Privacy Policy
Last updated: 2026
Who we are
Walnut Grovez Inc (the "Company", "we", "us") operates Create 2 Site at https://create2site.com (the "Site" and the "Service"). We are the controller of the personal information described in this policy. You can reach us at [email protected], by phone on +1 (888) 804-4372, or by post at 5307 N Eagles View Drive, Lehi, UT 84043, USA.
This policy explains what information we collect when you visit the Site or use the Service, why, who we share it with, how long we keep it, how we protect it, and the rights you have over it.
Information we collect
Account information. When you create an account we collect your name, email address, phone number and billing address, and a password that we store only as a one-way hash.
Payment information. Payments are taken by our payment processor, which collects your card number, expiry date and security code directly. We never store the full card number or the security code. We keep only a payment reference, the card brand, the last four digits and the expiry month and year, so we can show you which card is on file, send receipts and handle refunds.
Orders, subscriptions and support. We keep a record of what you bought, when, for how much, the status of each order and subscription, refunds, and the emails we have sent you. If you contact us, we keep the correspondence.
Information specific to the Service. The Service stores the content and settings you create in it. The product pages on this Site describe what that is; where the Service processes anything beyond ordinary account data, this policy says so in the section "Information specific to this Service" below.
Information collected automatically. When you use the Site we record your IP address, browser and device type, the pages you request, the time of each request and, for security, failed login attempts. This is server log data; we do not run third-party analytics or advertising trackers on the Site.
Cookies. We use a small number of cookies that are necessary for the Site to work: a session cookie that keeps you logged in, a cookie that protects forms against cross-site request forgery, and a short-lived cookie that carries a message from one page to the next. Our network provider may set a security cookie to tell real browsers from automated traffic. None of these is used for advertising or sold to anyone. You can delete or block cookies in your browser, but the Site cannot keep you logged in without them.
How we use information
We use personal information to: provide the Service and your account; take payment, send receipts, renewal notices and other billing messages; answer questions and provide support; keep the Site secure and prevent fraud and abuse; comply with legal, tax and accounting obligations; and, only if you ask for them, send product news. We do not sell personal information, rent it, trade it, or share it with anyone for their own marketing.
Where European or UK data-protection law applies, our legal bases are: performance of our contract with you (the account, the Service, billing and support); our legitimate interests in running, securing and improving the Service; compliance with legal obligations; and your consent, for any optional communication, which you can withdraw at any time.
Who we share information with
We share personal information only with the providers we need to run the Service, each bound by a contract that limits what they may do with it:
- Payment processing. Our payment processor receives the details needed to take and refund payments. Card data goes to the processor, not to us.
- Hosting and storage. The Service, its database and any files you store in it run on Amazon Web Services in the United States (US East, Northern Virginia). Database backups are stored in the same region.
- Network security and delivery. Cloudflare sits in front of the Site, providing DNS, TLS and protection against attacks, and therefore sees the traffic between your browser and the Site.
- Email delivery. The provider that delivers our transactional email (receipts, notices, alerts, password resets) processes the recipient address and the message.
We also disclose information when the law requires it, to establish or defend legal claims, to protect the rights and safety of our customers or others, and, if the business is sold or merged, to the new owner under the same commitments.
A current list of these providers is available from [email protected] on request.
Information specific to this Service
Create 2 Site hosts creator stores, so beyond account and billing data it processes what you put in your store and what your buyers give us.
Your store. Your store name and address, bio, links and socials, avatar and banner, your products (titles, descriptions, prices, cover images and the files you sell), and daily counters of views, clicks, checkouts and sales. Product files are kept in private storage and handed to buyers only through links that expire after 15 minutes; cover images, avatars and banners are public. Your Stripe key is stored encrypted and is used only to create checkout sessions and confirm payments with Stripe.
Your buyers. For a paid order we store the buyer's email address as Stripe reports it, the Stripe session reference, the amount, the time and a download count; for a free download, the email address the buyer typed. We store no buyer name, address or card details. The buyer's order link carries a long random token that is their only credential. You are the seller and the controller of your buyers' data; we process it on your behalf to take the order, deliver the file and send the delivery email, and you may use a buyer's email only to deliver the product and, where the buyer agreed, to contact them. You can see your orders and export paid buyers' emails as a CSV on the plans that include free downloads.
Who processes this content. Stripe runs the checkout under your own Stripe account and sees what a buyer enters there; we send Stripe the product name and description, the price and an order reference, never the buyer's details. The delivery email (store name, product title and the order link) goes through our email provider and a copy stays in our email log for 90 days. The buyer's browser fetches the file directly from our storage provider (Amazon Web Services), which sees their IP address. Payment for your own subscription, hosting, backups and network delivery are the providers named above. Store pages set no cookie on visitors other than a security cookie that carries no identity.
How long it is kept. Your store, products, files and orders stay until you delete them (deleting a product deletes its orders and their download links) and stay after a plan ends, because your store stays online. Buyer emails and order records are kept with the store for as long as it exists; counters are kept as totals. Closing your account or store: email [email protected] and we delete your account, store, files and order records within 30 days, keeping only the billing records the law requires us to hold. A buyer who wants their email removed can write to you or to [email protected].
How long we keep information
- Account information: for as long as your account exists, and for up to 30 days after you ask us to close it, so we can complete the closure and honour refund requests.
- Orders, payments, receipts and refunds: for as long as accounting, tax and payment-dispute rules require after the transaction.
- Support correspondence: for up to two years after the last message.
- Server logs and security records: for up to 90 days.
- Email delivery records: for 90 days.
- Backups: encrypted database backups are kept for up to 14 days and then overwritten; information deleted from the Service disappears from backups on that cycle.
When a retention period ends we delete or anonymise the information.
Security
All traffic between your browser and the Site is encrypted (TLS). Passwords are hashed with a modern algorithm and cannot be read by us. Card numbers never touch our systems. Access to production data is limited to the people who operate the Service and is logged. If we become aware of a breach of security that affects your personal information, we will notify you and, where the law requires it, the relevant supervisory authority without undue delay, and within 72 hours where that timescale applies.
International processing
The Service is hosted in the United States and may be supported from other countries. If you use it from the European Economic Area, the United Kingdom or elsewhere, your information is transferred to and processed in the United States. Where that transfer needs a legal safeguard we rely on standard contractual clauses or an equivalent mechanism with our providers.
Your rights
You can ask us to: tell you what personal information we hold about you and give you a copy; correct it; delete it; restrict or object to how we use it; and provide it in a portable format. You can withdraw consent to any optional communication at any time. If you are in the European Economic Area or the United Kingdom you also have the right to complain to your data-protection authority. If you are a California resident, you have the right to know what personal information we collect, use and disclose, to request its deletion or correction, and not to be discriminated against for exercising these rights; we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
How to make a privacy request
Email [email protected] with the subject "Privacy request", from the address on your account, saying what you would like us to do. We may ask you to confirm your identity. We answer within 30 days, free of charge, and explain our reasons if we cannot do what you ask.
Children
The Service is not directed at anyone under 18 and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy. The date at the top shows the current version. If a change is material we will email the address on your account before it takes effect.
Contact
Walnut Grovez Inc
5307 N Eagles View Drive, Lehi, UT 84043, USA
Email: [email protected]
Phone: +1 (888) 804-4372 (Mon–Fri, 9am–6pm ET)
