Privacy Policy

1. Information We Collect

We may collect the following types of personal information:

• Identity information: name, email address, phone number, job title, company and organization name — provided when you submit a contact or lead form, create an account, or purchase a product.
• Account information: your email address and sign-in credentials. Passwords are stored only in hashed form by our authentication provider; if you sign in with Google or LinkedIn we receive your name and email from that provider.
• AI Coaching and Behavioral Data (Get Savvy):
  • Chat logs: the text of conversations and prompts you submit to the 'Strategic Partner' AI coach, and the AI's replies.
  • Transcripts and media: text transcripts, audio, or video files (e.g. from Zoom or Teams) that you voluntarily upload for 'Shadow Coach' analysis, and the resulting analysis, which we save to your account.
  • Voice and audio: real-time audio you speak during 'Live Coach' sessions, which is streamed to our AI provider to generate spoken responses. We do not store the audio itself; we record that a session took place and may save a short text summary of it to your account so your coach can remember context in future sessions.
  • Behavioral profiles: assessment data (such as DISC or MBTI) that you upload or enter to personalize your coaching, and practice-session scores and action plans.
• Payment information: billing is handled by Stripe. We do not store your full card number, expiry date or CVV on our servers; we keep your plan, subscription status and Stripe customer reference.
• Usage data: product usage (e.g. AI usage counts and model used), and error diagnostics collected by our error-monitoring provider.
• Website analytics: pages visited, referrer, browser, device type and the approximate country and city you are visiting from (worked out by our host, Cloudflare, from your connection — we do not store your IP address). On our marketing website this is collected, together with Google Analytics and the Reddit advertising pixel, only if you consent. Inside the Get Savvy app we count page visits in the same anonymous way but record country only, without your IP address, city or any identifier that persists between visits.
• Communications: the content of messages you send us and records of onboarding and marketing emails we send you.

2. How We Use Your Information

• To provide, manage and improve our services, including generating personalized coaching.
• AI processing and training: your coaching messages, transcripts and voice are sent to Google's Gemini API to generate responses. We use them only to provide your coaching. We do not use your private chat logs, transcripts or voice data to train our own AI models, and we use Google's paid API service, under which Google states it does not use prompts or responses to improve its products. Google may retain prompts and responses for a limited period to detect and prevent abuse and to meet legal obligations.
• Automated processing: the AI coach and analyses generate suggestions, scores and action plans. They are advisory. We do not make automated decisions about you that have legal or similarly significant effects.
• Zero-retention mode (Enterprise): for organizations that have it switched on, the analysis of meeting transcripts and recordings in Shadow Coach is shown once and is not saved on our servers; the user can download it. It does not cover other features (for example Strategic Partner chats, which are stored as described above), and our AI provider may still hold prompts for a limited period as described above.
• To process payments and manage subscriptions.
• To communicate with you about your account and orders, send onboarding emails, and send marketing (which you can opt out of at any time).
• To understand and secure website usage (with your consent for analytics), and to comply with legal obligations.

We do not sell, rent or trade your personal information to third parties for marketing purposes.

3. Who Can Access Your Information

• Service providers listed in section 4, only as needed to deliver their service to us.
• CreateOne administrators can access account data for support, security and operational purposes.
• Team leads and employers: if you are part of a team or Enterprise account, the team lead who manages your team can view your profile details (such as name, email, job title, plan and behavioral profile) and team-level analytics. Your private coaching conversations and analyses are not visible to your team lead.
• Where the law requires — for example a court order or a request from a regulator.

4. Service Providers and Where Your Data Is Stored

We use the following providers to run Get Savvy. Your information is stored and processed in Japan and the United States, and may be accessed from other countries by these providers. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, including choosing providers with established security practices and contractual terms.

5. Security

Data is encrypted in transit (TLS) and encrypted at rest by our hosting providers. We restrict access to accounts and data using authentication and database-level access rules, limit administrator access, and monitor for errors and abuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and, where the GDPR applies, the relevant supervisory authority within 72 hours where required.

6. How Long We Keep Information

• Account and coaching data (profile, chats, analyses, action plans, practice history): kept while your account is active and deleted when you delete your account.
• Website visit records (page, referrer, browser, country and, on the marketing website, city): deleted after 12 months. Visit records collected before 30 September 2026 also include an IP address and approximate city; they are deleted on the same schedule.
• Email delivery queues: deleted 90 days after sending.
• AI usage logs: identifying details are removed after 24 months.
• Payment and billing records: held by Stripe and kept as required by tax and corporate record-keeping laws, even after your account is deleted.
• Backups and provider logs: may persist for a limited period after deletion before being overwritten. Our AI provider may retain prompts for a limited period as described in section 2.

7. Cookies, Analytics and Tracking

Sign-in uses browser storage that is essential to keep you logged in. Analytics and advertising tools (Google Analytics, the Reddit pixel) and our own visitor logging (which records the country and city you visit from) run on our marketing website only if you click Accept in the consent banner. If you click Decline, or make no choice, they do not run. You can change your mind at any time using "Cookie settings" in the website footer.

8. For Users in the EEA and UK

We process your personal data under lawful bases including performance of a contract, consent (for analytics and advertising tools), and legitimate interests (such as securing the service). Your data is transferred to and processed in Japan and the United States by the providers listed above.

9. Your Rights

• Access and portability: download a copy of the data we hold about you at any time from Profile → Your data → Export my data.
• Deletion: permanently delete your account and personal data from Profile → Your data → Delete my account. If you have an active paid subscription, cancel it first. If you also have a CreateOne learning portal (Continu) account, contact us and we will have it removed.
• Correction: update most of your details on your Profile page, or contact us.
• Withdraw consent / opt out: of analytics via the cookie banner, and of marketing emails via the unsubscribe link or by contacting us.
• Complaints: contact us first and we will respond promptly. You may also complain to the OAIC (oaic.gov.au) or, if you are in the EEA or UK, your local data protection authority.

10. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this policy as our services or the law change. The "Last updated" date above shows the current version.

12. Contact

If you have questions, concerns, or complaints regarding this Privacy Policy, or want to exercise your rights, please contact us at:

CreateOne

PO Box 9174, Brighton VIC 3186, Australia

Email: info@createone.com

Phone: +61 1300 885 703