LEGAL

Privacy Policy

Last updated: 26 September 2026

Creator PAT is operated by Lomexus Limited (“Lomexus”, “we”, “us” or “our”). Lomexus Limited is the controller of personal data processed through Creator PAT.

Who we are

Lomexus Limited is registered in England and Wales under company number 17465716. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom. Privacy enquiries can be sent to privacy@creatorpat.com.

What we collect

We process account details such as your name, email address, profile information and sign-in records; videos, titles, descriptions, hashtags and publishing settings you provide; connected social-account identifiers, profile information, permissions and OAuth credentials; delivery history and platform responses; beta-registration and marketing preferences; support messages and attachments; and technical, security, audit and application-error information generated when you use Creator PAT.

We do not ask for or store your Facebook, Instagram, TikTok, Google or YouTube password.

Why we use it and our legal bases

We use account, content, connection and delivery information to provide Creator PAT and carry out publishing instructions you request. This processing is necessary to perform our contract with you. We use security, audit, diagnostic and limited service-usage information where necessary for our legitimate interests in operating, protecting, troubleshooting and improving Creator PAT. We process information where required by law. We use consent for optional beta and product marketing; you can withdraw that consent at any time using the unsubscribe link in those emails.

Connected social platforms

When you connect Facebook or Instagram (Meta), TikTok, or Google/YouTube, Creator PAT exchanges information with that platform to authenticate the connection, identify the publishing destination and perform actions you request. Those platforms process information under their own privacy terms. Disconnecting an account stops Creator PAT using that connection for future publishing.

Google and YouTube API data

Creator PAT uses YouTube API Services. We request basic channel information so we can identify and display your connected destination, and permission to upload videos when you instruct Creator PAT to publish. We may store the channel identifier and channel information returned by the YouTube API together with OAuth access and refresh credentials required to maintain the connection.

Creator PAT does not sell Google user data, use it for advertising, credit or lending decisions, or transfer it to data brokers or advertising platforms. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google describes its own processing in the Google Privacy Policy.

Who we share information with

We use service providers that process information for us to operate Creator PAT: Vercel for application hosting and delivery; Supabase for database, authentication and application storage services; Cloudflare for staged video storage and delivery; and Resend for transactional and beta emails. We also send content and required account/publishing information to Meta, TikTok and Google/YouTube when you choose those destinations. We may disclose information where required by law or where necessary to protect legal rights or service security. We do not sell personal data.

International transfers

Some service providers and connected platforms operate internationally and may process information outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we rely on an applicable adequacy regulation or appropriate contractual safeguards provided for under UK data-protection law.

How long we keep information

Staged video files are temporary. Creator PAT currently gives uploaded publishing media a seven-day staging lifetime and releases staged media after all selected destinations have completed successfully. Draft media may therefore remain available for up to seven days unless replaced or released sooner.

Account, post, delivery and connection records are retained while needed to provide and support your account. Connected credentials are deleted or rendered unusable when the connection is removed or they are no longer required. Support, audit and security records may be retained for a reasonable period where needed to investigate issues, prevent abuse, resolve disputes or meet legal obligations.

Beta-list contact details are used for the beta/product updates you requested. If you unsubscribe, Creator PAT removes the raw waitlist record and retains only a one-way hash of the email address so we can honour the suppression. For YouTube API data, if access can no longer be verified or you request deletion of applicable YouTube user data held by Creator PAT, we will delete it within 30 days, except information we are legally required to retain.

Security

We use access controls, row-level database security, encrypted network connections and restricted production credentials designed to protect Creator PAT data. OAuth credentials are stored in encrypted form. No internet service can guarantee absolute security, but we review access controls and service configuration as Creator PAT develops.

Your rights

Under UK data-protection law, depending on the circumstances, you may have rights to access, correct or erase personal data, restrict or object to processing, request data portability, and withdraw consent where processing relies on consent. To exercise a right, contact privacy@creatorpat.com. We may need to verify your identity.

Complaints

Please contact us first if you have a privacy concern so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

Account and data deletion

See our Data Deletion page for instructions on requesting deletion of Creator PAT data. Deleting data from Creator PAT does not delete content already published to or held independently by a connected social platform.

Changes

We will review this notice as Creator PAT changes. If we introduce a materially different use of personal data, we will update this notice before that processing begins and bring the change to affected users’ attention where required.