Privacy policy
Effective 7 October 2026
1. Who is responsible
CreateAgent.ai is operated by Spotlight FZE (RAKEZ, United Arab Emirates). For anything about your data, write to hello@createagent.ai.
2. What we collect
Your account details (email, name). What you build and type: agent instructions, conversations with your agents, files you upload, agent memory notes, and connector settings. Billing status from PayPal (we never see your card number). Technical records: run logs (what went in, what came out, timing and usage), request identifiers, and a one-way hashed form of IP addresses used for rate limiting and abuse prevention.
3. What we use it for
To run your agents (your instructions and messages are sent to the AI model providers that power them). To keep your agents' memory working. To enforce plan limits, rate limits, and spending ceilings. To bill paid plans through PayPal. To secure the service and investigate abuse. To email you about your account.
4. Who else sees data
AI model providers process the content of runs so your agents can answer; we send what the run needs, not your account profile. Our infrastructure providers host data (database and authentication, hosting, email delivery, billing). If you connect an external tool to an agent, that tool's provider receives what the agent sends it — connectors run only when you run your own agent, never for visitors on your share link. We do not sell personal data, and we do not use your agents' content to advertise to you.
5. Tokens and keys
Connector access tokens are stored encrypted and are never shown again after you save them. API keys are stored only as a one-way hash; the key itself is shown once, to you, at creation.
6. Public things stay public by your choice
An agent is private until you share it. A share link or embed makes that agent's chat available to anyone who has the link. Visitors' conversations with a shared agent are logged to its run history, which the agent's owner can see.
7. How long we keep things
Your content stays while your account is open. Run logs are kept to operate the service and show you your history. When you delete an agent, a file, or your account, we delete the associated content within a reasonable period, except records the law requires us to keep.
8. Your rights
Under the UAE Personal Data Protection Law and similar laws, you can ask for a copy of your data, ask us to correct or delete it, and object to certain processing. Email hello@createagent.ai and we will respond within a reasonable time. You can also delete agents, files, and keys yourself from the product.
9. Where data lives
Our infrastructure providers may process data in data centres outside the UAE. Where that happens, we rely on the safeguards those providers offer and on contractual protections.
10. Children
The service is for adults and for businesses. It is not directed at children, and you should not give a child an account.
11. Changes
If this policy changes in a way that matters, we will post the new version here with a new effective date and tell signed-in users about significant changes.
Questions? hello@createagent.ai. See also our terms of service.