creiamo.ai Inc. ("creiamo.ai", "we", "us") is the controller of the personal data described in this notice — we decide why and how it is processed.

Data protection officer

We have not appointed a data protection officer. Our processing does not meet the Art. 37(1) thresholds: we are not a public authority, our core activities do not require regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of data on a large scale. Privacy questions go to hello@creiamo.ai.

This notice applies to personal data we handle as a controller:

• your visit to the creiamo.ai website;
• the "Request a scoping call" form and any other enquiry form on the site;
• email and correspondence between us, including during a commercial discussion.

In this notice, "GDPR" means Regulation (EU) 2016/679 and, if you are in the United Kingdom, the UK GDPR read together with the Data Protection Act 2018. The article numbering is the same in both, and so are your rights.

This site is addressed to professionals acting for their organisations. It is not directed at children, and we do not knowingly collect personal data about anyone under 16.

Not everything arrives through the form. If someone introduces us — an investor forwarding your details, a mutual contact suggesting we talk — we receive a small amount of personal data about you from them, not from you. Where that happens, this notice is the information we owe you under Art. 14: we will link to it in our first message to you, and in any event within one month. We use referral details only to respond to the introduction, and if nothing comes of it they fall under the same retention rule as any other enquiry (section 8).

Our legitimate interests, and your right to object

Where we rely on legitimate interests we have weighed our interest against your rights and freedoms. The data involved is ordinary business-contact data, given by you or by the person introducing us in a professional capacity, used for the purpose it was supplied for. You can object at any time under Art. 21(1) — see section 9. Ask us for the balancing assessment and we will send it.

This site sets no cookies. It runs no analytics, no advertising or social-media pixels, no session recording, and no fingerprinting. Nothing is written to or read from your device beyond your browser's ordinary cache of the page and its fonts. That is why you see no cookie banner — there is nothing to consent to under Article 5(3) of the ePrivacy Directive, or under regulation 6 of PECR, its UK equivalent.

Your browser contacts no third party at all. Everything this page needs — the markup, the styles, the two typefaces, the logo — is served from creiamo.ai itself. There is no font host, no tag manager, no embedded video, map or social widget. You do not have to take our word for it: open your browser's network panel, reload, and read the list of hosts.

Do Not Track and Global Privacy Control

Some browsers send signals — DNT, GPC — asking sites not to track you or not to sell your data. We respond to them the only way a site that tracks no one and sells nothing can: there is nothing to switch off. We say this expressly because California law requires every site collecting data from California residents to disclose how it responds to Do Not Track signals.

We keep the list short on purpose. Each processor is engaged under a written contract meeting Art. 28, and processes personal data only on our instructions.

A note on typefaces

This site is set in Schibsted Grotesk and Spline Sans Mono. Both are served from creiamo.ai itself. Loading them from Google Fonts — the ordinary way to use them — would have transmitted your IP address to Google LLC in the United States on every visit, before you had done anything on the page. We host the files instead, so that disclosure does not happen and Google is not a recipient of your data.

creiamo.ai is in the United States and so are most of our processors. Personal data covered by this notice therefore leaves the EEA and the UK. Those transfers rely on:

• the EU–US Data Privacy Framework and its UK Extension, where the recipient is certified under it — an adequacy decision under Art. 45; and otherwise
• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the UK International Data Transfer Addendum for UK transfers — appropriate safeguards under Art. 46(2)(c); supported by a transfer impact assessment and, where warranted, supplementary technical measures.

Vercel Inc. and Resend are certified under the EU–US Data Privacy Framework, including its UK Extension; transfers to them rest on the adequacy decision, with the Standard Contractual Clauses standing behind it if a certification ever lapses. We check each recipient against the official Data Privacy Framework list whenever we update this notice.

Vercel serves this site from a global edge network, so technical data in server logs may be processed at edge locations outside the United States and the EEA. The same safeguards travel with it.

Ask us at hello@creiamo.ai for a copy of the safeguards in place for any specific transfer.

You can ask us to delete your enquiry sooner. Unless we need it for a live engagement or a legal claim, we will.

Under the GDPR you have the following rights over your personal data. They are free to exercise, and you exercise them by writing to hello@creiamo.ai.

Consent

We do not rely on consent for any processing described here, so there is no consent for you to withdraw. If that ever changes, withdrawing will be as easy as giving it, and will not affect the lawfulness of processing carried out beforehand.

How we respond

We answer within one month of receiving your request (Art. 12(3)), extendable by two further months for complex or numerous requests — we will tell you within the first month if we need that. We may ask for enough information to confirm your identity, and no more.

Complaints

If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to a supervisory authority (Art. 77), in the EU Member State of your habitual residence, your place of work, or where the alleged infringement took place. The list of national authorities is published by the European Data Protection Board at edpb.europa.eu. In the UK, the authority is the Information Commissioner's Office at ico.org.uk. You may also address our EU or UK representative named in section 1.

This notice is written to the GDPR standard, which asks more of us than current US law asks of a site like this. Two things US law wants said expressly:

Comprehensive state privacy laws — California's CCPA/CPRA and its counterparts in other states — apply to businesses above thresholds of revenue and volume that we do not currently meet. If we grow past them, this notice will change before our practices do. In the meantime we do not wait for the law: the rights in section 9 are open to anyone who writes to hello@creiamo.ai, wherever you are.

For how we respond to Do Not Track and Global Privacy Control signals, see section 5.

We do not make decisions about you by solely automated means that produce legal effects or similarly significantly affect you, and we do not profile you. A human reads every enquiry. The only automated step in the form is a hidden spam trap that discards submissions filled in by bots — it evaluates the submission, not the person.

No. Providing it is neither a statutory nor a contractual requirement. But we cannot answer a scoping request without a name, a work email address and an organisation — the only consequence of not providing them is that we cannot reply. Your role, regulatory route and device stage are optional context that lets us come to the call prepared.

During an engagement we may process personal data that sits inside your technical documentation, your training, validation or clinical datasets, or your post-market data. In that role we act only on your documented instructions. You remain the controller and we are your processor.

That relationship is governed by the data processing agreement in the engagement contract, which sets out subject matter, duration, purpose, categories of data and data subjects, sub-processor terms, security measures, audit and assistance obligations, and what happens to the data at the end — as Art. 28(3) requires. This notice does not govern it, and nothing here overrides it.

• All traffic to and from this site is encrypted in transit over TLS; the site is served over HTTPS only, with HSTS.
• Enquiry data is transmitted directly to our email provider and stored in our mailbox. We keep no marketing database and no CRM of our own.
• Access to enquiry data is limited to the people who need it to answer you — currently the two founders.
• Our processors are chosen for their own security posture and are contractually bound to appropriate technical and organisational measures.
• No payment or financial data is collected through this website.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours under Art. 33, and notify you directly where the risk is high under Art. 34.

We update this notice when our processing changes. The version number and effective date at the top always tell you which one you are reading. Where a change materially affects people whose data we already hold, we will tell them directly where that is practicable.