Privacy Policy

Createch Evaluator Portal — Privacy Policy

Effective date: 23 August 2026

Last updated: 27 August 2026

1. Who we are and what this covers

Createch, LLC ("Createch", "we", "us") operates the Createch Evaluator Portal at sbs.createch.app (the "Portal"). Createch is a limited liability company organised in North Carolina, with offices at 4801 Glenwood Ave, Ste 200, Raleigh NC.

This Policy explains what personal information we collect from people who apply to, or work as, evaluators and project coordinators through the Portal, how we use it, who we share it with, how long we keep it, and the rights you have over it.

This Policy covers the Portal only. It does not cover:

• Gusto, the payroll platform we use to pay contractors. Gusto collects your bank details and tax information directly and is an independent controller of that information under its own privacy policy at https://gusto.com/about/privacy. Createch never receives your bank account or Social Security number.
• Any client system you may be given access to during an engagement, which is governed by that client's own terms.

A note on scope. California's privacy law applies in full to job applicants and independent contractors — the earlier exemption for employment-related data expired on 1 January 2023. If you are a California resident, the rights in Section 11 apply to you as an applicant or contractor, not only as a consumer.

2. Notice at collection

This section is the notice required at or before the point of collection.

We collect this information directly from you, except for technical data generated automatically when you use the Portal, and information generated by us during review — for example, a coordinator's decision and its reason.

3. What we never collect

We do not collect, and the Portal has no field for:

• Your Social Security number or any taxpayer identification number
• Your bank account or routing number, or any payment card details
• Your IRS Form W-9 or any tax form
• Your citizenship or immigration status — we ask only whether you are legally authorised to work in the United States, which is a different question
• Your race, ethnicity, religion, sexual orientation, gender identity, health or disability information, or political affiliation

Payment and tax information is collected by Gusto, directly from you, after your application is approved. If anyone claiming to represent Createch asks you for a Social Security number or bank details by email, text, or through this Portal, it is not us. Report it to info@createch.app.

4. How we use your information

We use your personal information only to:

1. Create, authenticate, and secure your Portal account.

2. Receive, review, and decide your application.

3. Verify your identity and confirm you are 18 or over.

4. Create and preserve a valid electronic signature record for the agreements you sign.

5. Notify you about your application status and next steps, by email and — if you have consented — text message.

6. Set up and track your onboarding through Gusto.

7. Deliver training, administer the calibration assessment, and manage work quality.

8. Detect and prevent fraud, credential sharing, and misuse of the Portal.

9. Keep records we are required to keep by law, and defend legal claims.

10. Operate, debug, and improve the Portal.

We do not use your information for any other purpose without telling you first.

5. Sensitive personal information

Your driver's license or state ID images and number, and your date of birth, are sensitive personal information under California and several other state laws.

We use them for one purpose only: verifying your identity and confirming you are 18 or over. We do not use or disclose sensitive personal information for inferring characteristics about you, for advertising, or for any purpose beyond those permitted without a right to limit under Cal. Civ. Code § 1798.121.

6. We do not sell or share your information

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use it for targeted advertising or for profiling that produces legal or similarly significant effects about you. We have not done either in the preceding twelve months.

We do not run advertising on the Portal.

7. Who we disclose information to

We disclose personal information only to service providers who process it on our behalf under contract, and only as needed:

Each is contractually restricted from using your information for its own purposes, from retaining it beyond what the service requires, and from disclosing it further.

We may also disclose personal information when required by law, valid legal process, or a government request; to establish, exercise, or defend legal claims; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different policy.

We do not disclose your identity documents to our clients. Clients receive the output of evaluation work, not your identity records.

8. How we protect your information

We maintain a written information security programme with administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• Encryption of data in transit (TLS) and at rest.
• Identity document images held in private storage with no public access, retrievable only through short-lived, access-controlled links generated for authorised reviewers.
• Every access to an identity document is logged with the identity of the person who viewed it and when.
• Role-based access control: staff can access only what their role requires. Our onboarding staff cannot view identity documents at all.
• Retention limits and automated deletion (§9).
• Regular review of access rights and security practices.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and any regulator as required by the breach-notification law of your state.

9. How long we keep your information

We delete or de-identify personal information when the applicable period ends, unless we are required to keep it longer by law or to defend a legal claim.

10. Text messages

We send text messages only about your application and onboarding. We never send marketing texts.

You will only receive texts if you separately opt in during your application. You can stop them at any time by replying STOP to any message, or by contacting us. Reply HELP for assistance. Message and data rates may apply. Withdrawing text consent does not affect your application — we will simply contact you by email instead.

11. Your privacy rights

Depending on where you live, you may have some or all of the following rights.

Rights available to residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws — the exact set varies by state:

• Know and access — what we hold about you, and a copy of it in a portable format.
• Correct — inaccurate information about you.
• Delete — your personal information, subject to exceptions where we must retain it.
• Limit the use of sensitive personal information — see §5; we already limit ours to identity verification.
• Opt out of sale, sharing, targeted advertising, and significant profiling — we do none of these.
• Non-retaliation — we will never penalise you, deny you work, or treat your application differently because you exercised a privacy right.

Appeal. If we deny your request, you may appeal by writing to info@createch.app with "Privacy Appeal" in the subject line. We will respond within 45 days with our decision and reasons. If we deny the appeal, you may contact your state Attorney General.

How to exercise your rights

Email info@createch.app or write to 4801 Glenwood Ave, Ste 200, Raleigh NC.

We will verify your identity before acting, usually by confirming you control the email address on your account. For deletion and access requests we may ask for additional confirmation, in proportion to the sensitivity of what you are asking about. We do not use verification information for any other purpose.

We respond within 45 days and may extend once by a further 45 days where the request is complex, telling you why.

Authorised agents may submit requests on your behalf with written authorisation; we may still contact you to confirm.

12. Cookies and tracking

The Portal uses only cookies strictly necessary to operate it — keeping you signed in, maintaining your session, and protecting against cross-site request forgery.

[VERIFY: If the Portal uses ANY analytics, product-analytics, session-recording, or advertising tag, this section must be rewritten and a cookie consent mechanism added. Do not publish this paragraph unless it is true.]

We do not currently respond to browser Do Not Track signals, as there is no common standard. We do honour Global Privacy Control signals as an opt-out of sale and sharing, though we do neither.

13. Children

The Portal is for adults only. You must be 18 or over to apply. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it promptly. Contact info@createch.app if you believe a minor has provided us information.

14. Where your information is processed

Your personal information is stored and processed in the United States. If you access the Portal from outside the United States, you are sending information to the United States, where privacy laws differ from those of your location.

15. Changes to this Policy

We may update this Policy. When we do, we will change the "Last updated" date above. If the change is material — for example, a new purpose or a new category of recipient — we will notify you by email or through the Portal before it takes effect, and where the law requires it, we will ask for your consent.

Previous versions are available on request.

16. Contact us