Privacy policy
And You Create builds Standards, a platform for business data and AI agents. This page explains which data we process, why, and how you stay in control of it.
The data we process
On this site: the information you send us when joining the waitlist or booking a call, namely your first name, last name, work email address and company.
With a contact request, we also record the page you first arrived on, the website you came from (its address only), the time of your first visit and, if you answer it, how you heard about us.
In the platform: the business data you put in it. You remain its owner and controller; we act as a processor under the GDPR.
Signing in to your account
You can sign in with your Google account. Google then acts as an identity provider: it confirms your name, email address and profile picture to us, and nothing else. We do not read your Google mail, files or contacts, and Google receives no data from your workspace.
You can also sign in with a passkey. We then keep its public key, its credential id, the name you give it and the date it was last used. The private key stays on your device or in your password manager, and no biometric data reaches us: the fingerprint or face that unlocks it never leaves your device.
You can remove a passkey at any time from your account settings. All of them are deleted with your account.
Connected AI assistants (MCP)
You can connect an external AI assistant — Claude, ChatGPT, Codex, Cursor or any MCP client — to your workspace through the Standards MCP server. The connection goes through a Standards consent page: it is bound to a single workspace and acts with the rights of your role, no more and no less. An API key can stand in for it; it then carries the rights of whoever created it.
The server receives only the tool calls the assistant sends, with their arguments: a search, the record to read, the fields to write. It never receives your conversation with the assistant, its memory, or your other files. What a call writes is kept in your workspace like any other change, attributed and audited.
The data the server returns to the assistant is then processed by that assistant's provider, under its own privacy policy. Choose the assistant, and the rights you open to it, accordingly.
You can revoke a connection at any time from your workspace, or delete the API key it uses: the assistant loses access immediately.
Why we process it
To get back to you about your access request, arrange a call, and keep you posted on product changes.
We do not sell any data and never pass it to advertising brokers.
Where it is hosted
Platform data is hosted in the European Union, or directly on your own infrastructure when you pick that option at deployment.
The AI models we call on your behalf do not use your data for training.
How long we keep it
Access requests are kept for three years from the last contact.
Platform data is kept for the duration of the contract, then returned or deleted, as you choose.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your personal data.
To exercise them, write to privacy@andyoucreate.com. You may also lodge a complaint with your national data protection authority.
Cookies
This site sets no advertising cookies and no third-party profiling trackers. Only the analytics strictly necessary to run the site are used.
These first-visit details are kept in your browser for as long as the tab is open, without a cookie, and are only sent with a form you submit.