How we protect
your data

This policy explains what Creatop does with personal data we control. It does not cover the data we process on behalf of our clients: where we run outbound for a client, that client is the controller, and requests about that data should go to them.

Who we are

Creatop LLC (“Creatop”, “we”, “us”) operates creatop.net and the client portal at app.creatop.net. We are registered at 30 N Gould St Ste R, Sheridan, Wyoming 82801, United States, EIN 38-4327033.

Questions about this policy: privacy@creatop.net.

What this policy covers

This policy applies to visitors to our website, people who contact us or are contacted by us about our own services, and representatives of our clients and suppliers.

It does not apply to personal data our clients instruct us to process on their behalf. Where we run outbound campaigns for a client, that client is the controller of the prospect data involved. Requests about that data should go to the client. Our handling of it is governed by our client agreement and the Data Processing Addendum, and we will pass on any request we receive.

Our two roles

We are a controller when we decide why and how data is processed: running our site, responding to enquiries, our own marketing, managing client relationships and billing, and securing our systems.

We are a processor when a client instructs us to process data as part of delivering their outbound programme: building and enriching prospect lists, sending campaigns, and recording replies and outcomes. We act only on the client’s documented instructions.

What we collect

You give us directly: name, business email, company, role, and anything you write in a form, an email, or a booked call.

We collect automatically: IP address, browser and device information, pages viewed, referring pages, and dates and times of access, together with server and security logs.

Cookies: we use cookies to run the site, remember preferences, and understand how the site is used.

Our own prospecting: we run outbound for ourselves. If we contacted you cold, we hold your name, business email, company, role, and publicly available professional information, obtained from business data providers and public sources. You can opt out at any time using the unsubscribe link in any email, or by writing to privacy@creatop.net, and we will stop sending and suppress your details.

Why we process it, and our lawful basis

Running and securing the site: legitimate interests. Answering enquiries: legitimate interests, or steps taken prior to a contract. Delivering services to clients: contract. Our own B2B outreach: legitimate interests, subject to your right to object. Billing and records: legal obligation.

Sharing and sub-processors

We do not sell personal data.

We share data with service providers who help us operate, including business data providers, sending and outreach platforms, automation and workflow tools, AI providers, and our workspace and storage tools. We will provide our current sub-processor list to any client on request.

International transfers

We are based in the United States and work with clients and suppliers in the EU, the UK, and the US. Where personal data moves outside the EEA or the UK, we rely on appropriate safeguards, including Standard Contractual Clauses.

Retention

We keep controller data only as long as it is needed for the purpose it was collected for, then delete or anonymise it. Suppression records are kept indefinitely, because that is how we make sure we do not contact someone who has opted out again.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to our processing, and to withdraw consent. To exercise any of these, write to privacy@creatop.net. You can also complain to your local data protection authority.

For data we process on a client’s behalf, contact that client. We will forward any request we receive and support them in answering it.

Security

We hold client prospect data, and we send from infrastructure that carries a client’s name. Both are hard to repair once damaged, so we treat security and sending discipline as part of the service rather than as a policy document.

Independently attested

We hold a NIST cybersecurity attestation, verifiable at lockwell.co/nist/creatop.

We follow the rules that apply to outbound

GDPR and CAN-SPAM, including a lawful basis for B2B contact, honouring opt-outs immediately and permanently, and accurate sender identification.

Data is stored and moved securely

Encrypted in transit and at rest, with access limited to the people delivering the work.

Sending discipline is enforced, not aspirational

Warmup runs for a minimum of 14 days before any campaign sends, and never turns off. Volume is capped per mailbox. Campaigns pause automatically if bounce rates cross 4%. These are operating rules, not targets.

Ownership is a security property

The domains, the lists, and the copy we build belong to the client. They can export them, keep them, or take them in-house at any time. That is a security property as much as a commercial one.

Reporting a concern

Security concerns: privacy@creatop.net.

Changes

We will update this page when our practices change, and revise the date below.

Last updated: 8 November 2026