Privacy Policy

1) Data controller

Creator Academy is a trade name operated by Norde SRL. We have not appointed a data protection officer: our activity does not fall within any of the cases in which such an appointment is mandatory under Article 37 of the GDPR. Your requests are handled directly at kriss@creator-academy.co.

2) Data collected and why

We only collect what we need. Below is the complete list of processing operations, depending on what you do on the website.

a. Contact form

We collect your name, your email address and the content of your message. The form does not accept attachments. This data is sent to us by email and is used only to reply to you.
Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b)) or our legitimate interest in responding to enquiries (Art. 6(1)(f)).

b. Course waiting lists

To be notified when a course or a tool opens, you need an account: we record the chosen list, the email address of your account and the date you signed up. Your address is added to that list's group in our emailing tool, Sender. This data is used solely to notify you of the opening; you can withdraw at any time from the relevant page, from your account or via the unsubscribe link in each email.
Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time via that link or by writing to us.

c. Student account

To take a course or download a plugin, you create an account. We record your name or username, your email address and your password, which is stored only in encrypted (hashed) form: no one, not even us, can read it back. If you sign in with Google, we receive from Google your name, your email address and your profile picture, without any password. If you enable two-step verification, we store the secret key used to verify your codes. Each sign-in creates a session, associated with the IP address and browser used, which ends when you sign out. When the account is created, we record the date and time at which you accepted the terms of use and this policy, as well as your choice regarding marketing emails (see h), so that we can prove it.
Legal basis: performance of the contract (Art. 6(1)(b)) and legitimate interest in securing accounts (Art. 6(1)(f)).

d. Purchase of a course or a plugin

Payments are collected by Stripe. We keep the details of each order: products purchased, amounts, VAT, billing country, status of the payment or of any refund, as well as the invoice issued. We never have access to your bank details: you enter them directly on Stripe, and they do not pass through this website.
Legal basis: performance of the contract (Art. 6(1)(b)) and accounting and tax obligations (Art. 6(1)(c)).

e. Plugin licences

Each plugin obtained (purchased or free) is associated with a licence key linked to your account, with its status (active, suspended or revoked) and the number of computers authorised. When a plugin is activated online, we record for each computer a fingerprint calculated from its identifier (never the identifier itself), the name of the computer if the plugin sends it, the activation date and the date of the last check. Each downloaded file carries an invisible identification mark: your licence key, a reference to your account and the date of the download. This data is used to make your licence work, to limit the number of computers and to trace the origin of a copy distributed without authorisation.
Legal basis: performance of the contract (Art. 6(1)(b)) and legitimate interest in protecting our plugins against unlawful sharing (Art. 6(1)(f)).

f. Tracking your progress

During a course, we record the lessons you open (date of first and last viewing, number of visits), those you complete, the days on which you are active and your quiz answers with their score. This data allows you to pick up where you left off and to see your progress. We also use it, in the form of statistics, to identify the lessons where students drop off, in order to improve them. The Creator Academy team can view each student's progress, for example to help them if they are stuck. For videos, we only record whether you have watched almost all of them: the detail of the parts watched stays in your browser. The personal notes you take under the lessons are visible only to you.
Legal basis: performance of the contract for your progress (Art. 6(1)(b)) and legitimate interest in improving our courses (Art. 6(1)(f)), to which you can object.

g. Questions, comments and reviews

The questions and comments you post under a lesson are visible, with your name, to the other students who have access to that lesson, as are the files you attach to them (images, videos, Fusion or Resolve files, 100 MB maximum per file). These files are stored at Supabase and deleted with the comment or your account; a file uploaded but never posted is erased after 24 hours. The reviews you leave on a course or a plugin are checked by our team before publication, then displayed on the sales page with only your first name and the initial of your surname, your rating and the date. If you attach a video, it contains your image and your voice: it is hosted by Bunny Stream and published on the sales page after approval, until you remove it. You can edit or remove your review at any time from your account. Published reviews also appear in the code of the sales page in a form readable by search engines (same first name, initial, rating, date and text), which may display them in their results.
Legal basis: performance of the contract for exchanges under the lessons (Art. 6(1)(b)) and your consent for the publication of a review (Art. 6(1)(a)).

A few days after you purchase or obtain for free a course or a plugin, we send you a single email asking for your review of that product (for a course, only if you have started it). We record the date of this email so that we never ask you again. You can refuse these emails at any time in your account (Emails section), via the link included in each of them.
Legal basis: our legitimate interest in gathering our customers' opinions on the products they have purchased (Art. 6(1)(f)), with the option to object at any time.

The ideas you suggest for a plugin (title and details) and the number of votes are publicly visible, on that plugin's page and to its customers, without your name. Any account can vote from the plugin's page; your vote is linked to your account, but no one else can see who voted. Our team can see your email address so that we can reply to you, and lets you know by email when your idea is released in an update. If you delete your account, your votes are erased and your ideas remain on the board with no link to you.
Legal basis: your consent, given by suggesting an idea or by voting (Art. 6(1)(a)).

h. Emails related to your account

We write to you to confirm your address, reset your password, confirm a purchase or an account deletion request and, if you wish, to let you know when someone replies to one of your questions. This last notification can be turned off in one click from your account. These emails contain no advertising; marketing emails are covered in the next point.
Legal basis: performance of the contract (Art. 6(1)(b)).

i. Marketing emails (Sender)

If you agree, we send you tips, new releases and offers by email. You give your consent by ticking the box provided when you create your account, or from the "My account" page; it is optional and has no effect on access to your courses. We record the date and time of your consent and, where applicable, of its withdrawal. The emails are sent through our service provider Sender, to whom we pass on your email address, your first name and the courses and plugins you have purchased or obtained, as well as the courses whose free chapters you have started, so that we can write to you about what concerns you (for example, tips for the course you are taking).
If you were already a student on our previous platform (Podia), we may write to you about our courses and plugins, which are products similar to those you purchased, unless you object.
You can unsubscribe at any time, free of charge, from the "My account" page or via the link at the bottom of each email.
Legal basis: your consent (Art. 6(1)(a)); for former students, our legitimate interest in informing our customers about similar products (Art. 6(1)(f) and Article XII.13 of the Belgian Code of Economic Law), to which you can object at any time.

j. Technical logs and security

Our hosting provider automatically records your IP address, the date and time of the request, the page requested and your browser. These logs are used to ensure the operation and security of the website and to diagnose incidents. To limit abuse (repeated submissions of a form, sign-in attempts), we also temporarily count the actions carried out from the same IP address or the same account.
Legal basis: legitimate interest in securing and maintaining the service (Art. 6(1)(f)).

k. Audience measurement and browsing analysis

If and only if you agree, we use Google Analytics and Microsoft Clarity. The latter records and replays your browsing session: mouse movements, clicks and scrolling, in anonymised form and with masking of what you type into fields. Details of the trackers, their durations and how to change your mind are set out in our cookie policy.
Legal basis: your consent (Art. 6(1)(a)).

We do not carry out any automated decision-making producing legal effects concerning you, nor any profiling within the meaning of Article 22 of the GDPR. We do not sell, rent or exchange your data with anyone.

3) Who receives your data

The service providers below act on our instructions and are bound by a contract that complies with Article 28 of the GDPR. We list them by name rather than by category, so that you can check their practices for yourself.

We may also disclose data to public authorities where the law requires us to do so, for example in response to a judicial order.

4) Transfers outside the European Union

Our hosting remains within the European Union. However, several of the service providers above belong to groups established outside the European Economic Area, mainly in the United States. These transfers are governed by the following safeguards:

• Supabase, Inc.: Standard contractual clauses (Supabase data processing agreement).
• Stripe Payments Europe, Ltd.: Standard contractual clauses and EU-US Data Privacy Framework certification.
• Resend, Inc.: Standard contractual clauses.
• Sender (UAB Sender.net): No transfer outside the European Union.
• Google Ireland Ltd. (Gmail): Standard contractual clauses and EU-US Data Privacy Framework certification.
• Google Ireland Ltd. (Sign in with Google): Standard contractual clauses and EU-US Data Privacy Framework certification.
• Google Ireland Ltd. (Google Analytics 4): Standard contractual clauses and EU-US Data Privacy Framework certification.
• Microsoft Ireland Operations Ltd. (Clarity): Standard contractual clauses and EU-US Data Privacy Framework certification.
• Cloudinary Ltd.: European Commission adequacy decision for Israel, supplemented by standard contractual clauses.
• Notion Labs, Inc.: Standard contractual clauses.
• Anthropic Ireland, Limited (Claude): Standard contractual clauses.

You can obtain a copy of the applicable safeguards by writing to us at kriss@creator-academy.co.

5) How long we keep it

• Contact form messages: for the time needed to handle your request, then archived for a maximum of 3 years from the last exchange.
• Waiting list sign-ups: until the relevant course opens, and for a maximum of 2 years, or immediately if you withdraw your consent.
• Account, progress, comments and reviews: for as long as your account exists. You can delete it at any time from the "My account" page: this data is then erased immediately, and disappears from the server backups when they are renewed.
• Marketing emails: your data remains with Sender until you unsubscribe or delete your account. Proof of your consent (date and time) and of its withdrawal is kept for as long as the account exists, then for 3 years so that we can respond to a complaint.
• Orders: kept with the accounting records (see below), even after your account is deleted, but detached from it.
• Plugin licences: for as long as the licence exists, then erased with your account. The identification mark remains in files already downloaded: we cannot remove it from them.
• Anti-abuse counters: a few hours, for the duration of the monitoring window.
• Refused or new licence activations: fingerprint of the computer (never its identifier) kept for 31 days, to detect a shared licence.
• Technical alerts (email not sent, failed refund or synchronisation, with the address concerned): until they are handled by our team, then 30 days.
• Technical logs: 12 months maximum.
• Audience measurement trackers: durations detailed in the cookie policy.
• Accounting records and invoices: 7 years, the period required by Belgian accounting and tax law.

At the end of these periods, the data is deleted or irreversibly anonymised.

6) Your rights

You have the following rights over your data:

• Access (Art. 15): to know whether we process your data and to obtain a copy of it.
• Rectification (Art. 16): to have inaccurate or incomplete data corrected.
• Erasure (Art. 17): to have it deleted, except where the law requires us to keep it, in particular for accounting purposes.
• Restriction (Art. 18): to request the temporary suspension of a processing operation.
• Portability (Art. 20): to receive the data you have provided to us in a machine-readable format.
• Objection (Art. 21): to object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Withdrawal of consent: at any time, without affecting what was done before. For marketing emails, this takes one click from the "My account" page or via the unsubscribe link in each email. For trackers, from the cookie policy.
• Post-mortem instructions: to decide what happens to your data after your death.

From the My account page, you can yourself download all your data (JSON file), correct your name, turn off notifications and delete your account. For anything else:

Write to us at kriss@creator-academy.co specifying your request. We reply within one month, in accordance with Article 12 of the GDPR. If there is serious doubt as to your identity, we may ask for proof of identity, solely to that extent.

Complaints. If you believe that we are not complying with the regulations, you may lodge a complaint with the Belgian supervisory authority, without prejudice to any judicial remedy:

7) Security

We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR: encryption of communications via HTTPS, strict security headers, restricted access to data, regular backups and selection of processors providing sufficient guarantees. As no system is infallible, we cannot guarantee absolute security.

In the event of a data breach likely to result in a high risk to your rights, we will inform you without undue delay, in accordance with Article 34 of the GDPR.

8) Minors

The website is not intended for persons under the age of 16, the age of digital consent in Belgium. We do not knowingly collect their data without the consent of the holder of parental responsibility. If you notice that a minor has provided us with data, write to us and we will delete it.

9) Changes

This policy may change along with our practices or the legal framework. The applicable version is the one published here, the date of the last update being shown at the top of the document. In the event of a substantial change affecting your rights, we will inform you of it visibly on the website.