What data we process, and on what ground

The controller is CreativMaro SRL, registration number 1009600037044, str. Calea Iesilor 16, no. 3, ap. 8V, MD-2069, Chisinau, Republic of Moldova. Zafirok is the brand under which we provide the application.

Subscriptions are billed by Create Go LLC, 7901 4th St N, STE 300, St. Petersburg, FL 33702, United States, which processes your name, email address and billing details for that purpose.

Write to support@creatego.net for any request about your data. We reply within one month.

We process data under Law no. 195/2024 on personal data protection, applicable from 23 August 2026.

For your account data we are the controller: name, email, subscription and how you use the application.

For the data your company enters about workers, projects, timesheets and expenses, your company is the controller and we are only a processor. We process it on your instructions and never for our own purposes.

In practice: if you are a worker whose data was entered by an employer, address your request to them first. We will assist, but the decision is theirs.

• Account and company details, to provide the service. Ground: performance of the contract, art. 6(1)(b).
• Worker data entered by the company: name, phone, date of birth, rate, timesheets, projects. Here the company sets the ground, as controller.
• Access to the worker portal, by password. The password is stored only as a cryptographic hash, never in clear text.
• Invoicing and payment records. Ground: legal obligation, art. 6(1)(c).
• Technical logs and security events. Ground: legitimate interest, art. 6(1)(f).

Google, for the database and authentication. Vercel, for hosting and access logs. Garage, on Contabo servers located in France, for uploaded documents.

OpenAI, for the in-app assistant, voice message transcription and automatic reading of photographed invoices. Content is sent with instructions not to be retained or used for model training.

Stripe for payments, Brevo for email, SMS.md and SMS.to for text messages.

We use no analytics or advertising tools on this site, so there are no tracking cookies.

Uploaded documents are stored on servers in France. Being within the European Economic Area, these transfers require no additional formality under art. 44(2).

Some providers process data in the United States. Those transfers rely on standard contractual clauses, allowed without prior authorisation by art. 46(2)(c). You may request a copy of these safeguards.

Separation between companies is enforced at the database level, not only in the interface: a request that reaches outside your company is refused by the server, wherever it comes from. The database is hosted in a European region.

Uploaded documents have no public address. Every download verifies the session and that the file belongs to the company requesting it.

Passwords are never stored in clear text, worker portal passwords included. e-Factura API credentials are encrypted, with the key held separately from the database.

Alongside the daily backups, the database can be restored to any moment within the last 7 days, and is protected against accidental deletion.

• Active account: for the duration of the contract, plus 30 days.
• Deleted account: purged within 30 days by an automated job.
• Invoices and accounting records: for the statutory archiving period.
• Technical logs: 90 days.
• Backups: at most 35 days, after which deleted data is not reintroduced.

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest, under art. 15 to 22. You may withdraw consent at any time, as easily as you gave it, art. 7(3).

We make no automated decisions producing legal effects about you, and we do not profile you.

If our answer does not satisfy you, you may complain to the National Centre for Personal Data Protection, str. Serghei Lazo 48, Chisinau MD-2004, datepersonale.md, or go to court.

If a personal data breach occurs, we notify the Centre without undue delay and, where feasible, within 72 hours of becoming aware of it, under art. 33(1). Where the breach is likely to result in a high risk, we inform the affected people directly, under art. 34.