Last updated: 2026 — 2026-09-20
Creavela (operated by NexAxis) collects only the data needed to build and run your store.
Account data (name, email, preferred language, country), your onboarding answers (brand, niches, socials, logo), and order data for purchases made in your store.
To create your store, process payments, fulfil orders and keep you informed. We do not sell your personal data.
Payments are handled by Stripe; hosting by Cloudflare; transactional email by our email provider; product fulfilment by our sourcing partners. Each receives only what its task requires.
You can request access, correction or deletion of your data. Contact: privacy@creavela.com.
Account and order data: necessary to perform our contract with you. Security and fraud logs: our legitimate interest in operating a safe service. Marketing email, if we ever send it: your consent, withdrawable at any time.
Account data for as long as your account exists, then when an account is closed, the account and profile data are erased within 30 days. Order, invoice and payment records are kept for as long as the applicable accounting and tax law requires us to keep them, and erased once that obligation ends — we cannot delete them sooner, and we do not keep them longer. Payout details are erased with the account; only the proof that a transfer was made remains, inside those accounting records. Contact-form messages are kept 24 months, the anti-spam fingerprints 12 months, and backups are overwritten within 90 days after closure. Order and payment records are kept for the period accounting law requires in our jurisdiction, which is longer and which we cannot shorten on request.
The platform runs on Cloudflare's global network, which means data may be processed in the country nearest the visitor. Payments are processed by Stripe, and fulfilment data — name, address, and where a country requires it a tax identifier — is transmitted to the supplier who ships the order.
When someone buys from a creator's store, we process their order data in order to fulfil it. We do not profile them, do not sell their data, and do not place advertising or analytics cookies on storefronts.
You can ask for access, correction, deletion, a copy of your data, or restriction of processing. Write from the contact page; we answer every request. Data contact: write to privacy@creavela.com, or use the contact page — both reach the same person. We answer within 30 days, which is the deadline the GDPR sets, and usually much sooner. If you are not satisfied with our answer, you may complain to the data protection authority of the country where you live. You may also complain to the supervisory authority of your country.
The service is not intended for people under 18. We do not knowingly create accounts for minors, and we delete such an account if we learn of one.
If you ask to be paid, we store what is needed to send the transfer: the account holder's name, the country, and the account identifiers themselves — IBAN, SWIFT, PayPal or Wise address. The identifiers are encrypted at rest with a key held outside the database, and only a masked preview is shown on screen. Our finance team sees the full details only at the moment of making a transfer, and every such access is logged. We never send them by email, and we never write them to an application log.
When you write to us through the contact form, we keep your name, your address, your message, and a salted fingerprint of your IP address. The fingerprint is not the address and cannot be turned back into one: it lets us count how many messages come from the same visitor in order to stop automated spam, and nothing else.
Stripe receives the payment data needed to take and refund a payment. CJ Dropshipping, in China, receives the recipient's name, address, phone number and, where customs require it, a tax identifier — it cannot ship a parcel without them. Printify receives the same shipping data for printed items. Cloudflare hosts the platform and its database. Our email provider, Resend, sends transactional messages and therefore sees your address and the content of those messages. None of them receives your payout identifiers, and none is allowed to use your data for its own purposes.
← Back to home