No Sale
We do not sell personal information
Protected
Transport protection and encryption for designated sensitive fields
UK GDPR & CCPA
Designed to support privacy rights
Right to Delete
Request erasure, subject to verification and applicable exceptions
1. Introduction
ETHICSNET ("we", "us", "our") operates Creed Space and is the data controller for the personal data described in this Privacy Policy. This policy explains how we collect, use, disclose, retain, and protect information when you use Creed Space. It forms part of our Terms of Service.
The corporate name, number, status, company type, and registered office below were verified
against Companies House on 28 July 2026:
ETHICSNET (Company No. 11412076, registered in England and Wales)
Private limited company by guarantee without share capital, using the “Limited” exemption
11 Kingfisher Business Park, Arthur Street, Lakeside
Redditch, B98 8LG, United Kingdom
We design our privacy controls to support applicable privacy obligations, including the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and, where it applies, the California Consumer Privacy Act (CCPA/CPRA). References to "GDPR" identify the UK GDPR, the EU GDPR, or both as the context requires. For details on cookies and browser storage, see below.
2. Information We Collect
Information You Provide
- Account Information: Email address, username or display name, age information, password hash, sessions, passkeys, MFA records, and external sign-in identifiers where used
- Preferences: Selected Creeds, Persona configurations, UI preferences
- Content: Messages and interactions with the AI
- Feedback: Any feedback or communications you send us
- Account Records: We store account status and usage records for service operation and compliance purposes.
- VCP Personal State Signals: If you opt in, you may declare cognitive state, emotional tone, energy level, perceived urgency, and body signals for protective response modulation. Some signals may reveal health or emotional information. In the Creed Space web interface, every dimension is off by default, and each requires your separate, explicit opt-in consent. An API, SDK, or gateway client that sends these signals provides them by its own choice.
- Competence Claims: If you opt in, self-declared competence domains and criteria used to calibrate AI interaction depth.
- Bilateral Trust Metrics: Relationship-health and optional VCP interaction history are recorded only while your authenticated server setting is Partner mode. Advisor, Collaborator, and Compliant modes do not create this history. Changing out of Partner stops new writes immediately; it does not by itself erase earlier records. You can request erasure separately through your privacy controls.
Information Collected Automatically
- Usage Data: Features used, interaction patterns, session duration
- Technical Data: Browser type, device type, operating system
- Consent-managed analytics: Only if you allow optional analytics, page and feature events may be sent through our consent gate
- Cookies: Essential cookies for session management (see Cookie Policy below)
- Reliability diagnostics: Error reports may include stack traces, browser or device metadata, and request context. Filters reduce sensitive fields, but diagnostics can still contain personal information unexpectedly.
Information Standard Signup Does Not Require
Information you enter in prompts, feedback, or support requests may include additional personal information. An identity provider you sign in with (Google or GitHub) processes information under its own notice. A device biometric used to unlock a passkey remains with the device or authenticator and is not sent to Creed Space as a biometric template.
3. How We Use Your Information
Process your requests and deliver AI responses
Enhance constitutional alignment and reduce harmful outputs
Remember your preferences and settings
Understand usage patterns and improve the Service
Lawful Basis for Each Purpose
Under the UK GDPR and the EU GDPR, we rely on the following lawful bases. Where a purpose lists more than one basis, the basis depends on the activity described.
| Purpose | Lawful basis |
|---|---|
| Creating and securing your account, signing you in, and age assurance | Contract (Article 6(1)(b)): we need this to provide the account you ask for. Where the law requires us to assure age or obtain a parent's consent for a child, legal obligation (Article 6(1)(c)). |
| Conversations and aligned responses, including applying the Creeds and safety controls you select and sending your request to the model provider you configure | Contract (Article 6(1)(b)) |
| Keeping your Creeds, Personas, preferences, and collaboration settings | Contract (Article 6(1)(b)) |
| The API gateway, your provider keys, and the integrations and webhooks you authorise | Contract (Article 6(1)(b)) |
| Account email: verification, recovery, security, and service notices | Contract (Article 6(1)(b)). Parental-consent requests and replies about your privacy rights: legal obligation (Article 6(1)(c)). |
| Recording consent and handling privacy-rights requests | Legal obligation (Article 6(1)(c)) |
| Security, audit records, and error monitoring | Legitimate interests (Article 6(1)(f)): securing the Service, preventing abuse, and establishing or defending legal claims |
| Enforcing safety controls, handling appeals, and governance review | Legitimate interests (Article 6(1)(f)): preventing abuse and harm, securing the Service, and establishing or defending legal claims |
| Ratings, comments, and other feedback you choose to submit | Legitimate interests (Article 6(1)(f)): improving the Service and the safety of its responses |
| Optional analytics through Plausible | Consent (Article 6(1)(a)), given in the cookie and analytics controls |
| Bilateral and relational features, including Partner-mode relationship history and competence claims | Consent (Article 6(1)(a)), given when you turn the feature on |
| VCP personal-state signals | Consent (Article 6(1)(a)) and explicit consent (Article 9(2)(a)), given separately for each signal dimension |
Where we rely on consent, you can withdraw it at any time; withdrawal stops future processing and does not affect processing carried out before it. Where we rely on legitimate interests, you can object as described in .
Our code also contains two research capabilities that we do not currently operate: sampling conversations for safety-research evaluation, and recording whether grounding prompts helped. We will update this policy before operating either of them.
AI Processing
When you use an AI feature, the Service sends your prompt, relevant conversation context,
selected Creed or Persona settings, and safety instructions needed for that request to the
model provider you configure with your own API key, or processes them with a local model.
That provider processes the request under its own terms and privacy notice, and its account
settings, regions, transfers, and retention are those of your account with it. We do not pay
for or resell model calls. The authenticated gateway removes its internal Creed context and
direct account user field from the OpenAI-compatible provider payload. Text and context
can still contain personal information that you enter. We do not use your content to train models.
4. Data Sharing and Disclosure
We do not sell, rent, or trade personal information, including for third-party marketing.
Limited Sharing Scenarios
- Service Providers: Providers that help operate hosting, database, cache, email, security, monitoring, analytics, or identity features, and the model provider you choose
- Legal Requirements: When required by law, court order, or government request
- Safety: To prevent harm, illegal activities, or protect rights and safety
- Business Transfers: In case of merger, acquisition, or asset sale (with notice)
- Consent: With your explicit permission
Service Provider Categories
The categories below describe providers supported by our deployment configuration. A provider processes data only when the feature it supports is in use. Each provider's region and retention are provider-specific.
- Payments: We take no charges for the Service, so no payment data is collected.
- Edge and bot protection: Cloudflare may process network, device, and browser challenge data when its proxy or Turnstile features are enabled. Cloudflare Privacy Policy
- Hosting, PostgreSQL, and Redis: Our deployment configuration uses Render for application hosting and managed PostgreSQL and Redis resources. Render Privacy Policy
- Transactional email: MailerSend may process an email address, display name, message content, and delivery metadata when we send you email. Its retention is provider-specific. MailerSend Privacy Policy
- Reliability monitoring: Sentry may receive diagnostic events when configured. Source filters and disabled default PII collection reduce exposure, but an event can still contain unexpected personal information. Its retention and region are provider-specific. Sentry Privacy Policy
- AI model providers: The model provider you configure with your own API key processes the request data described in Section 3 under your agreement with that provider. A local model processes it on the machine where it runs.
- Analytics and identity: Plausible may receive analytics events only if you allow optional analytics. Google or GitHub receive sign-in data when you choose to sign in with them.
5. Data Security
We use encrypted transport and protected storage, with encryption for designated sensitive fields. Storage controls at each provider are provider-specific.
Application roles, permission checks, account MFA, and passkeys are used where the relevant feature is enabled.
We use security logging and monitoring controls. Their retention is described in section 8 and is otherwise provider-specific.
We review source controls and track operational evidence and unresolved risks.
Some Creed Space features require an account. You can sign in with an email address and password, a passkey, Google, or GitHub, and accounts can add multi-factor authentication where your account settings offer it. New password hashes use Argon2. Legacy bcrypt hashes may be accepted for password verification.
No security measure eliminates every risk. Please contact the Privacy Contact if you believe your account or personal data may have been affected by a security issue.
6. Automated Safety Processing
Creed Space uses automated safety and policy checks that evaluate proposed model output against selected Creeds, constitutions, and other configured protections. Depending on the configured feature and result, a check may allow, block, modify, or route an output for review.
The controls and explanations available to you depend on the feature you use. Where applicable law gives you a right concerning a decision based solely on automated processing that produces legal or similarly significant effects, contact the Privacy Contact. We will assess the request against the processing that actually occurred.
7. VCP Personal-State Signal Processing
Creed Space offers an optional Value Context Protocol (VCP) feature. It can accept user-declared signals across five dimensions: cognitive state, emotional tone, energy level, perceived urgency, and body signals. Its purpose is to calculate a bounded protection state that can adapt presentation or safety behavior to the context you declare.
Some personal-state signals may reveal health or emotional information. In the Creed Space web interface, each dimension is off by default and is sent only after you give explicit opt-in consent for it; you can withdraw that consent at any time by switching the dimension off. An API, SDK, or gateway client that sends personal-state signals chooses to provide them, and stops by not sending them.
Design Boundaries
- Granular choice: All five dimensions are off by default, and the browser-side consent choice is stored in bounded session storage.
- Data path: Raw and derived state can pass through browser, API, VCP, and policy services. The design aims to limit what reaches a model provider, but the model provider you use may receive raw signals, derived protection state, or related metadata.
- Protective direction: The design uses declared vulnerability to increase protection.
- Purpose boundary: We do not use these signals for advertising, engagement optimization, unrelated profiling, or model training.
VCP Retention and Control
Unpinned signal values use configured exponential half-lives ranging from 12 minutes to 4 hours depending on the signal. One half-life is not an expiry or deletion time, and pinned values do not decay. Browser-side consent is session-scoped. These boundaries do not mean that every VCP-related record, audit entry, cache, backup, or provider copy is session-scoped. Creed Space does not currently describe a general 30-day persistence mode.
Where an account or privacy control is available, you may use it to manage future signal processing. For access, correction, restriction, export, or erasure across all relevant stores, contact the Privacy Contact so the actual scope and any applicable exceptions can be assessed.
8. Data Retention
Retention depends on the data, purpose, configuration, provider, and any legal or security requirement. The following positions apply:
| Data Type | Current Boundary |
|---|---|
| Account and registered conversation data | Associated with the account unless a narrower approved schedule applies. Erasure is subject to verification, applicable exceptions, holds, recipients, and backup behavior. |
| Erasure record | After an account erasure completes, a one-way keyed hash of the account email address is kept so the address can't be used to create a new account. It is not the address itself and no expiry is currently set. |
| Under-13 age answer without parental consent | Where automatic deletion is in operation (always, while we accept parental consent for child accounts): account deletion scheduled no sooner than 30 days after the answer (or after this policy takes effect or automatic deletion began, if later) and at least 15 days after any consent link expires, carried out after a 48-hour window. Otherwise the answer and the account, which has no access, are kept and no expiry is currently set; deletion can be requested (section 12). Parent contact details from an unconfirmed consent request are deleted one day after its last link expires. |
| Parental consent after the child is 13 or older | The consent record (the parent's contact details given with the consent, when consent was given and confirmed, and the related audit entries) and the account with the information collected while its holder was under 13 are kept after the account leaves the children's programme, and no expiry is currently set. A parent can ask for deletion of that information (section 12). |
| Anonymous browser conversation state | Held in browser session state. Any server cache, log, or provider copy follows the retention of the store or provider that holds it. |
| VCP personal-state signals | Browser consent is session-scoped and unpinned signal values use bounded decay. Other records follow the retention of the store that holds them. |
| GDPR export artifact | The generated artifact expires 24 hours after it becomes ready. An authenticated status
request can issue one five-minute download token, sent only in the X-GDPR-Download-Token request header. The download flow claims the token before
file access and consumes it after validation. |
| GDPR request-administration records | The 24-hour artifact period does not set a general retention period for the underlying request-administration record. No general period is approved for that record. |
| Application audit records and bilateral trust records | Identified stores use a 90-day default retention period. Provider logs and restored backup copies follow provider-specific retention. |
| Competence claims | Associated with the account unless a narrower approved schedule applies or an authorized request changes the applicable scope. |
| Providers, telemetry, email records, and backups | Retention is provider-specific, and no single period applies. |
You may request erasure where applicable. We verify the data scope, identity, exceptions, recipient actions, and deletion behavior before confirming completion. After deletion completes, a one-way keyed hash of your email address is kept so the address can't be used to create a new account.
9. Feedback Data
If you voluntarily submit feedback on a model response, we process your rating, selected categories, written comment, message and model references, account or session reference, timestamps, and technical request context. We convert your IP address into a purpose-specific keyed HMAC pseudonym rather than store the raw address in the feedback record. That pseudonym remains personal data while it can be linked within its declared feedback purpose.
Feedback records may remain linkable to an account, session, or message reference. No expiry is currently set for feedback records; you can ask us to delete your feedback as described in section 10. Do not include sensitive information in an optional feedback comment.
10. Your Privacy Rights
Depending on your location, the processing involved, and applicable exceptions, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and rights concerning certain automated decisions.
UK and European Rights
- Access: Request information and a copy of relevant personal data.
- Rectification: Ask us to correct inaccurate or incomplete data.
- Erasure: Ask us to erase data where the right applies.
- Restriction: Ask us to limit qualifying processing.
- Portability: Receive qualifying data in a structured, commonly used, machine-readable format.
- Object: Object to qualifying processing.
- Withdraw consent: Where consent is the basis, withdraw it for future processing without affecting processing lawfully carried out before withdrawal.
- Automated decisions: Exercise applicable rights concerning solely automated decisions with legal or similarly significant effects.
California Rights
- Know and access: Request qualifying collection and disclosure details.
- Delete: Request deletion, subject to applicable exceptions.
- Correct: Request correction of inaccurate information.
- Opt out or limit: Exercise rights that apply to sale, sharing, sensitive personal information, or qualifying automated decision-making technology.
- Non-retaliation: Exercise applicable rights without unlawful discrimination.
How to Exercise Your Rights
Where the Service presents a relevant account or privacy control, you may use it. For other requests, or if a control does not cover the data involved, contact [email protected]. We may need to verify your identity and clarify scope.
For an applicable UK access request, the ordinary response period is one calendar month. Where permitted for a complex request or multiple requests, it may be extended by up to two further months, with notice and reasons provided within the first month.
For an applicable California request to delete, correct, or know, we will confirm receipt within 10 business days and respond within 45 calendar days. Where permitted, we may take another 45 calendar days and will give notice during the initial period. For an applicable request to opt out of sale or sharing, or to limit use of sensitive personal information, we will comply as soon as feasible and no later than 15 business days after receipt.
12. Children's Privacy and Age Assurance
Creed Space is offered only to adults aged 18 or older. Child accounts are not offered, and we do not currently accept parental consent for new child accounts. The paragraphs below describe how we handle information when an age screen indicates that a user is under 13, and information about accounts that were in our children's programme.
If an age screen indicates a user is under 13 and verifiable parental consent is not obtained, we keep the recorded age answer and the account, which has no access to the service. Where automatic deletion of that data is in operation, we schedule deletion of that account and its data no sooner than 30 days after the age answer (counted from the date this policy takes effect, or the date automatic deletion began, if either is later) and no sooner than 15 days after the last consent link for that account expires. Deletion runs through our standard erasure process after a further 48-hour window. As with any completed erasure, we keep a one-way keyed hash of the account email address, which prevents that address from creating a new account. Automatic deletion is always in operation while we accept parental consent for child accounts. While it is not in operation, no expiry is currently set for that account and its data, and the account holder or a parent can ask us to delete them by emailing [email protected] with the subject "Under-13 data deletion".
When a parental consent request expires without being confirmed, we delete the parent's email address, name, linked account reference, and browser and network details recorded for that request one day after its last link expires.
When our records show that an account holder in our children's programme is 13 or older, the parent dashboard and parental consent end and the account leaves the programme, and we try once to email the parent to say so; if that email cannot be sent, we do not send it again. We keep the consent record (the parent's contact details given with the consent, when consent was given and confirmed, and the related audit entries) as evidence of consent, and the account keeps the information collected while its holder was under 13; no expiry is currently set for either. Creed Space accounts are currently available only to adults, so that account has no access until its holder verifies that they are 18 or older. The parent, or the account holder, can still ask us to delete the information collected while the account holder was under 13 by emailing [email protected] with the subject "Under-13 data deletion".
If you believe a child provided personal information without any authorization required by applicable law, contact the Privacy Contact. We will assess the account, jurisdiction, data, verification evidence, applicable exceptions, and appropriate action.
13. International Data Transfers
A service provider, or the model provider you choose, may process information outside your country. Recipients, account settings, regions, subprocessors, retention terms, and transfer routes are provider-specific.
Where an applicable restricted transfer occurs, Creed Space will identify and use a transfer mechanism approved for that actual transfer.
VCP design aims to limit raw-signal disclosure across the model-provider boundary, but section 7 describes what a model provider may still receive.
14. Third-Party Links
Our Service may contain links to third-party sites. Their services and privacy practices are governed by their own terms. Please review those terms before providing information.
15. Changes to This Policy
We may update this Privacy Policy as the service, providers, or applicable requirements change. For a material change, we will use a notice method appropriate to the change, which may include an in-service notice, email where available, or a prominent website notice. The effective date and version at the top of this policy identify the version presented here.
16. Privacy Contact
For privacy questions or to exercise a privacy right, contact:
Privacy Contact
Email: [email protected]
Subject: "Privacy Request: [Your Request Type]"
This mailbox identifies a privacy contact. It does not by itself establish that a Data Protection Officer has been appointed.
17. Supervisory Authorities
If UK data-protection law applies, you may have the right to complain to the Information Commissioner's Office at ico.org.uk.
If European data-protection law applies, you may have the right to complain to the competent supervisory authority. Contacting us first may help us address the concern, but it is not a requirement for exercising any applicable complaint right.
18. California Privacy Rights
If California consumer privacy law applies to Creed Space and to your information, you may have rights to know, access, delete, correct, opt out of qualifying sale or sharing, limit qualifying use and disclosure of sensitive personal information, receive information about qualifying automated decision-making technology, and exercise those rights without unlawful retaliation. Exceptions and verification requirements may apply.
The categories involved depend on the features you use. They may include identifiers, account and authentication information, internet or network activity, approximate location derived from technical context, user-provided content, sensitive context, and inferences or safety evaluations.
Creed Space does not sell personal information, and does not intend to share it for cross-context behavioral advertising. Whether a statutory opt-out or limitation right applies depends on the actual processing and applicable law.
Submitting a Request
Email [email protected] with the subject "California Privacy Request." We may verify your identity and authority. For an applicable request to delete, correct, or know, we will confirm receipt within 10 business days and provide a substantive response within 45 calendar days. Where permitted, we may take another 45 calendar days and will notify you during the initial response period. For an applicable request to opt out of sale or sharing, or to limit use of sensitive personal information, we will comply as soon as feasible and no later than 15 business days after receipt.
19. Browser Privacy Signals
Creed Space does not currently claim that a Do Not Track browser setting changes service behavior. You can use available consent controls to manage optional analytics.
Creed Space does not currently claim to detect an opt-out preference signal such as Global Privacy Control. Because we do not sell personal information, there is no sale for such a signal to opt you out of.
20. Contact Us
ETHICSNET is the data controller. Its corporate details below were verified against Companies House on 28 July 2026.
ETHICSNET (Company No. 11412076; private limited company by guarantee without share capital, using the “Limited” exemption)11 Kingfisher Business Park, Arthur Street, Lakeside
Redditch, B98 8LG, United Kingdom
Response periods depend on the applicable law and request. The UK and California timing boundaries are described in Your Privacy Rights.