Privacy Policy

Preamble

Proactive Creator works with a small number of specialists at a time. The personal data we hold is, by design, narrow: enough to assess fit, deliver the engagement, and support the working relationship - and no more.

This policy describes that practice plainly. It is written to inform, not to insulate.

1. Introduction

This Privacy Policy explains how Proactive Creator collects, uses, stores, shares, and protects personal data when you interact with the service.

Proactive Creator is a strategic and implementation service operated by Proactive Health & Retreat ApS.

This Privacy Policy applies when you:

• visit proactivecreator.com
• submit an inquiry or qualification form
• book a strategy call
• enter into a project or commercial dialogue with us
• otherwise interact with Proactive Creator

2. Data Controller

The data controller for personal data processed through Proactive Creator is:

Proactive Health & Retreat ApS
CVR: 41372192
Vornæs Skovvej 14
5700 Svendborg
Denmark

Contact: hello@proactivecreator.com

3. What Data We Collect

We may collect and process:

• name
• email address
• company details
• contact information
• qualification form submissions
• project and inquiry information
• strategy call notes and meeting metadata
• support and commercial communications
• information voluntarily shared with us in relation to a possible or active engagement
• technical data such as IP address, browser type, device type, referrer, and pages visited

4. How We Use Personal Data

We use personal data to:

• respond to inquiries
• assess fit for Proactive Creator engagements
• prepare proposals and agreements
• deliver strategic and implementation services
• communicate with prospective and active clients
• support ongoing client relationships
• improve the website and service through aggregated analytics
• comply with legal, accounting, and contractual obligations
• establish, exercise, or defend legal claims where necessary

5. Legal Basis for Processing

Where GDPR applies, we rely on one or more of the following legal bases:

• steps requested by you prior to entering into a contract
• performance of a contract
• our legitimate interests in operating, securing, and developing the service
• compliance with a legal obligation
• your consent, where required by law (for example, non-essential cookies)

6. Cookies, Analytics, and Tracking

This website does not currently set non-essential analytics, advertising, or marketing cookies. No Google Analytics, Meta Pixel, or LinkedIn Insight Tag is loaded on this site.

Only technically necessary functionality is used, for example remembering your language selection and keeping a form or booking session working.

If measurement or advertising tools are introduced later, they will be listed here and, where required by law, will only load after you give consent - which you can withdraw at any time. Browser settings can also be used to block or delete cookies; doing so may affect site functionality.

7. Sub-Processors

We use a small set of trusted sub-processors to operate the service. The current list is:

• Lovable Cloud (Supabase) - application hosting, database, authentication, edge functions
• Cal.com - strategy call scheduling
• Resend - transactional email delivery
• Google Workspace - business email, document collaboration, calendar
• Google Analytics 4 - website analytics
• Meta Pixel - campaign measurement on Meta platforms
• LinkedIn Insight Tag - campaign measurement on LinkedIn
• ElevenLabs - voice generation for selected AI deliverables

Each sub-processor is bound by its own terms and, where applicable, a data processing agreement. We review this list periodically and update it when sub-processors are added or removed.

8. Data Processing Agreement

Where Proactive Creator acts as a data processor on behalf of a client - for example, while building or operating an AI client-access layer that handles end-user data - a separate Data Processing Agreement (DPA) governs that processing.

Clients can request the standard DPA at hello@proactivecreator.com.

9. International Transfers

Some of our sub-processors are based outside the EU/EEA, including in the United States. Where personal data is transferred outside the EU/EEA, we rely on lawful transfer mechanisms such as the European Commission's Standard Contractual Clauses, adequacy decisions where they apply, and supplementary measures where appropriate.

You can request more detail on these transfer mechanisms by contacting us.

10. Data Minimization

We process only the information reasonably necessary to assess, structure, deliver, and support Proactive Creator engagements. We do not collect data speculatively.

11. Data Retention

We retain personal data for as long as necessary to:

• manage inquiries and prospective engagements
• deliver and support active engagements
• support legal, accounting, and contractual obligations (including statutory bookkeeping retention under Danish law, currently five years)
• maintain legitimate business continuity and reference history

Where retention depends partly on third-party infrastructure used in a specific implementation, that retention also depends on the relevant processor-side handling and the client's chosen operating model.

When personal data is no longer needed, it is deleted or anonymized.

12. Data Sharing

We may share personal data with the trusted sub-processors listed in section 7, and with professional advisors (such as accountants and lawyers) where strictly necessary.

We may also share personal data where required by law, court order, or to protect our legitimate interests in establishing, exercising, or defending legal claims.

We do not sell personal data.

13. Data Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include access controls, encrypted transport, vendor selection criteria, and regular review of our processing.

No system is perfectly secure. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with GDPR.

14. Your Rights

If GDPR applies to you, you may have the right to:

• access your personal data
• request correction of inaccurate or incomplete data
• request deletion
• object to certain processing, including processing based on legitimate interests
• request restriction of processing
• request data portability
• withdraw consent where processing is based on consent
• lodge a complaint with a supervisory authority - in Denmark, Datatilsynet (datatilsynet.dk)

To exercise your rights, contact hello@proactivecreator.com. We respond within one month of a verified request, in line with GDPR.

15. Children

Proactive Creator is a B2B service intended for professional use. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact hello@proactivecreator.com and we will delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version is always available on this page with the updated date. Material changes will be highlighted where reasonably possible.

17. Source Material, Rights Clearance, and Personal Data You Provide

Client source material - such as recordings, transcripts, notes, documents, and course material - often contains personal data about the client's own participants or clients. The client determines what is provided and for what purpose, and is responsible for having a lawful basis and the permissions required for that material to be provided and processed.

Permission must expressly cover digitisation, adaptation, AI processing, and delivery to the client's own clients. Attendance on a programme, purchase of a work, or possession of a copy is not permission in itself, and material owned by a third party requires that third party's documented permission.

No source material is ingested or processed before rights clearance for that material. Material whose provenance or permission cannot be established is excluded. Each engagement maintains a source provenance and rights register recording, per source, its origin, rights holder, the permission relied upon, and the permitted use.

Special categories of personal data and highly confidential material are processed only within a scope expressly approved in writing, with an identified lawful basis, defined purpose limitation, named providers, and agreed safeguards. Absent such an approved scope, that data must not be provided to us or entered into any tool used in the engagement.

18. AI Processing, Transparency, and Human Responsibility

Systems we build use AI models supplied by third-party providers. Input sent to such a model is processed by that provider under its own terms, and the providers used in a specific engagement are named in the written agreement. We do not permit client source material to be used for training third-party models where the provider offers a setting or agreement to prevent it, and we confirm that position per engagement.

AI output is probabilistic and can be incomplete, outdated, or wrong. It is not regulated professional advice and does not replace assessment by a qualified human professional. Delivered systems include disclosure wording and defined handover points to a human.

Human responsibility remains with identified people: the client remains responsible for their own professional advice and for how the system is presented to their clients, and we remain responsible for the architecture, boundaries, and documentation we deliver.

19. Retention and Deletion of Source Material

Source material is retained at category level for as long as needed for the purposes it was provided for:

• material under assessment: retained while the assessment is active
• material in an active build: retained for the duration of the engagement
• material needed to operate or support a live system: retained while that system is in service
• records evidencing rights clearance and contractual obligations: retained while a legal or accounting obligation requires it

On written request, or when material is no longer needed for the purposes above, it is deleted or anonymised in the systems under our control. We cannot guarantee deletion from third-party provider logs or backups beyond what that provider's own terms and retention cycles allow, and we do not state fixed deletion timeframes we cannot verify.

20. Third-Party Dependencies and Deployment

Delivered systems run on third-party providers such as model providers, cloud hosting, and email or scheduling services. Those providers process data under their own terms, and the providers relied upon for a specific engagement are named in the written agreement. Their availability, features, and terms may change, and we do not guarantee uninterrupted availability of any provider.

Where and how a system runs is decided case by case as a security and architecture question. For non-sensitive, appropriately authorised use cases, systems run on approved cloud providers. For regulated or security-sensitive requirements, the engagement begins with an architecture discovery and assessment; private, sovereign, isolated, or air-gapped deployment is not currently offered as a standing capability.

Separately, the parties agree who operates the delivered system day to day. Where a system is handed over, the client becomes responsible for its provider accounts, configuration, and the personal data processed within it. Where it is operated together with Proactive Creator, responsibilities are set out in the engagement agreement and, where applicable, a data processing agreement.

21. Contact

For privacy questions, requests, or commercial inquiries, contact hello@proactivecreator.com.