Skip to content

Creativity Privacy Policy

Last updated: 8 September 2026

1. Who we are

Creativity is the brand name under which the trader named below runs this streaming platform — the one that lets you browse, watch and react to films, series, games, music and backstage material we produce, and rent or buy titles from independent partner studios. This policy explains what personal data we collect, why, who we share it with, how long we keep it and what your rights are. It applies to creativityfilms.gr, our television apps, the Chromecast receiver and embedded players, the emails we send, the partner portal, and Creativity Studio, our production tools.

The controller of your personal data is the trader named below. You can reach us about anything in this policy at the contact address shown; we answer requests within one month.

Trader
Thomas Doykinitsas
Service address
Flat 3 Regal Court, Dawes Road, SW6 7DT, London
Contact
thomas@creativityfilms.gr

2. Information we collect

We collect information in two ways:

Information you provide to us:

When you log in via Google, we receive your Google ID, name, email address, and profile picture. If you grant YouTube access, we also receive your YouTube Channel ID and YouTube Membership status. This information is used solely to create and manage your account and to verify your eligibility for exclusive member content.

Your profile (all optional):

After your first sign-in we invite you to review a short profile: your display name, preferred language, and — entirely optionally — your age group, gender, a link to your YouTube channel, and a profile picture of your own instead of the one from Google. The optional items are collected on the basis of your consent, are never pre-filled with a guess, are never shown to other viewers, and are never sold or shared. You may skip the invitation entirely; we will not ask again. You can change or erase any of it at any time from the menu under your name, and clearing a field deletes the stored value. If you upload a picture, the 1:1 crop happens in your browser and only the cropped square is sent to us — the original photo, and any location data your camera saved inside it, never leaves your device. Removing an uploaded picture deletes it from our storage and restores your Google one. Your YouTube channel link is not read from Google: we only pre-fill a suggestion from the channel we already identify for membership checks, and nothing is stored unless you save it.

Information automatically collected:

  • Page views and duration of visit.
  • Referral sources (the URL that linked you to us).
  • Video engagement data (watch time, pause timestamps, completion status).
  • Device type, browser and the country your connection appears to come from. We work the country out on our own server from your IP address, using an offline lookup database; the IP address itself is not stored with your analytics or account records.

Anonymous Demographic Data:

We may record age and gender data associated with page views for aggregate analysis, but this is stored separately from your personal user profile to maintain anonymity.

3. Google user data

This section specifically addresses how we handle data obtained through Google Sign-In and Google API Services.

How We Access Google User Data:

We use Google OAuth 2.0 to authenticate you. During sign-in, we request access to your basic profile information (name, email, profile picture) and, with your consent, read-only access to your YouTube account to determine your channel ID and membership status.

How We Use Google User Data:

Your Google profile data is used exclusively to create and maintain your user account on Creativity. Your YouTube channel ID and membership status are used only to verify whether you are an active Creativity+ YouTube channel member, which grants access to exclusive content.

How We Store Google User Data:

Your Google profile information and YouTube data are stored securely in our database. We retain this data only for as long as your account is active. When you delete your account, all associated Google user data is permanently removed.

How We Share Google User Data:

We do not sell, trade, rent, or share your Google user data with any third parties. Your data is used solely within Creativity for the purposes described in this policy.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Why we use your information, and on what legal basis

We use your data for the following purposes, each with the legal basis the GDPR and the UK GDPR require:

  • Providing the service — creating and managing your account, signing you in, checking your Creativity+ membership, remembering where you stopped watching, and granting access to titles you have rented or bought. Basis: performance of our contract with you.
  • Personalisation you control — the optional profile fields and the optional “For you” row (see the sections on recommendations below). Basis: your consent for the profile fields; our legitimate interest, with an opt-out, for “For you”.
  • Analytics — understanding which pages and titles are watched, from which countries, and for how long, so that we can programme the site and report aggregated figures to partners. Basis: your consent, given through the cookie settings; without it we record nothing about your visit beyond what is technically necessary.
  • Email — telling you about new releases and, if you opted in, campaigns. Basis: your consent, which you can withdraw from any email or from your account settings.
  • Purchases — recording the order, the entitlement it grants, your confirmation about immediate access, the country you bought from, and any refund; making your invoice available. Basis: performance of the contract, and our and the seller’s legal obligations for tax and consumer law.
  • Security and abuse prevention — rate limits, sign-in protection, Google’s account-security signals, and short-lived records of device pairing codes. Basis: our legitimate interest in keeping the platform and your account safe.
  • Legal compliance — handling content reports, responding to lawful requests, and keeping the records tax law requires. Basis: our legal obligations, and our legitimate interest in establishing or defending a claim.
  • Artificial intelligence — producing and checking artwork, descriptions, translations and subtitles for the catalogue, running our production tools, and answering our own questions about aggregated audience statistics. Basis: our legitimate interest in presenting the catalogue well, making it accessible in both languages and running a small studio efficiently. Section 12 describes what is sent, to whom, and how to object.

We never use your data for advertising, we never sell it, and we do not make automated decisions about you that have a legal or similarly significant effect.

5. Who we share your data with

We share personal data only with the service providers we need to run the platform, each bound by a data-processing contract, and with the parties named below:

  • Hosting and delivery — our database (MongoDB Atlas, hosted in the European Union), our application host (Heroku, a Salesforce service, in the European Union), file and image storage (Cloudflare R2), and video storage, transcoding and delivery (Amazon Web Services, in the European Union, with a worldwide content-delivery network). They process data on our instructions only.
  • Google — for sign-in and for the YouTube membership check, under the Google API Services User Data Policy.
  • Stripe — when you rent or buy a partner title, Stripe processes the payment on the seller’s account. Stripe receives your name, email, billing address and card details; we never see your card. Stripe is an independent controller for payment processing.
  • Resend — our email delivery provider, which receives your email address and the content of the messages we send you.
  • AI providers — Replicate, Inc. (United States) and Lightricks Ltd. (“LTX”, Israel), which run the image, language, speech and video models we use; a request to Replicate may be served by a model published by Google, Anthropic, OpenAI or another model publisher. What they receive is described in section 12 — never your account data.
  • Partner studios — aggregated statistics only, plus what Stripe provides on their own account for invoicing (see “What partner studios see”). People on a partner’s own team see each other’s name, email address and role.
  • Authorities and advisers — where the law requires it, to respond to a valid legal request, or to establish or defend a legal claim.

We do not sell, rent or trade personal data, and we do not share it with advertising networks or data brokers.

6. International transfers

Creativity is established in the United Kingdom, and our database is hosted in the European Union. The UK and the EU each recognise the other as providing adequate protection, so data flowing between them needs no further safeguard.

Some providers may process data outside the UK and the EU: Google, Stripe, Amazon Web Services, Cloudflare, Resend and Replicate in the United States, and Lightricks in Israel. Transfers to the United States are covered by the EU–US and UK–US Data Privacy Framework where the provider is certified, or by the European Commission’s standard contractual clauses and the UK addendum; Israel is recognised by both the EU and the UK as providing adequate protection. You can ask us for details of the safeguard that applies to a particular provider.

7. How long we keep your data

We keep personal data only for as long as the purpose it was collected for requires:

  • Account, profile, watch progress and reactions — for as long as your account exists. Deleting your account (“Revoke access”) removes them immediately.
  • Page and video analytics — two years after the visit the random session identifier and the full referrer address are removed from the record; what remains (page or title, country, device type, duration, language and age or gender band) is anonymous statistics and is kept indefinitely so that we can compare years.
  • Orders, entitlements, invoices and refunds — six years after the transaction, because tax law requires the seller and the platform to keep them, even if you delete your account in the meantime; after six years the link to your account is removed and the record remains as an anonymous financial entry.
  • Content reports — deleted three years after the matter is resolved.
  • Email preferences — until you withdraw consent or delete your account; a record that you unsubscribed is kept so we do not email you again.
  • Security and payment-event logs — 30 days; device pairing codes — minutes.
  • AI job records — which model was used, what we sent it, the result and its cost — for as long as the title or production they belong to exists, as part of our accounts and audit trail; the provider’s own copy is short-lived (section 12).
  • Partner records and partner media — see section 16. Crew and production records — see section 17.
  • Backups — encrypted copies of the database are kept for disaster recovery and are overwritten on a rolling basis; data deleted from the live system disappears from backups as they rotate, and backups are never used for any other purpose.

8. Cookies and similar technologies

Strictly necessary cookies keep you signed in, remember your language and your cookie choices, and protect the site; they cannot be switched off. Everything else — functional cookies, analytics and email preferences — is off until you accept it in the cookie banner, and you can change your choice at any time from “Cookie settings” in the footer, whether or not you are signed in. We do not use advertising or cross-site tracking cookies. Fonts, emoji and scripts are served from our own servers, so no font or script host sees your visit. Embedded YouTube players set Google’s own cookies when you play a YouTube video, and casting to a television uses Google’s Cast framework; Google’s privacy policy applies to those.

9. YouTube API Services

Our application uses YouTube API Services. By using our website, you agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy. We access your YouTube membership status solely to verify eligibility for content and do not share this data with external third parties.

To unlock member content we also read, through the channel owner’s account, the current list of members of the Creativity+ YouTube channel, roughly every fifteen minutes. For each member this gives us the YouTube channel id, the public display name and the membership level — whether or not that person has ever visited this site. It is used only to check membership, is refreshed on every sync, is removed at the next sync after a membership ends, and is never used for anything else. If you are a channel member who has never signed in here and would rather not appear in that list, contact us and we will exclude you.

10. Recommendations (“More like this”)

Our editors score every film, series and game against a list of descriptive tags — how funny it is, how scary, how fast-paced. The "More like this" row on a page is worked out by comparing those scores between titles.

This part does not use anything about you. It is calculated from the two titles alone, so every visitor sees exactly the same "More like this" suggestions on the same page, whether or not you are signed in.

The calculation happens on our own servers, from our own database. No recommendation service, advertising network or other third party is involved, and nothing about your visit is shared for this purpose.

11. “For you” and your reactions

If you are signed in, we may also show you a "For you" row on your home page, built from your own likes, dislikes and reaction emotions on titles across the site. This is different from "More like this" above: it looks at your account's reactions, not just the two titles on the page you happen to be viewing.

The only purpose is ordering that extra row on your own home page. It is never used for advertising, is never shown to anyone else, and is never sold or shared with a third party.

Our lawful basis for this is legitimate interest: a like or dislike is a deliberate action you took on your own account, and using it to order your own home page sits within what you would reasonably expect. What makes that balance hold is that it is easy to turn off — see below.

This is profiling under data protection law (it draws inferences about your taste from your activity), and we say so plainly here. It is not automated decision-making with a legal or similarly significant effect on you: at most, it changes the order of one optional row on a page you are already looking at.

You can turn this off at any time from your account settings (the "Personalised recommendations" toggle, on by default). When it is off, we do not compute anything from your reactions and the "For you" row does not appear.

We do not keep a separate profile of you anywhere. Your taste is worked out fresh each time it is needed, directly from your reaction history, and the result is kept in a short server cache for at most one hour before it expires. There is no long-lived "taste profile" database.

Deleting your account ("Revoke Access" in your profile menu) removes your reactions along with everything else, and any cached result for you expires on its own shortly after.

As with "More like this", this is calculated on our own servers from our own database. No third-party recommendation service is involved, and your reactions are never shared outside Creativity for this purpose.

12. Artificial intelligence

We use generative-AI models to help make the catalogue: key art (posters, thumbnails, logos, television artwork), draft descriptions written from a film’s dialogue, Greek and English translations, subtitle, caption and closed-caption tracks and their translations, the retouching and cut-out of team portraits, suggested editorial tag scores and related-title lists, and — inside our production tools — storyboards, character and location illustrations, script assistance and receipt reading. Every use is started deliberately by a member of our team, or by a partner working on their own submission; nothing runs automatically on your data.

The models run at two providers. Replicate (United States) hosts models published by Google, Anthropic, OpenAI, Black Forest Labs, ByteDance and others; under its terms (updated 1 April 2026) it may use what we send only to produce the output and provide the service, and it deletes the inputs and outputs of API jobs after about an hour by default. Lightricks LTX (Israel) runs some video models; its terms (updated 13 May 2026) grant it a licence to use inputs and outputs, including any likeness in them, to improve its products and train its models. For that reason LTX is reachable only from our production tools, is used only on material Creativity holds the rights to, and a person’s image or voice is not sent to it without that person’s agreement; the media we hand it is kept in its storage for 24 hours. We use both providers’ programming interfaces, not consumer chat products, and each model’s own publisher terms apply on top.

What may reach a provider: frames, stills, audio and dialogue from a film or series (which can include the face and voice of anyone in it); the names of the people credited on it; the text of a script and its character and location notes; a team member’s portrait when a portrait is retouched; a photographed receipt when an expense is read; and, when we ask a model to help us read our own analytics, the aggregated audience statistics described in section 2 — countries, referring sites, watch time and taste bands, never a session identifier, a name or an email address. Your account data — name, email, Google ID, watch history, reactions — is never sent to an AI provider.

Our lawful basis is legitimate interest (Article 6(1)(f) GDPR / UK GDPR): presenting works well, making them accessible with subtitles in both languages, and running a small studio efficiently. We balanced that against the people concerned by sending only what the task needs, by using programming interfaces rather than consumer tools, by labelling the results, by keeping a human decision before anything is published, and — for portraits of our own team — by asking the person first. You may object to a particular use of your data with an AI provider at the contact address above; where a portrait, credit or contribution of yours is involved we will stop and, where possible, redo the work without AI.

AI-generated or AI-altered artwork and portraits are labelled where they are shown, subtitle and caption tracks a model produced or translated carry an “(AI)” marker in the player, and we never present AI output as a person’s work. We do not use AI to make decisions about you, to profile you or to recommend titles — sections 10 and 11 describe how recommendations really work.

We keep a record of each AI job — which model, what was sent, the result, the cost and who ran it — with the title or production it belongs to, as part of our accounts and audit trail.

13. Content reports

If you report content to us using the report form, we process what you send: the type of report, the link and the description you give, and — where you provide them — your name and email address. A copyright notice needs a name and contact details; other reports can be made anonymously.

We use the information in this report to review and act on it. The substance of your notice (what you reported and why) may be shared with the content provider so they can respond; your identity is only shared where necessary to act on the report, and we will say so beforehand.

Our lawful basis is our legal obligation to run a notice-and-action mechanism under Article 16 of the EU Digital Services Act, together with our legitimate interest in keeping unlawful material off the platform and in being able to defend a claim about how we handled a notice.

We keep a report and its outcome for three years after the matter is resolved — roughly how long a dispute about our handling of it could realistically run — and then delete it automatically.

14. Forms on the site

When you fill in one of our forms — a casting call, a survey, a competition, a feedback form — we process the answers you give and any file you attach, together with a salted hash of your IP address that we keep only to limit abuse of a public form. The form itself says what it is for; we keep the answers for as long as that purpose requires and then delete them. A file attached to a form that was never submitted is deleted after 24 hours.

Our lawful basis is your consent where the form asks for it, or otherwise the steps you ask us to take (for example, considering you for a role) — Article 6(1)(a) and (b) GDPR / UK GDPR.

15. What partner studios see

Some titles here are distributed by independent partner studios. Partners receive aggregated statistics only: how many views or sales a title had, and over what period. They never receive your name, your email address, your viewing history, or anything else that identifies you. This is written into our agreement with them, not only into this policy.

When you rent or buy a partner title, the payment is taken by the partner through Stripe, and Stripe processes your card details — we never see them. The partner receives, through their own Stripe account, what they need in order to issue your invoice and meet their own tax obligations as the seller — your name, email address and billing country — and they are a separate data controller for that. They may use it only to fulfil and account for the sale, never for marketing. Everything else about your account stays with us.

16. Partner applications and partner accounts

If you apply to become a Creativity Partner, we process what you enter on the application form — who you are (individual, group or company), your name, country, contact email, whether you want paid distribution, your description and the links you give us — together with the Google account you sign in with and the messages exchanged about the application. We also keep a salted hash of your IP address for a short time, purely to limit abuse of the form; it is never shown to anyone.

Our lawful basis is the steps you ask us to take before entering into a partner agreement (Article 6(1)(b) GDPR / UK GDPR); for the abuse-control hash, our legitimate interest in keeping a public form usable.

Applications that are not accepted, or that you withdraw, are deleted automatically six months after the decision; approved applications twelve months after approval, by which point the partner account holds what is needed. You can delete a closed application yourself from your application page, and withdraw an open one at any time.

Once you are a partner, we hold the details needed to run your channel and, if you sell titles, to identify you as the seller — legal name, address, tax registration number and the status of your Stripe account — together with everything you upload and submit, for as long as the partner agreement runs and for six years after it ends, the period tax law requires for the invoices you are named on; then the partner record and every file and video you uploaded are deleted. Media uploaded for a submission that was rejected or withdrawn, and that no published title uses, is deleted six months after the decision. People you invite to help manage your channel see each other’s name, email address and role, not the Google account behind them. The partner portal’s AI tools send only what you choose to give them, within a spending allowance we show you, and each AI job is recorded against your submission.

17. Crew, cast and contributors

This section is for the people who work with us on a production — cast, crew, contributors, volunteers, location owners, musicians — whether or not they have an account here. It covers Creativity Studio, our production tools, and the legal forms, call sheets and emails that go with a production.

What we hold: your name, role and contact details (email, phone, address) for call sheets and forms; the productions you are assigned to and what you do on them; the scripts, notes, images, recordings and comments you contribute; call sheets and schedules; expense claims with their receipts; legal forms (agreements, releases, deal memos) with the fee agreed, the name you typed and the signature you drew; and, for people on our public team page, a biography, portrait and links.

Lawful basis: performing our agreement with you, or the steps before it, for assignments, call sheets, forms and payments (Article 6(1)(b)); our legal obligations for financial records; and our legitimate interest in running a production, keeping an evidence record of what was signed, and crediting people accurately. Publication on the team page is with your agreement, which you can withdraw at any time.

Who sees it: the crew assigned to the same production see its working material, call sheets and — unless the producer restricts the legal module — its signed forms. Assigned crew see each other’s contact details; the public never does. A calendar feed you switch on for your own diary contains the names of the people you are scheduled with and is protected only by the secret link you copied — keep it private, and ask us to reset it if it leaks.

Studio’s AI tools (section 12) may process a script, a character or location image, a storyboard prompt or a receipt you contributed. An image of a real person is not sent to an image model unless a team member chooses to send it, and team portraits are only retouched with the person’s agreement.

We email you sign links, access changes and mentions from the production discussion at the address the producer holds for you, even if you have no account. Reply to any of them, or write to us, to stop.

Retention: production records are kept for as long as the production and its distribution exist, because credits, rights and clearances have to stay traceable for the life of the work; signed forms and expense records for at least six years, for tax and evidence; a crew member’s own login is deleted when they revoke access, but the records they wrote and signed remain. You may ask for a copy of any form you signed, and for your contact details to be removed once a production is over.

Your rights are the same as everyone’s — see section 20. Write to the contact address above; you do not need an account to exercise them.

18. Our representative in the EU

Creativity is established in the United Kingdom and offers its service to people in the European Union. Where Article 27 of the GDPR requires a representative in the EU, their name and contact details are published here; until they are, you may contact us directly at the address above about anything in this policy, and you keep every right described in it.

19. Security

We use appropriate technical and organisational measures to protect your personal data: encrypted connections everywhere, encrypted session cookies, access-controlled databases, least-privilege access for staff, and short-lived signed links for paid video. No transmission over the internet is completely secure, so we cannot promise absolute security, but if a breach ever affects your data we will tell you and the regulator as the law requires.

20. Your rights

You have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to take it with you in a portable format, and to withdraw any consent you have given at any time. To delete your account and all associated data (including Google user data), use “Revoke access” in your profile menu: it permanently deletes your account, watch history, preferences, reactions and stored Google data. Some records stay, without the link to your account: orders and invoices (tax law), content reports you made (three years), and anything you wrote or signed as crew on a production (section 17). Your profile fields can be changed or cleared from the menu under your name. For anything else, contact us at privacy@creativityfilms.gr

When you make a request we may ask you to confirm your identity. Requests are free and answered within one month; if a request is complex we may extend that by up to two months and will tell you if so. Order records that tax law requires us to keep are the one thing we cannot erase early, and we explain that when it applies.

You may withdraw consent for analytics from the cookie settings, for emails from any message we send, and for personalised recommendations from your account settings. Withdrawing consent does not affect processing that happened before you withdrew it.

21. Complaints

If you are unhappy with how we handle your data, please tell us first so that we can put it right. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Greece, the Hellenic Data Protection Authority (dpa.gr); or the authority of the EU member state where you live or work.

22. Children

You must be at least 16 to create an account. The free catalogue can be watched without an account. We do not knowingly collect personal data from children under 16; if you believe a child has created an account, contact us and we will delete it.

23. Changes to this policy

We will update this policy when our processing changes — for example when a new feature or provider is added. The date at the top is the date of the current version; material changes are announced on the platform.

Back to Home