Privacy policy

Creasana supports the creation of creative yoga sequences and learning key concepts relating to yoga and its practice. It is presented at creasana.com and available as a web application at app.creasana.com and, subject to availability, as Android applications on Google Play and iOS applications on the App Store. These are collectively referred to as the “Service”.

As part of this Service, we process certain personal data that you entrust to us.

This Privacy Policy informs users of the Service (“Users”) about how personal data is collected, used, stored and protected in accordance with the General Data Protection Regulation (GDPR). It is publicly available and updated regularly to reflect changes in processing activities.

Our Service is not directed to children under 15, and we do not knowingly collect their personal data.

• “User / You / Your”: any natural or legal person using the Service, whether as a visitor or an account holder.
• “The Company / the Controller / We / Our”: the publisher of the Service identified below. Its details also appear in our Legal Notice. The Company is responsible for the processing described in this Privacy Policy.
• “Service”: all features provided to Users by the Company through creasana.com, its subdomains and the Creasana applications.
• “User Account”: the personal space created by the User to access Service features.
• “Personal data”: any information allowing a natural person to be identified directly or indirectly.

Operator: Laure Mathieu, a sole proprietor (entrepreneur individuel, EI), trading as Creasana.

Contact: contact@creasana.com

Business address: 40 boulevard du Midi Louise Moreau, 06150 Cannes, France

Telephone: +33 6 87 88 84 52

SIRET: 948 972 559 000 33

By creating an account, you agree to our Terms of Use and acknowledge that you have read this Privacy Policy. Registration includes a terms-of-use checkbox and a link to this policy. The relevant versions and date are recorded in the account information.

This notice does not constitute blanket consent to all processing: each activity relies on the legal basis described below. Processing requiring consent, including marketing communications, is subject to a separate, optional choice.

• Account: email address, identifier, verification status and, when you sign in with Google, profile information supplied by that service. Authentication is managed by Firebase Authentication; Creasana does not access your password in plain text.
• Optional yoga profile: yoga styles practised, experience (beginner, intermediate, guru), main activity (practitioner, independent teacher, studio, teacher training school or other), school or studio name where applicable, practice or teaching languages and a personal introduction. You provide these details only if you wish to, to complete your profile, and can edit or clear them there. They are not public and are not used for advertising targeting. We also retain your choice about marketing communications, its date and the version of the notice shown.
• Creations and preferences: sequences, personal templates, favourites, settings and learning progress depending on the features used. Local-only content remains on your device; synchronised data is sent to the cloud. Avoid entering health information or identifying information about students in notes or shared content.
• Subscription: transaction identifiers, billing country where supplied by the payment provider, plan, access status, evidence of acceptance of the Terms of Sale and withdrawal requests. Full card details are handled by the payment provider and are not stored in Creasana’s application database.
• Support and security: messages you send us, technical request information (including IP address, browser, date and errors depending on provider logs), counters and consulted references necessary for access limits. We do not build an exhaustive browsing history for advertising purposes.
• Local storage: the Service stores data needed for sign-in, preferences and local creations on your device.

• Contractual necessity: creating the account, authenticating users and managing accounts, providing selected features, synchronising data, managing subscriptions and providing support. Without essential information, the relevant feature cannot be provided.
• Legal obligations: invoicing, retaining required records, handling consumer rights and personal data requests.
• Legitimate interests: preventing fraud and bulk extraction, limiting excessive requests, diagnosing incidents, improving the Service’s technical reliability and defending our rights, while considering your rights and freedoms. A counter may automatically limit a request; a block may be challenged by contacting support at contact@creasana.com.
• Consent: an optional checkbox, unchecked by default, lets you receive news and promotional emails from Creasana, including partner offers sent by Creasana. This choice does not authorise sharing your address with partners for their own marketing. You can withdraw consent at any time in your profile, using the unsubscribe link in emails or by writing to contact@creasana.com.

We never sell your personal data to third parties. We may share certain personal data in the following circumstances:

• Where you have given prior consent;
• Where necessary to establish, exercise or defend our rights, with authorised professionals and on an appropriate legal basis;
• In response to a legal obligation (legal proceedings, an injunction, etc.) or to defend our rights;
• In a restructuring, merger, sale or transfer of the business, limited to necessary data, with confidentiality safeguards, an appropriate legal basis and information about any change of controller;
• With technical providers, partners, subprocessors or suppliers acting strictly to provide our Service (details below);
• With competent authorities where required by law.

For operation of the Service, access is limited to authorised persons within the Company and the following providers, according to their duties:

• Firebase / Google Cloud for hosting, authentication and cloud data;
• Stripe for web purchases;
• Apple or Google for purchases in their stores;
• Resend for transactional confirmations when enabled.

Payment providers and stores may also process data for their own obligations under their policies.

Creations do not become public merely through synchronisation. If you share content, people with access who meet the access conditions can view it. Links can be forwarded: Users must therefore avoid sharing confidential data in their creations (notes, descriptions, etc.). Revoking a link does not erase copies already retained by a recipient.

Some providers may process your data outside the European Economic Area. Transfers must be covered by an applicable adequacy decision or appropriate safeguards, including standard contractual clauses. You may request information and a copy of the applicable safeguards by writing to contact@creasana.com.

We attach great importance to the security and confidentiality of our Users’ data and take our responsibility to protect it seriously. We undertake to implement technical and organisational measures proportionate to the risks to protect the confidentiality, integrity and availability of our services and your data.

When an account is deleted, we erase the associated data, except what must be retained to meet legal obligations or establish, exercise or defend legal claims, for the applicable period. Invoices and accounting records are kept for ten years from the end of the relevant financial year. Account deletion does not erase copies on your devices or held by recipients of your shares.

Contract and consent evidence is retained for the applicable legal periods. Support data is kept while a request is handled, then only as necessary for follow-up or a dispute.

Security counters use limited time windows; logs are retained according to their diagnostic, prevention or incident-evidence purpose and the relevant service’s settings. They must not be kept indefinitely. Residual backups follow their replacement cycle, subject to legally necessary retention.

We apply technical and organisational measures appropriate to the risks, including authentication, access controls and request limits. No system is risk-free. Incidents are handled and, where required by law, notified to the authority and affected people.

You may exercise your rights of access, rectification, erasure, portability, restriction and objection under the conditions of the GDPR, and withdraw consent for processing based on it. You may also exercise specific rights provided by applicable local data protection laws, such as defining instructions for your data after death under French law. To exercise these rights, contact the Controller at contact@creasana.com.

We respond without undue delay and, in principle, within one month of receipt. This period may be extended by two months due to the complexity or number of requests; we inform you of the extension and its reasons within the first month. We act on requests as required by law and explain any refusal. Proportionate additional information, such as an identification document, may be requested where there are reasonable doubts about your identity.

You may lodge a complaint with the French data protection authority (CNIL). You may also contact the competent supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. Contacting us may help resolve the issue without restricting your right to complain.

This Privacy Policy may be updated at any time to reflect changes in our services, technology or legal requirements. Changes take effect on publication on the website. For significant changes, we will inform you by email or through our website.

The version and last updated date appear on this page. We recommend checking this page regularly to stay informed of updates.

A change does not allow consent to new processing to be inferred. Where consent is required, it is obtained separately before the processing concerned.

When enabled on the landing website, Google Analytics 4 audience measurement requires your prior consent. It counts visits, identifies pages viewed and shows which website buttons lead to the Creasana application, to help improve the website. Declining does not prevent access. No Google Analytics script or analytics cookie is loaded before you agree; this integration does not enable advertising tracking.

Your acceptance or refusal is stored for 180 days in this browser’s local storage, with the date and notice version, under creasana.landing.analytics-consent. This storage only remembers your choice. You can change or withdraw it using “Cookie settings” at the bottom of the page. Withdrawal stops future measurement and deletes analytics cookies accessible to the website; it does not automatically erase data already sent.

If you accept, Google receives page addresses without query parameters or fragments, page titles, clicks on links to the Creasana application (button location and, where applicable, the plan chosen), browser and device information, and cookie identifiers. An IP address is needed to communicate with Google. This integration’s analytics cookies use the creasana_landing prefix and have a configured maximum lifetime of 180 days. This integration sends no account identifier or email address. Statistics cover consented visits only and may be limited by tracking blockers.

Google provides the audience measurement service. Processing may involve transfers outside the European Economic Area, covered by the provider’s applicable contractual mechanisms and safeguards. User and event data retention must be configured to two months when activating the service; aggregated reports may remain longer. This measurement concerns the landing website and does not constitute consent for Creasana applications.