Privacy Policy

Last updated: 15 July 2026

1. Company information

Fossca Limited, trading as CreateFu. Registered in England, company number 11630043. Registered office: 4–6 Swaby's Yard, Walkergate, Beverley, HU17 9BZ. Studio and correspondence address: 1 Madeley Street, Hull, HU3 2AH. Phone 01482 244244, email support@createfu.com.

Fossca Limited is the data controller for the personal data described in this policy, except where section 12 says otherwise.

2. Service description

CreateFu provides a Software as a Service (SaaS) platform for photographers and videographers ("creators") to host and share their photos and videos with their clients. The service operates across web, iOS, and Android applications.

3. Data we collect

We collect and hold the following categories of data:

• Account and profile details you give us — such as your name, email address, phone number and any profile image you add.
• Login credentials — your password is held only as a one-way cryptographic hash by our authentication provider; we cannot read it.
• Subscription and billing references — such as customer and subscription identifiers from our payment provider. We never store card numbers.
• Device and notification data — such as push-notification tokens and your notification preferences.
• The content you upload and the details attached to it — files, session information, favourites and sharing records.
• For creators: studio and branding details, team invitations, and the client records they choose to keep in the service.
• Technical data generated automatically when you use the service — such as IP addresses in server logs, used for security, troubleshooting and abuse prevention and kept for limited periods.

This applies to both kinds of user: creators, and the clients they invite. You are not under any legal obligation to give us personal data, but a name, email address and password are needed to create and operate an account — without them we cannot provide the service. Everything else is optional.

4. Why we use it

To identify users within the system, provide technical support, operate sharing and notifications between creators and their clients, keep the service secure, and administer subscriptions and billing.

5. Where it is processed

Email and password data for authentication are held with Amazon Web Services (AWS). Photos and videos uploaded to the platform are stored with AWS. Payments are processed by Stripe, who receive the details needed to take payment; we do not store card numbers.

6. How long we keep it

User data is retained while an account exists, including while it is paused. When an account is deleted, personal data is removed from our live systems promptly — normally within minutes — cascading through the database, file storage and our authentication provider. Short-lived technical logs (such as IP addresses in server logs) expire on a rolling basis. Residual copies may remain in encrypted backups until those backups expire, a few months at most; backups are used only for disaster recovery, and any data restored from them is deleted again.

Two exceptions: we keep a salted, one-way hash of the account email address for as long as we offer free trials, solely to prevent trial abuse — we cannot turn it back into your address, but it lets us recognise if the same address signs up again. And Stripe retains billing records for tax and audit purposes. Uploaded files are handled as described in the Terms and Conditions.

7. Your rights

You can edit your details or delete your account in the app, or by contacting support@createfu.com. Under UK data protection law — and any other data protection laws that apply where you live — you also have the right to access a copy of your data, to correct it, to have it deleted, to object to or restrict processing, and to data portability. Contact support@createfu.com and we will respond within one month (for complex requests the law allows up to two further months — if we need them, we will tell you within the first month).

You have the right to object at any time to your data being used for direct marketing. If you object, we stop — no exceptions. Use the unsubscribe link in any email or contact support@createfu.com.

Where our processing is based on your consent, you can withdraw that consent at any time — via the cookie settings on the website, the unsubscribe link in any marketing email, your device's notification settings, or by emailing support@createfu.com. Withdrawing consent does not affect processing that happened before you withdrew it.

Where your request concerns photos, videos or client records controlled by the creator who works with you (see section 12), the creator is the data controller: we will pass your request to them promptly and help them deal with it, but the decision is theirs. Requests about your CreateFu account itself are ours to handle.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or, if you live outside the UK, to your local privacy regulator.

8. Security

All data is hosted on Amazon Web Services and protected by industry-standard measures, including encryption in transit and at rest. Passwords are stored only as one-way hashes by our authentication provider and are never visible to CreateFu staff.

9. Cookies and tracking

The platform uses cookies to keep you signed in; these are essential and always on. The app contains no third-party advertising or cross-site tracking; any analytics we use are described in this policy. The createfu.com website uses Google Analytics to understand how the site is used: those cookies record pages visited and how you arrived, the information goes to Google, and they are set only if you accept them via the cookie banner. You can change your cookie choice at any time via the Cookie settings link in the site footer.

10. Marketing and communication

We may email creators who start a trial or subscription about CreateFu and similar services we offer; you can opt out when you sign up and via the link in every email. We do not send marketing to clients who join by a creator's invitation unless they have asked for it, and they can withdraw that consent at any time. Service emails (such as sharing notifications and account or billing notices) are part of running the platform and are not marketing.

Push notifications are used for service events — such as new files being shared with you, or account and billing notices. We do not use push notifications for marketing unless you have opted in, and you can turn notifications off in the app or your device settings at any time.

11. Prospective customers (outreach)

We keep a small database of professional photographers and videographers we may contact about CreateFu. It holds business contact details taken from those businesses' own public websites and social profiles — name, business name, business email and phone, public social handles, location, specialisms and brief notes on relevance to the product. It is held for us by Atlassian (Trello). We process this under our legitimate interest in telling relevant professionals about a product built for their trade.

We contact people individually — a message and at most one follow-up in any approach, and occasionally again later if there is something genuinely new to say — and we never sell or share these details. We check telephone numbers against the Telephone Preference Service before any marketing call. We remove a prospect's details within a reasonable period once an approach closes; if you ask us to stop, we delete your details and keep only your email address on a suppression list so you are not contacted again. To object at any time: support@createfu.com.

12. Creators' client content

Files that creators upload, and any personal data within or attached to them (such as their clients' names and contact details), belong to the creator's business: for that data the creator is the data controller and Fossca Limited is their data processor, acting on their instructions as described in the Terms and Conditions. This includes client records a creator enters (name, phone, address) for people who may never open an account themselves. We do not use facial recognition or analyse the content of uploaded files.

We are the controller for platform account data (section 3). Our current sub-processors: Amazon Web Services (hosting and infrastructure, including storage, authentication and email delivery), Stripe (payments), and Expo (push notification delivery). Address autocomplete uses Google's Places service; the text typed is sent to Google but not stored by us. We keep this list current here and give creators notice before adding or replacing a provider that processes their data.

13. Legal bases and international transfers

We collect only what we need for the purposes described in this policy. Our lawful bases, by purpose: performance of a contract — operating your account, sharing, notifications and billing; legitimate interests — service security and abuse prevention (including the trial-abuse email hash), service communications, and outreach to prospective customers (section 11); legal obligation — tax and accounting records; consent — analytics cookies on the website and any marketing you opt into.

Our primary data storage is in AWS's UK region. Some of our providers — including our payment, push-notification, address-lookup and website-analytics providers — process data in the United States or elsewhere. Wherever personal data leaves the UK, the transfer is protected by recognised safeguards: a UK adequacy decision (including the UK–US Data Bridge) or the UK's international data transfer agreement or addendum with the provider. Contact support@createfu.com for details of the safeguard applying to a particular provider.

We do not make any decisions about you based solely on automated processing that have legal or similarly significant effects. Account pausing when a trial or payment lapses is automatic, but everything is restored when a subscription starts.

14. Compliance with laws

Fossca Limited adheres to the UK Data Protection Act 2018 and UK GDPR and, where they apply to you, the data protection laws of the country where you live. CreateFu is sold to businesses; the clients they invite may be individuals. The service is not intended for children under 13 and we do not knowingly collect their data.

15. Changes to this policy

We keep this policy under review; the date at the top shows the current version. If we make a significant change — new data, new purpose, new recipient — we will tell account holders by email or in-app notice before it takes effect.