Privacy Policy
Last updated: May 2026
Who We Are
Creator House is an independent live-in experience for creators and founders. It is operated by Tobias Loesch as an individual.
Postal address: see the Legal Notice.
Contact for all privacy matters: tobias@creatorhouse.it.com
We are not a registered company. We do not have a data protection officer, as none is required under Art. 37 GDPR for our scale of operations.
Hosting and Server Logs
This website is hosted by Vercel Inc., 340 Pine Street, San Francisco, CA 94104, USA. When you visit any page, Vercel's servers automatically record standard access data:
- IP address of the requesting device
- Browser type and version
- Pages visited and time of access
- Referrer URL (if any)
This data is used only for technical operation and security. It is not linked to you personally and is deleted automatically within 7 days.
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in operating a functional and secure website. Transfers to the USA are covered by standard contractual clauses (SCCs) and Vercel's DPA: vercel.com/legal/dpa
Fonts
This website uses self-hosted web fonts. Font files are served directly from our own hosting infrastructure (Vercel, see above) rather than from Google or any other third-party font provider.
No request is made to Google's servers when a page loads, and no data (including your IP address) is transmitted to Google for the purpose of font loading.
Video Content
Some videos on this website are served from Vercel Blob Storage (Vercel Inc., see above) or Cloudflare R2 (Cloudflare, Inc., USA). When a page containing these videos is loaded, your browser connects to Vercel's servers and your IP address is transmitted as part of that request.
Videos hosted in /assets/ are served directly by the same
Vercel infrastructure. No third-party video embed services (e.g. YouTube,
Vimeo) are used.
Application Form
If you apply to Creator House via the website form, we collect:
- Your name
- Your email address
- Your Instagram handle
- Your answers to the application questions
This data is used solely to evaluate and respond to your application. It is not used for marketing or sold. It is processed on our behalf by the service providers listed under "Service Providers" below (Notion, Resend, Telegram, Vercel).
Legal basis: Art. 6(1)(b) GDPR - processing necessary for pre-contractual steps at your request (reviewing your application). No separate consent checkbox is required for this reason.
Retention: Application data is deleted within 6 months of a decision being made. If you are accepted, we retain basic contact details for alumni documentation for up to 3 years.
All applications are reviewed personally. No automated decision-making or profiling (Art. 22 GDPR) takes place.
You can withdraw your application at any time by emailing us. Your data will be deleted promptly upon request.
Event Bookings and Payments
If you book a place at an event or trip, we collect additional data beyond a general application: identity document details (where required for visas, insurance, or travel logistics), dietary and health information (such as allergies, only where you choose to provide it), and payment information, which is processed by a third-party payment provider (Whop, Inc., USA). We do not store full card numbers.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for health-related data, Art. 9(2)(a) GDPR (explicit consent).
Retention: up to 10 years, in line with statutory tax and accounting record-keeping requirements.
Photos and Video at Events
Photos and video of participants are taken at events and used for marketing and content purposes. By registering for an event, you agree to our Event Terms, which set out in full the rights we hold to use this material.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(a) GDPR (consent given by accepting the Event Terms).
Service Providers
We use the following providers to run this website and process applications. Each acts on our behalf under a data processing agreement or its standard terms:
- Vercel Inc. (USA): hosting, server logs, file storage (Vercel Blob).
- Notion Labs, Inc. (USA): stores the application and form entries you submit (name, email, Instagram handle, answers).
- Resend, Inc. (USA): sends confirmation and notification emails for form submissions.
- Telegram: internal notification to the team when a form is submitted (contains the entry you submitted).
- Cloudflare, Inc. (USA): bot protection on forms (Turnstile) and video delivery (R2).
- Whop, Inc. (USA): payment processing for bookings; marketing pixel only with your consent.
- Google Ireland Limited: analytics and, with your consent, advertising measurement.
Legal basis: Art. 6(1)(b) GDPR for form handling and bookings, Art. 6(1)(f) GDPR for hosting and security. Transfers to third countries (USA and others) rely on the EU-U.S. Data Privacy Framework where the provider is certified, otherwise on standard contractual clauses (Art. 46 GDPR). On request we tell you which safeguard applies to a given provider.
Bot Protection
Forms use Cloudflare Turnstile (Cloudflare, Inc.). When a form loads, your browser contacts Cloudflare, which receives your IP address and browser signals to tell humans from bots. Legal basis: Art. 6(1)(f) GDPR (protecting the forms against abuse).
Analytics and Marketing (Cookies and Local Storage)
Optional analytics and marketing tools run only after your consent. The cookie banner offers "Accept all", "Only necessary" and granular choices. Nothing optional is pre-selected.
Analytics: Google Analytics 4 (Google Ireland Limited) processes your (truncated) IP address, device and browser information, pages viewed and UTM parameters. We also log page sections you view and buttons you click in a first-party event log on our own hosting, keyed to the same anonymous analytics ID. UTM parameters are kept for the session in your browser (sessionStorage).
Marketing: with marketing consent, advertising measurement signals (Google) and the Whop pixel are enabled so we can see which ad or link brought you here. Without it they stay off.
Necessary storage: your cookie choice is stored in your browser (localStorage keys ch_consent,
ch_consent_ads, with date and version). This is required to respect your choice.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent) for analytics and marketing; Section 25(2) TDDDG for the necessary choice storage. Withdraw or change your choice at any time with "Cookie settings" in the footer; withdrawal does not affect processing done before it. Google Analytics data is kept for 14 months. More information: policies.google.com/privacy.
Your Rights
If you are located in the EU, EEA, or UK, you have the following rights regarding your personal data:
- Access - request a copy of personal data we hold about you
- Rectification - request correction of inaccurate data
- Erasure - request deletion of your data
- Restriction - request we limit how we use your data
- Portability - receive your data in a machine-readable format
- Objection - object to processing based on legitimate interests (Art. 21 GDPR)
- Withdraw consent - at any time, via "Cookie settings" in the footer or by email (Art. 7(3) GDPR)
To exercise any of these rights, email us at tobias@creatorhouse.it.com. We will respond within 30 days as required by Art. 12(3) GDPR.