CreatorBuddy

GDPR overview

There is no GDPR content on this site at all. The word never appears, in the privacy policy, the terms or the fulfillment policy, and neither does CCPA. No legal basis for processing is stated, no retention period is given, and no procedure is published for access, portability, erasure or objection. No Article 27 EU representative and no data protection officer is named. No data processing agreement is offered to customers; the only mention of data protection agreements covers the vendor's own suppliers. All data sits on US servers, with no transfer mechanism described. The single protective rule is an age floor of 16, with deletion promised if a younger user is identified. European users have one route for any privacy question: alex@creatorbuddy.io. This is an absence of published information, not evidence of non-compliance.

Who owns the data?

The privacy policy limits collection to three things: your email address, the tweets you choose to sync from X, and the content ideas you type in. Nothing is described as sold or shared with advertisers, or with any third party beyond the named providers. Ideas you enter stay under your control and can be deleted from the account at any time. The terms of service say nothing about who owns the posts the AI produces: they claim no licence over your output and grant you none explicitly, so ownership of generated content is simply left undocumented. Both documents carry a single date, 23 January 2025.

Reuse rights

Nothing in the terms restricts what you do with the posts, articles or scripts the tool produces. There is no licence clause, no attribution requirement and no resale limit, so no published rule stands between you and reusing your output commercially. On the vendor's side the stated uses are narrow: generating and repurposing content ideas, personalising suggestions from your synced tweets, and storing your inputs inside your workspace. Named providers do the processing, each described as acting on the vendor's behalf: OpenAI and Claude for generation, Supabase for storage, Clerk for authentication, Stripe for payments and the X API for tweet syncing. Model training is never mentioned, in either direction. One discrepancy is worth noting: the policy claims no cookies and no third-party tracking, yet an X advertising pixel sits in the homepage code.

Data retention & training

Hosting summary

All user data is stored on Supabase servers on the east coast of the United States, and that is the whole of what the site publishes about hosting. No European region is offered and there is no data residency option, so a European customer's content leaves the EU by design. The surrounding infrastructure is US-based too: the domain resolves to 76.76.21.21, an address on Amazon's AS16509 network, served through an anycast node. Two other providers hold user data outside the main database, Clerk for authentication on a dedicated subdomain and Stripe for payment details. The site publishes no security certification, no SOC 2 or ISO 27001 attestation, no trust or status page, and no description of encryption, backups or access controls. Jurisdiction, in practice, is American, with a company address in Menlo Park, California.