Privacy Policy

KREO AI, Inc. ("Kreo," "we," "us," or "our") provides a platform that brands use to send products to people and to manage what happens afterwards. This Privacy Policy explains what information we collect, why, who receives it, and the choices you have. It applies to visitors of this website, to brands and other people who hold a Kreo account, and to anyone who fills out a gifting form that a brand runs through Kreo.

1. If you receive a gifting form from a brand

When you fill out a form on a Kreo-hosted page, the form belongs to the brand named on it. That brand decides what to ask you and what to send you. Kreo hosts the form, stores your answers, and helps the brand ship and track the gift. Two organizations therefore receive what you submit: the brand, and Kreo, acting as the brand's service provider. This policy explains Kreo's part. The brand may have its own privacy notice for theirs.

You do not need a Kreo account to fill out a form. You must be 18 or older. We collect:

• What you enter on the form: name, shipping address, email, phone number, sizes, product choices, and any other question the brand asks
• Public information about a social media account you provide, or that the brand shared with us, such as username, display name, bio, follower count, and public posts
• Address verification results, and tracking and delivery status once a gift ships
• Messages between you and the brand, if the brand contacts you through Kreo and you reply

Some brands add a checkbox to their form about using content you post. That checkbox is the brand's agreement with you, not ours. We keep form information while the brand's Kreo account is active and for up to 90 days after it closes. You can ask us to delete it sooner (see section 9).

2. If you hold a Kreo account

2.1 Account information

• Email address and password (stored hashed, never in plain text)
• Account type and name or brand name
• For brand accounts: organization name, team members' names, emails and roles, the services you choose to connect, and, for team members who share creator profiles with the brand by Instagram direct message, their Instagram username and account ID. We do not sign in to or access a team member's Instagram account and collect nothing else from it; the messages themselves are the direct messages to the brand's connected account described in section 2.2.

2.2 Instagram and TikTok data

If you connect an Instagram or TikTok account, we access it through the platform's official developer program and follow its rules. Depending on the permissions you grant, this can include:

• Profile information (username, name, bio, profile picture)
• Follower, following and media counts
• Public posts, captions and engagement metrics
• For brand accounts, direct messages sent to the connected account, so that profiles shared with the brand by its team can be added to its Kreo workspace

We also collect public profile information about accounts that brands add to their workspace, whether or not those accounts have connected to Kreo. This comes from the platforms' official tools and from public pages such as bios, link-in-bio pages and public archives. We keep one record for each creator, which is shared across the brands that add them and which we also use for our own features, and Kreo is responsible for that record. Information you give a particular brand, such as your shipping details and form answers, is kept separately and handled for that brand. We do not use what one brand does with a creator to build features or reports for other brands. We do not access private accounts or private messages other than those sent to a brand's or creator's own connected account.

2.3 Email accounts

If you connect an email account (for example Gmail or Outlook) so that Kreo can send and receive campaign email on your behalf, we access only the mailbox data needed to send those messages and to show you the replies. Kreo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.4 Gifting preferences

Account holders who receive gifts may save delivery addresses, a phone number, sizes, product preferences and response templates so they do not have to re-enter them.

2.5 Campaign data

For brand accounts we store campaign configurations, form questions and branding, form responses, the profiles added to the workspace and their status, and shipment tracking. Where a brand connects its online store, we create the gift orders for approved creators and store order-level information that does not include customer fields, such as order numbers, dates, totals, line items, product and inventory information, and the tracking number, carrier and shipment status for those orders. We do not access the brand's customer records. Customer matching is off unless a brand turns it on. If a brand turns it on, we compare the email addresses on the brand's marketing list against the public creator emails we already hold, keep only the matches in that brand's workspace, and do not store the others.

3. How we use information

• To provide the platform: run campaigns, host forms, ship and track gifts
• To let brands contact the people they send products to, and to show them the replies
• To help brands understand the results of their campaigns, including public posts about the brand
• To draft messages and organize information, with the help of AI services (see section 4)
• To enable collaboration within a brand's team
• To keep the platform secure, prevent abuse, and fix problems
• To send service notifications

We do not sell personal information. We do not use it to advertise to you.

4. AI processing

We use third-party AI services for an assistant that helps brand users run their own workspace, to read and organize public posts and messages received by a connected account, to suggest how an imported spreadsheet maps to fields, and to help draft messages. Those services receive only the text needed for the task. Under our agreements with them, your information is not used to train their models, and we do not train models ourselves. Brand workspace admins can turn AI-assisted features off for their workspace in Settings, after which none of the workspace's information is sent to an AI service. The assistant tells users that it is an AI assistant at the start of every session.

5. Who receives information

We share information only as needed for the purposes above, with:

• Brands running a campaign, and the people the brand authorizes in its account. When you respond to a brand's form, your answers and delivery details go to that brand.
• Managers, if you are an account holder who has connected a manager. You control that relationship in the platform.
• Shipping and carrier services a brand uses to send gifts
• A brand's own store and email tools that it has connected to Kreo
• Social platforms (Meta and TikTok) for account connections and public profile lookups
• An address verification service
• AI services as described in section 4
• Service providers that help us operate the platform, including cloud hosting and email delivery in the United States

We may also disclose information if the law requires it, to enforce our terms, or to protect someone's safety. A list of the specific providers we use is available to brand customers on request as part of our data processing terms.

6. Where information is processed

Kreo operates from the United States and stores information there. If you are in the United Kingdom, the European Economic Area, or another region with data transfer rules, your information is transferred to the United States, using the European Commission's Standard Contractual Clauses where required. Our legal basis for processing form submissions is that it is needed to provide what you ask for; for account holders it is the performance of our contract with you; and for campaign results and public profile information it is our and the brand's legitimate interest. You can object to this at any time (see section 9).

7. Security

Information is encrypted in transit and at rest, access is limited to people who need it, and connections to third-party services use industry-standard authorization. No system is perfectly secure, and we will notify the brand and, where we are responsible for doing so, you and any relevant authority as the law requires if a breach affects your information.

8. Retention

We keep account information while your account is active and for a short period afterwards to handle deletion, disputes and legal obligations. Form submissions are kept while the brand's account is active and for up to 90 days after it closes. Public profile information is refreshed periodically and kept on the same schedule. You can ask us to delete your information sooner at any time.

9. Your rights and choices

You can ask us to:

• See the information we hold about you
• Correct it
• Delete it
• Object to, restrict or stop a particular use, such as campaign results or AI-assisted features
• Export your data (account holders)
• Disconnect any connected service at any time from your Kreo settings

Email charlie@kreo-inc.com with the email address or social handle you used. We will confirm your identity and respond within 30 days. Where the information belongs to a brand, we will pass your request to that brand. If you are in the EU or UK you also have the right to complain to your data protection authority. Our website does not respond to browser "Do Not Track" signals.

10. How to delete your data

Email charlie@kreo-inc.com with the subject line "Data Deletion Request" and the email address or social handle you used. We will process the request within 30 days and confirm when it is done. If you connected an Instagram or TikTok account, you can also remove Kreo's access from that platform's own settings (for Instagram: Settings > Apps and Websites > Remove Kreo), which stops any further access.

Deletion removes your account (if any), gifting preferences and addresses, form responses, campaign data for brand accounts, and any social platform data we hold. Information already passed to a brand or its shipping provider is under their control, and we will tell you who to contact.

11. Children's privacy

Kreo is not intended for people under the age of 18. We do not knowingly collect information from anyone under 18, and we will delete it promptly if we learn we have.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the date above, and where we have your email address we will let you know about material changes.

13. Contact

KREO AI, Inc.
Email: charlie@kreo-inc.com
Website: https://www.kreo-inc.com