information, browser type and settings, date/time stamps, pages and files viewed, features used, and device event information (such as system activity, error reports, and hardware settings).
Device Data. Information about your computer, phone, tablet, or other device used to access the Services — such as IP address (or proxy server), device and application identification numbers, browser type, hardware model, Internet service provider and/or mobile carrier, and operating system.
Location Data. Imprecise location information inferred from your IP address.

Information collected from other sources

In Short: We may collect limited data from service providers, from Brands and creators about each other in connection with engagements, and from public social media profiles used to build creator profiles.

From Brands (about creators). A Brand may upload Creator Materials in connection with a proposed engagement, handled as described above: held to present the engagement to you, unused for any generation, and deleted if you decline.
From creators (about Brands). Creators may share information about an engagement or their communications with a Brand (for example, when reporting misuse).
From service providers. Identity-verification results, payment confirmations, and analytics.
Public/social profile information. Publicly available social media profile information (such as handles, profile URLs, and follower counts) used to populate or verify creator profiles.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, generate the Variants creators have approved, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts.
To generate and deliver Variants. We process Creator Materials and biometric information through our AI Providers to create a creator's digital replica and generate Variants — strictly within each creator's approved Creator Licenses and Usage Guidelines (see Sections 5 and 6).
To maintain the consent framework. We record, display, and enforce Creator Licenses, Usage Guidelines, approvals, opt-outs, revocations, and takedown requests.
To verify identity and consent. We confirm that a creator is the person depicted in the Creator Materials and has consented to a digital replica, before generation.
To enable discovery. We display creator profiles to Brands on the Platform so Brands can find creators and propose engagements (see Section 4).
To bill and manage Subscriptions (brand users) through our payment processor.
To communicate with you. Service announcements, legal notices, and support responses; and, with your consent where required, marketing communications (you can opt out of marketing at any time).
For security and fraud prevention. Detecting and preventing fraud, abuse, unauthorized use of a likeness (including comparing content against a creator's likeness to catch impersonation or out-of-scope use), and security incidents, and enforcing our Terms.
To improve the Services. We may process personal data in an aggregated or de-identified form to analyze the effectiveness of our Services, conduct research, and analyze usage. We do not use biometric information, Creator Materials, or the digital replica for this purpose (see Section 5).
To save or protect an individual's vital interest, such as to prevent harm.
To comply with law, legal process, and lawful requests.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law — and for creators' biometric data, that basis is your explicit consent, given as a separate act.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. Zestworld Inc. is the data controller. We may rely on the following legal bases:

Explicit consent (Article 9(2)(a)) — biometric data. We process a creator's voice, facial imagery, likeness, and digital replica only with the creator's explicit consent, given as a separate, affirmative act — your approval of each specific Creator License, together with the live recorded consent statement described in Section 1 where we require it — distinct from your general acceptance of the Terms. You can withdraw this consent at any time (Sections 6 and 12); withdrawal triggers deletion on the Section 6 timeline.
Consent. For marketing communications and non-essential cookies. You can withdraw your consent at any time by contacting us at team@creatorapi.ai.
Performance of a contract. Operating your Account and providing the Platform under the Terms.
Legitimate interests. Securing the Services, preventing fraud and misuse, and improving non-biometric features — balanced against your rights and freedoms.
Legal obligations. Compliance with law, such as cooperating with a law enforcement body or regulatory agency, exercising or defending our legal rights, or disclosing your information as evidence in litigation in which we are involved; and tax/accounting record-keeping.
Vital interests. Where necessary to protect your vital interests or those of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent) — except that we collect creators' biometric information only with express consent. You can withdraw your consent at any time by contacting us at team@creatorapi.ai. In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent (for example, for investigations and fraud detection, to comply with a subpoena or court order, or where the information is publicly available and specified by regulations).

In Short: Creator profiles are visible to Brands for discovery. Finished Variants and engagement information are shared with the Brands you approve, at your direction. Biometric information goes only to the service providers that generate your approved Variants or verify your identity — and as required by law. We do not sell personal information.

Creator profiles are visible to Brands (creators). Your profile information (such as your handle, bio, photo, links, and public social details) is visible to Brands using the Platform so they can discover you and propose engagements — this can occur before any Creator License exists. Your Creator Materials, biometric information, and Variants are shared only as described below.

With the Brands you approve (creators) — at your direction. The finished Variants generated under the applicable Creator License, and the engagement information needed to run it. When you approve a Creator License, you intentionally direct us to disclose that information to that specific Brand (and to the AI Providers that generate the Variants) for that engagement — a disclosure made at your direction under your written consent, not a sale of your personal information. We do not give Brands your raw Creator Materials, source footage, voice or facial data, or digital replica, and Brands are contractually prohibited from extracting, reconstructing, or reusing your Likeness or replica from a Variant. Brands are contractually required to use creator information solely to run the approved advertising, to protect it, not to sell it or use it to train AI models, and not to retain the creator's biometric information, Creator Materials, or Likeness longer than needed for the engagement.

With creators (brand users). Your brand profile, proposed engagement details, and campaign materials you submit in connection with an engagement or a public listing on the Platform.

With our AI Providers. The third-party artificial-intelligence providers and processing vendors that generate Variants on our behalf receive Creator Materials and biometric information solely to generate and deliver approved Variants, under contracts restricting their use, prohibiting training on your data, and requiring deletion on our instruction (see Sections 5 and 6).

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place designed to safeguard your personal information — they cannot do anything with it unless we have instructed them to, they will not share it with any organization apart from us, and they commit to protect it and retain it only for the period we instruct. The categories of third parties we may share personal information with are: data storage/cloud hosting providers; payment processors (Stripe); identity-verification providers; data analytics services; and email/communications tools.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company — subject to this policy's commitments, including Section 6's biometric commitments, which bind any successor.

Legal obligations and safety. To comply with law, regulation, subpoena, or legal process; to enforce our Terms; or to protect the rights, property, or safety of CreatorAPI, our users, or others — including reporting to law enforcement where appropriate.

With your direction or consent. For example, the marketing showcase use described in the Terms: by default we do not use Variants or a creator's Likeness to market CreatorAPI, and we do so only with the authorization of the Brand that owns or controls the Variant and, where the Variant identifiably features the creator, the creator's separate opt-in consent — which the creator may withdraw prospectively at any time.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Disclosures you direct — such as to a Brand under a Creator License you approve — are made at your request and with your consent, and are not sales. Beyond the sharing described in this section, we will not expose or disclose your personal information to other users of the Services, nor share information regarding your individual usage of the Platform.

Data firewalls between users. A Brand's campaign information is not shared with other Brands or with creators beyond what the Brand itself submits toward an engagement or public listing; we never disclose a creator's biometric information to any Brand (Brands receive finished Variants and profile information only — including where the Brand itself supplied Creator Materials toward a proposed engagement, it does not receive the creator's other materials or the replica); and one Brand's engagement activity with a creator is not disclosed to another Brand.

5. HOW DO WE USE AI — AND WHAT WE DON'T DO (NO TRAINING)

In Short: Your data is used to generate the Variants you approved. It is not used to train AI models — by us, our AI Providers, or Brands.

Generation, not training. Creator Materials, biometric information, and the digital replica are used solely to generate and deliver the Variants the creator has approved through a Creator License (plus, where the creator separately opts in, the limited marketing use described in the Terms).
No general-purpose training. We do not use your biometric information, Creator Materials, Likeness, or digital replica — nor the Variants generated from them, nor Brand campaign materials — to train, fine-tune, or improve general-purpose AI or machine-learning models — ours or anyone else's — outside the generation of your approved Variants. Our AI Providers are contractually bound to the same restriction, and Brands are contractually prohibited from using creator information to train or fine-tune any AI model or from deriving any voice or likeness model from it.
If that ever changes. If we ever propose to use creator data for model training beyond generating approved Variants, we will ask for your fresh, separate, opt-in consent first — we will not make that change through a silent update to this policy — and declining will not affect your access to, or standing on, the Platform.
Scope is creator-controlled. Generation happens only within the Creator Licenses and Usage Guidelines each creator approves; each new Brand, product/category, or material scope change requires new approval.
No automated decisions with legal effect. We do not use personal information for automated decisions that produce legal or similarly significant effects about you without human involvement.

6. BIOMETRIC INFORMATION POLICY

In Short: We collect creators' voice and face data only with explicit written consent, use it only to generate their approved Variants and to verify identity and prevent misuse, never sell it, and permanently delete it — including the digital replica and any models or embeddings derived from it, across our systems, backups, and service providers — within 15 days after a creator fully exits, unless the law requires otherwise.

This section is our written policy for biometric identifiers and biometric information (together, "biometric information") under laws including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, and Washington's biometric privacy law, and for "sensitive personal information" under the California Consumer Privacy Act (as amended) and similar state laws. It covers voice recordings and voiceprints, facial imagery and the face geometry derived from it, and the digital replica — and any voice or likeness model, embeddings, or other data derived from your biometric information. (Ordinary photographs and videos you choose to display publicly, such as your profile photo, and finished Variants delivered as advertising assets, are not treated as stored biometric identifiers — though the data extracted from source imagery and audio to build your replica is.)

Collection only with an informed, written release. We collect, capture, or otherwise obtain a creator's biometric information only after the creator (or, for creators under 18, their parent or legal guardian) has been informed in writing that biometric information is being collected and stored, informed of the specific purpose and length of term of the collection, use, and storage, and has executed a written release consenting to it. That consent is a separate, affirmative act — given through your approval of each specific Creator License (which describes the Brand, uses, territory, and duration) and, where we require it, confirmed by the live recorded consent statement described in Section 1 — not merely through general acceptance of the Terms.

Purpose limitation. We collect and use biometric information for two purposes only: (1) to create the creator's digital replica and generate and deliver Variants within the creator's approved Creator Licenses and Usage Guidelines (plus any marketing use the creator separately opts into); and (2) to verify the creator's identity and consent and to detect and prevent impersonation and unauthorized use of a likeness. We do not use biometric information for any other purpose.

No sale; no profit. We do not sell, lease, trade, or otherwise profit from biometric information, and we do not share it for cross-context behavioral advertising. It is the creator who licenses and monetizes their own Likeness through engagements with Brands; CreatorAPI's disclosures of biometric information occur only at the creator's direction, under the creator's written release, to generate the Variants the creator has approved.

Limited disclosure. We disclose biometric information only: (a) to our AI Providers and processing vendors, solely to generate and deliver approved Variants under the contractual restrictions in Section 5; (b) to our identity-verification providers, solely to verify identity and consent; (c) with the creator's consent; (d) when required by law, subpoena, or valid legal process; or (e) as needed to complete a transaction the creator has requested. We never disclose biometric information to Brands — they receive finished Variants and profile information only.

Retention schedule and destruction. We retain biometric information only while needed for the purposes above — serving the creator's approved, active Creator Licenses, operating their Account, and verifying identity and consent. We permanently destroy a creator's biometric information — including the digital replica and any voice or likeness model, embeddings, or other derived data — within 15 days after the creator closes their Account or withdraws consent such that no approved Creator License remains active, across our systems, our backups, our AI Providers, and our identity-verification providers, and in any event no later than the destruction deadlines applicable law requires. Two narrow exceptions: (1) where a specific law, litigation hold, or valid legal process requires us to preserve specific records, we isolate them from any other use and destroy them when the requirement ends; and (2) the executed written release may be retained as described below. On written request, we will confirm the deletion. Once deleted, no further Variants can be generated in the creator's Likeness.

Consent records. We retain the executed written release — the Creator Licenses you approved and the associated approval records — for 7 years after the relevant engagement ends, solely as the legal record that consent was given and what it covered; this retention supports no further processing of your Likeness.

What deletion does not reach — Variants already delivered. Finished Variants already generated and delivered to a Brand under a Creator License you approved are advertising assets, not our stored biometric information: on a full exit they are subject to the wind-down described in the Terms (the Brand must stop using them, except to the extent ownership or use is governed by your separate agreement with that Brand), and Brands must delete the biometric information, Creator Materials, and Likeness they received through the Platform, but copies of Variants that you and the Brand have agreed the Brand owns may remain with the Brand under that separate agreement. Brands are contractually prohibited from using any Variant to extract, reconstruct, or recreate your Likeness or replica, and no new Variants can be generated through the Platform after deletion.

Storage and protection. We store, transmit, and protect biometric information using a reasonable standard of care within our industry, in a manner at least as protective as the way we store other confidential and sensitive information — including encryption in transit and at rest and access controls (see Section 10).

7. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use strictly necessary cookies to run the Services, and analytics cookies to understand usage.

We use cookies and similar technologies to access or store information. A "cookie" is a piece of information sent to your browser by a website you visit. We use:

Strictly necessary cookies — sign-in, session security, and platform functionality; and
Analytics cookies (Google Analytics).

We do not use advertising or retargeting cookies, and we do not permit third parties to collect personal information on our Services for their own advertising.

You can set your browser to accept all cookies, to reject all cookies, or to notify you whenever a cookie is offered so that you can decide each time whether to accept it. Disabling necessary cookies may affect certain features of the Services. For more information about cookies, please visit https://allaboutcookies.org/.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Our servers are located in the United States; if you access the Services from elsewhere, your information is transferred to, stored, and processed in the United States.

Our servers are located in the United States, and the Services are hosted in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by the third parties with whom we may share your personal information (see Section 4), in the United States.

If you are a resident of the European Economic Area (EEA), United Kingdom (UK), or Switzerland, please be aware that the United States and other destination countries may not have data protection laws as comprehensive as those in your country. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments, as applicable) for those transfers, with supplementary safeguards including encryption in transit and at rest, and we will take appropriate measures to protect your personal information in accordance with this privacy policy and applicable law.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as needed for the purposes in this policy — with a hard 15-day deletion clock on biometric information after a creator fully exits (subject only to the narrow legal-hold and consent-record exceptions in Section 6), and longer retention only where the law requires or for the records that prove what was authorized.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). In particular:

Category	Retention
Biometric information (including the digital replica and derived models/embeddings)	While approved Creator Licenses are active + 15 days after Account closure or full consent withdrawal, subject to the narrow exceptions in Section 6
Creator Materials	Same as biometric information
Consent & licensing records (Creator Licenses, approvals, revocations — the executed written release)	7 years after the relevant engagement ends — retained as the legal record that consent existed and what it covered (see Section 6 for the recorded consent statement)
Account & profile information	Life of the Account + 90 days
Identity-verification records	Biometric elements (e.g., a selfie or liveness scan) are deleted on the Section 6 15-day schedule; any non-biometric verification records are kept only as long as needed to verify identity, then deleted.
Billing records (brand users)	As required by tax and accounting law (7 years)
Support communications	2 years
Usage logs	12 months

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible — except biometric information, which is deleted across systems, backups, and service providers within the 15-day window in Section 6 (subject to Section 6's narrow exceptions). Finished Variants already delivered to a Brand are addressed in Section 6 ("What deletion does not reach").

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures — with heightened protection for biometric information.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process — including encryption in transit and at rest, access controls and least-privilege permissioning, logging and monitoring, and vendor security review — consistent with reasonable industry standards and applicable legal requirements (such as New York's SHIELD Act) and, for biometric information, the heightened standard in Section 6. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment. If a breach affecting your personal information occurs, we will notify you and regulators as required by law. Report suspected security issues to team@creatorapi.ai.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: The Services are not for children under 13. Creators aged 13–17 may participate only with a parent or legal guardian's agreement — including the biometric consent.

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Creators represent in the Terms that their Creator Materials, and the advertising in which their Likeness is used, are not directed to children under 13.

Creators aged 13–17 may use the Platform only if a parent or legal guardian reviews and agrees to the Terms on their behalf. For these creators, the parent or legal guardian executes the written release and approvals described in Section 6, and we collect the parent/guardian's contact and consent records; the recorded consent statement is made by the creator — the person depicted. Brand users must be 18 or older and act for a business.

If we learn that we have collected personal information from a child under 13 — or from a minor without the required parental consent — we will deactivate the account and promptly delete such data from our records (including any biometric information, on the Section 6 timeline). If you become aware of any data we may have collected from children under 13, please contact us at team@creatorapi.ai.

We do not sell the personal information of any user, including minors, and we do not share it for cross-context behavioral advertising.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time — and creators may withdraw biometric consent at any time. In some regions, you have additional rights under applicable data protection laws.

All users. You can access, update, or correct your account information at any time by logging in to your account settings, or by contacting us at team@creatorapi.ai. You can opt out of marketing emails via the unsubscribe link in any marketing message; service and legal notices continue while you have an Account.

Creators — withdrawing biometric consent. You may revoke any Creator License, or withdraw your consent entirely, at any time through the Platform or by emailing team@creatorapi.ai. Full withdrawal (no approved Creator License remaining active) triggers the 15-day deletion of your biometric information and digital replica described in Section 6. The Terms describe the wind-down of Variants already in use.

Minors — parents and guardians. For creators under 18, the parent or legal guardian who agreed to the Terms may exercise any of the rights in this policy — including access, deletion, and withdrawal of biometric consent — on the creator's behalf.

Non-users. If you are not a CreatorAPI user and you believe your voice, image, or likeness appears in Creator Materials or a Variant on our Services without your consent, contact us at team@creatorapi.ai; we will review and take appropriate action, including removal and deletion where required by law.

EEA, UK, and Switzerland. You have rights under applicable data protection laws, which may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) to object to processing based on legitimate interests. You will not be subject to automated decision-making that produces legal effects concerning you without appropriate safeguards. You can make such a request by contacting us using the details in Section 16. If you believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority (see the European Data Protection Board's member list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en), the UK Information Commissioner's Office (https://ico.org.uk), or, for Switzerland, the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).

Canada. You may have the right to request access to and correction of your personal information, and to withdraw consent as described in Section 3.

Withdrawing your consent (all regions). If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us using the details in Section 16. This will not affect the lawfulness of processing before withdrawal, nor processing conducted in reliance on lawful grounds other than consent.

Account termination. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases, subject to the retention schedule in Section 9 (and, for creators, the Section 6 biometric deletion). We may retain limited information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with applicable legal requirements.

We will consider and act upon any request in accordance with applicable data protection laws. If you have questions or comments about your privacy rights, you may email us at team@creatorapi.ai.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and we do not currently respond to DNT browser signals. We do, however, honor opt-out preference signals such as Global Privacy Control (GPC) where applicable law treats them as a valid opt-out request — and because we do not sell or share personal information, there is nothing further for such a signal to opt you out of. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy policy.

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes. If you reside in California or another state with a comprehensive privacy law, you have specific rights — and we already treat the most protective ones (no sale, limited use of sensitive information) as our default for everyone.

If you are a resident of California, Colorado, Connecticut, Texas, Virginia, or another state with a comprehensive consumer privacy law, you may have the right to: know/access the personal information we hold about you; correct inaccuracies; delete your personal information; receive a portable copy; limit the use and disclosure of sensitive personal information; and opt out of sale, sharing for cross-context behavioral advertising, and certain profiling. We do not sell or share personal information and do not engage in such profiling, so there is nothing to opt out of, but you may still submit the request.

Categories of personal information we collect (last 12 months):

Category	Examples	Collected
A. Identifiers	Real name, alias, postal address, telephone number, unique personal identifier, online identifier, IP address, email address, account name	YES
B. Personal information (Cal. Customer Records statute)	Name, contact information, financial information	YES
C. Protected classification characteristics	Date of birth / age (collected for eligibility and minor-consent purposes)	YES
D. Commercial information	Subscription transaction information and purchase history (brand users)	YES
E. Biometric information	Voice recordings and voiceprints, facial imagery and face geometry, Likeness, and the digital replica derived from them (creators, with explicit consent)	YES
F. Internet or other similar network activity	Log and usage data, interactions with the Services	YES
G. Geolocation data	Imprecise location from IP address	YES
H. Audio, electronic, visual, or similar information	Creator Materials (audio, video, images); recorded consent statements	YES
I. Professional or employment-related information	Business contact details of brand users	YES
J. Education information	Student records	NO
K. Inferences	Profiles or summaries about preferences and characteristics	NO
L. Sensitive personal information	Biometric information (creators); government-issued ID images/numbers (identity verification); account log-in credentials	YES — used only to provide the Services

We may also collect other personal information outside these categories where you interact with us in person, online, or by phone or mail — for example, customer support, surveys, or facilitating delivery of the Services.

Sale/share status. Zestworld Inc. has not sold or shared personal information collected through the Services described in this policy in the preceding twelve (12) months, and does not sell or share personal information — including the personal information of consumers under 16. Separately, we have disclosed for business purposes (to the service-provider categories in Section 4): Categories A, B, C, D, E (to AI Providers and identity-verification providers only, under contract), F, G, H, and I. Disclosures of a creator's information to a Brand under a Creator License the creator approved are made at the creator's direction and with the creator's consent, and are not a sale or sharing of personal information.

Sensitive personal information. We collect and process sensitive personal information (biometric information; government-issued ID data; account log-in credentials) only to provide the Services you request and for the purposes permitted by Cal. Civ. Code § 1798.121(a) and its regulations — we do not use or disclose it to infer characteristics about you or for any purpose that would require a "Limit the Use of My Sensitive Personal Information" link.

How to exercise your rights. Email team@creatorapi.ai with the subject "Privacy Request," telling us which right you are exercising. We will verify your identity — typically by matching information you provide against what we have on file, or by contacting you through a communication method you have previously provided — and will only use information provided in your request for verification, deleting any additionally provided verification information once finished. You may use an authorized agent; we may deny a request from an agent that does not submit proof of valid authorization, and we may still verify your identity directly. We will respond within the time required by law, will not discriminate against you for exercising your rights, and if we decline a request you may appeal by replying to our decision — we will explain the outcome, and where state law provides, you may contact your state Attorney General.

California "Shine The Light." California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. California residents under 18 with a registered account may request removal of content they publicly posted on the Services by contacting us with the email associated with the account; we will ensure it is not publicly displayed, though it may not be completely removed from all systems (e.g., backups) — except biometric information, which is deleted per Section 6.

15. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Last updated" date and version number and will be effective as soon as it is accessible. If we make material changes — including any change to how we handle biometric information or previously collected personal information — we will notify you by prominently posting a notice of such changes or by directly sending you a notification, and, where the law requires it, we will obtain your consent before the change applies to information we have already collected. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

16. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may email us at team@creatorapi.ai, or by post to:

Zestworld Inc. (d/b/a CreatorAPI) 333 Schermerhorn St, Ph51M Brooklyn, NY 11217 United States

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, email us at team@creatorapi.ai with the subject "Privacy Request," telling us which right you are exercising (see Section 14 for the verification, authorized-agent, and appeal process). Requests may include:

Know what information is being collected from me
Access my personal information / receive a copy of it
Fix inaccurate information
Have my information deleted
Withdraw my biometric consent and delete my digital replica (creators — see Section 6)
Limit the use and disclosure of my sensitive personal information
Opt out of sale or sharing of my personal information (we do not sell or share, but you may still submit this)
Other (please specify)

We will need to validate your request and may contact you to complete it. Please note that deletion of your personal data is irreversible, may end your ability to use the Services, and — for creators — permanently prevents any further Variants from being generated in your Likeness. We will consider and act upon any request in accordance with applicable data protection laws.