How Places handles information.

Last updated 26 October 2026.

This policy explains what Creaition Places collects, why we collect it, and the choices people have. It covers the website at places.creaition.co, the venue dashboard, visitor experiences, on-site screens, and the Places Cast app. It is written for the same kind of service as other venue platforms that create a guest photo or video, show consented results on a screen, and give the venue a dashboard.

Who we are

Creaition Places is operated by Creaition, Kikar Kdumim 3, Old Jaffa, Tel Aviv, Israel. The product site is places.creaition.co. For privacy questions, email hello@creaition.co.

A museum, hotel, city, attraction, or other venue that uses Places is responsible for the experience it offers its guests. We process visitor photos and related details for that venue so the experience can run.

Who this covers

People who create or manage a Places account for a venue.
Staff the venue invites into that account.
Visitors who scan a code, open an experience, or appear in a result.
People who book a demo, join the affiliate program, or email us.

Information from accounts

When a venue signs up we collect the details needed to run the account: name, email address, organization name, and a password if they create one. Sign-in with Google gives us the name, email address, and the Google account identifier Google sends for that sign-in. We do not receive the Google password.

The dashboard can also hold venue content the team uploads: logos, reference photos, experience copy, screen layouts, commercials, and team roles. If a venue connects Google Calendar for meetings, we use that connection only to schedule and update those meetings.

Billing is handled by PayPal. PayPal processes the card or account details. We keep the plan, payment status, and the references PayPal sends us so we can apply the subscription. We do not store full card numbers.

Visitor photos and results

A visitor opens the experience in the browser. No app install and no visitor account is required. If they continue, they take or upload a photo. We use that photo, together with the venue’s scene, to generate a still or a short video. Creating that result means the photo is processed by our generation service.

Before a photo is used, the visitor sees the venue’s consent text. Processing consent is what allows us to create their result. A separate, optional consent covers use in the venue’s gallery, promotions, or on-site screen. A result without that second consent is not placed on a public screen and is not offered as a public download. Visitors can also choose to email the result to themselves. We use that address only to send the result.

The venue can see the results for its own experiences in its dashboard. Results the visitor did not approve for promotion stay out of public screens and public downloads.

Screens, channels, and commercials

Venues can run a TV or lobby screen from Places. A screen plays the venue’s commercials and, where the visitor agreed, visitor results. The Places Cast app is a way to open that same site and send a screen to a TV on the local network. Cast does not give us a new copy of the visitor’s photo. The TV loads the screen address the venue already published.

How we use information

To create and sign in to accounts, including with Google.
To run experiences, generate results, and show them to the visitor and the venue.
To play screens and commercials the venue configured.
To send the result, account mail, and demo or product messages the person asked for.
To bill for a plan and keep usage within that plan.
To measure scans, generations, and which experiences are used, so the venue and we can see what is working.
To keep the service reliable, prevent abuse, and fix failures.

Where European data-protection law applies, we rely on the contract with the venue, the visitor’s consent for their photo and any promotional use, and our legitimate interest in securing and improving the service. A visitor can refuse promotional use and still receive their own result when the venue has set the experience up that way.

Who we share it with

We share information with service providers that perform a task for us, and only for that task:

Google, for sign-in, for optional Calendar scheduling, and for site analytics.
PayPal, for subscription payments.
The providers that generate the still, video, or spoken narration from the content sent to them.
Our email host, to deliver account mail and result mail.
OneSignal, if a person turns on push notifications for their account.
Meta, for measuring visits that come from our own ads.

The venue receives the results and usage for its own place. We do not sell personal information. We share it when the law requires it, or to protect the service, our users, or other people from harm.

Google user data we receive through Google sign-in or Google Calendar is used only to provide and secure the Places features the person asked for. We do not sell that data, and we do not use it for ads. Use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and similar tools

We use a sign-in cookie so the dashboard stays signed in. It is limited to our site. A referral cookie remembers an affiliate code for a limited time. The browser also stores a few local values, such as whether a visit came from a campaign link.

Google Analytics and the Meta pixel measure how the public site is used. They can set their own cookies. Browser settings can block cookies. Blocking the sign-in cookie means the dashboard will ask you to sign in again.

How long we keep it

Account details stay while the account is open, and for a short period afterward if we need them for billing, security, or a legal claim. A venue can set how long visitor results are kept, including a shorter time for results that were not approved for promotion. If the venue does not set a limit, results stay until the venue or the visitor asks us to delete them, or until we remove them in the ordinary running of the service.

Uploaded selfies are used to create the result. We do not put the original selfie in the venue’s public gallery. Generated results are what the gallery and screens use, and only promotional screens use results the visitor allowed.

Security

Places is served over HTTPS. Account sessions are stored in an HttpOnly cookie. Access to a venue is limited to the people on that account. No method of storage or transmission is perfectly secure. Report a vulnerability to security@creaition.co.

International transfers

Creaition is based in Israel. Venues and visitors may be elsewhere, and some providers we use process data in other countries. When we transfer personal information outside the country it came from, we use providers that offer a level of protection appropriate to the information and the transfer.

Your choices and rights

Visitors can skip an experience, refuse promotional use, and ask the venue or us to delete a result.
Account holders can update their details in the dashboard and can ask us to close the account.
You can ask what personal information we hold about you, ask for a copy, and ask us to correct it.
Where the law gives you the right, you can object to certain uses or ask us to limit them, and you can complain to a data-protection authority.

Email hello@creaition.co for these requests. We may need to confirm that the request comes from the person the information is about. If a visitor’s result is held for a venue, we may also need to coordinate the deletion with that venue.

Children

Places is a tool for venues, not a service directed at children. A venue that invites children to use an experience is responsible for obtaining any permission the law requires from a parent or guardian. If you believe a child’s photo was submitted without that permission, contact us and we will delete it.

Changes

We will update this page when the product or the law changes, and we will change the date at the top. If a change materially affects how we use account information, we will say so by email or in the dashboard.

Contact

Creaition
Kikar Kdumim 3, Old Jaffa
Tel Aviv, Israel
hello@creaition.co