Start free trial

Kreel legal

Privacy Policy

Last updated: 2026-11-02

This Privacy Policy describes how Kreel ("we", "us", "Kreel") handles personal information when you use our Service (the Kreel application, dashboards, Brand Knowledge Base, hosted reports, API, CLI, MCP server, and related offerings available at kreel.ai and app.kreel.ai).

1. Who we are

Kreel is operated by Beyond Peaks Ltd, a company incorporated in Malta. Contact: privacy@kreel.ai.

2. Data we process

Account data

  • Email, name, and authentication identifiers when you sign up.
  • Billing information (handled by Paddle, our reseller and merchant of record; we do not store card numbers).
  • Workspace and team membership records.

Connected-platform data (on your behalf)

When you connect Shopify, Klaviyo, Meta Ads, Google Ads, TikTok Ads, or Google Analytics 4 accounts, Kreel accesses data from those platforms to provide the Service. This may include:

  • Store products, orders, customers, and order fulfilment status (Shopify).
  • Email campaigns, flows, segments, and performance metrics (Klaviyo).
  • Ad accounts, campaigns, ads, ad creative, and performance metrics (Meta, Google, TikTok).
  • Aggregated website traffic, landing page, device, and ecommerce event metrics for the property you select (Google Analytics 4).

We access this data via OAuth tokens that you authorise. You can revoke access at any time from your connected platform or from your Kreel workspace.

Google user data

When you connect Google Ads, Kreel requests the adwords scope and uses it read-only: it reads the accounts you can access and, for the Google Ads accounts you select, their campaigns, ad groups, ads and assets, keywords, search terms, products and performance metrics. It also reads your Google account email and name to show which account is connected. When you connect Google Analytics 4, Kreel requests the analytics.readonly scope to list your properties and web streams and to read aggregated reports (sessions, purchases, revenue, key events, traffic sources, campaigns, landing pages and devices) for the property you select. Kreel never creates, changes or deletes anything in your Google accounts.

We use this data only to provide the features you use: your dashboards and reports in Kreel, the alerts, briefs and reports you choose to send or publish, and the answers returned to the API, CLI and MCP clients that you or your team connect with your own Kreel credentials, including AI assistants you choose to connect. We do not use Google user data for advertising and do not sell it. We do not use it, or allow any provider we work with to use it, to develop, train or improve AI or machine-learning models. Our staff do not read it, except with your permission, for security purposes, or to comply with the law.

Kreel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Kreel's access at any time from your Google Account permissions page, or with Revoke on the source in Kreel, which deletes Kreel's stored token. See Data deletion for how the data is then removed.

Usage data

  • Request logs, API call counts, and error logs used to operate and improve the Service.
  • Product usage analytics collected via PostHog to operate and improve the Service, keyed only by your internal Kreel user id, never by your email or name. In the product these are cookieless (PostHog keeps its state in memory only), unless you accepted analytics cookies on kreel.ai: then the product uses the same PostHog cookie as the marketing site, so your visits to kreel.ai before you signed up are linked to your account.
  • Marketing-site analytics collected via PostHog and Google Analytics 4, only if you accept analytics cookies in the banner on kreel.ai. With that consent, Google Analytics also measures which of our Google ads lead to trial and demo requests; it is not used to personalize ads or retarget you. One choice covers kreel.ai and app.kreel.ai. See our Cookie Policy.
  • Sign-up source. If you accepted analytics cookies on kreel.ai before signing up, we store where your sign-up came from with your account: the campaign tags (UTM parameters) and ad click ids of your first and latest tagged visit, the page you landed on, the referring site's address (scheme and domain only) and your browser's Google Analytics ids. Tags that look like an email address are never kept.
  • Conversion measurement. For those accounts, our servers send sign-up, trial-start and first-payment events to Google Analytics, with your browser's Google Analytics id, your internal Kreel user id and the payment amount, never your email or name, to measure which of our ads lead to trials and customers. Ad personalization is off for these events.
  • Demo bookings. If you accepted analytics cookies and book a demo from kreel.ai, kreel.ai passes your browser's Google Analytics ids and PostHog id to Cal.com with the booking. Cal.com returns them to our servers, which report the booking to Google Analytics and PostHog with those ids only, never your name, email or booking answers.
  • Waitlist. If you joined the waitlist on kreel.ai while it was open, we keep your email and whatever else you chose to enter (name, website, what you want from Kreel), to email you when access opens. We don't add you to a newsletter. Ask privacy@kreel.ai and we delete it.
  • Support conversations. When you open support chat in the product, your account email, name and workspace/brand context are attached to your support session. Nothing is sent to our chat provider until you open chat.

3. How we use data

  • To provide the Service and respond to your API requests.
  • To prevent abuse, monitor uptime, and enforce usage limits per your pricing tier.
  • To communicate about your account, billing, and material changes to the Service.
  • To improve the Service using aggregated and de-identified signals.
  • With your consent, to measure which of our ads and campaigns lead to sign-ups, trials and paying customers.

Legal basis

  • Providing the Service (account data, connected-platform data, request logs): performance of our contract with you.
  • Marketing-site analytics and ad measurement: your consent, given in the cookie banner on kreel.ai. You can withdraw it at any time with "Cookie settings" in the site footer or in the product.
  • Sign-up source and conversion measurement (the sign-up source stored with your account, the sign-up, trial-start and first-payment events sent to Google Analytics, and demo bookings reported with your analytics ids): your consent, the same choice. Withdrawing it stops the events and deletes the attribution cookie from your browser; ids already passed to Cal.com with a booking stay with that booking.
  • Product analytics (cookieless, keyed by user id only): our legitimate interest in understanding and improving how the product is used. If you accepted analytics cookies on kreel.ai, the shared PostHog cookie in the product relies on that consent.
  • Waitlist: your consent, given when you submitted the form. You can withdraw it at any time by emailing privacy@kreel.ai.
  • Support chat: performance of our contract with you, at your own request when you open chat.

We do not sell personal data. Except as described for Google Gemini in section 4, we do not provide connected-platform data to third parties for training AI models.

4. Sharing

We share personal data only with sub-processors who help us run the Service, under each provider's standard terms. Where a provider publishes a data-processing agreement (DPA) or data-use terms, it is linked below. Current sub-processors:

  • Supabase (authentication and database hosting; EU region). Supabase DPA.
  • Hetzner (application hosting; EU region). Provider's standard terms.
  • Google (Gemini API, free tier, via Google AI Studio). We send Meta and TikTok ad creative media (images and video) and the associated ad copy to generate descriptive tags that power the creative analysis feature. Data from Google Ads and Google Analytics is never sent. Under the free-tier terms, Google may use submitted content to improve its products. Gemini API terms.
  • Google (Google Analytics 4: analytics on the marketing site, and server-side conversion events for sign-ups and demo bookings that followed your consent; Google LLC, which may process data in the United States). Only after you consent to analytics cookies on kreel.ai, it receives from kreel.ai page views and interactions with a random browser id, device and browser details and approximate location, and, when you arrive from one of our Google ads, the ad click, plus clicks on our "Start free trial" and "Book a demo" buttons and, while the waitlist was open, joining it. If you then sign up, our servers send it your sign-up, trial start and first payment with that browser id, your internal Kreel user id and the payment amount, never your email or name. If you book a demo, our servers send it the booking with that browser id and session id only. We use it to count visits and to measure which of our Google ads lead to demos, trials and customers; ad personalization and Google signals are switched off. Nothing from your connected accounts is sent. Google Ads Data Processing Terms.
  • Sentry (backend error monitoring; EU ingest). Receives stack traces and request metadata when an error occurs; default personal-data collection is switched off and credentials, request bodies and query strings are removed before sending. Sentry DPA.
  • Crisp (in-app support chat; EU region). Loaded only when you open support chat; it then receives your email, name, workspace and brand context and the conversation. Provider's standard terms.
  • PostHog (product usage analytics, marketing-site analytics and backend error events; EU cloud). From the product it receives usage events keyed by your user id, with no email or name; from the marketing site, only after you consent to analytics cookies, page views, clicks (the trial, demo, sign-in and contact-sales buttons, the sample report link, FAQ answers opened and pricing plans chosen) and, from our servers, completed demo bookings. If you consented, the product uses the same PostHog cookie, so those visits are linked to your account when you sign up. From our backend it receives exception details and workspace and brand metadata such as brand name, industry, workspace ids and API-key labels. PostHog DPA.
  • Cal.com (demo booking; Cal.com, Inc., which may process data in the United States). When you book a demo from kreel.ai, it receives what you enter in its booking form, such as your name and email address, and, only if you accepted analytics cookies, your browser's Google Analytics and PostHog ids, which it returns to our servers with the booking. Provider's standard terms.
  • Resend (transactional email, and the waitlist: it stores the details you entered if you joined). Resend DPA.
  • Paddle (checkout, billing and payments). Paddle resells Kreel subscriptions as merchant of record and processes payment data under its own privacy policy. We send it your workspace id and plan, and your email to fill in checkout.
  • Vercel (marketing and documentation site hosting; static content, and, while the waitlist was open, its form, whose entries it passed to Resend without storing them). Vercel DPA.

Integrations you configure. If you set up Slack alerts, alert content (brand name, campaign and ad names, metrics, dates and a dashboard link) is sent to the Slack workspace you choose, through the incoming webhook you provide. Slack processes it under your own agreement with Slack; it is a destination you direct, not a Kreel sub-processor.

For questions about our sub-processors, contact privacy@kreel.ai. Kreel's own data-processing terms for customers are in our Data Processing Agreement.

5. Data location and transfers

Primary data is stored in the European Union. Where transfers outside the EU occur (for example to a US-based sub-processor), they are made under appropriate safeguards including Standard Contractual Clauses.

6. Retention

  • Account data is retained while your account is active and for up to 12 months after closure for legal and accounting reasons.
  • Connected-platform data is deleted immediately when you explicitly delete a workspace. Disconnected workspace data is purged by the retention process according to the configured schedule.
  • Logs older than 90 days are aggregated or deleted.

7. Your rights

Subject to applicable law (including the GDPR for EU residents), you have the right to access, correct, delete, restrict, or export your personal data, and to object to processing. Submit requests to privacy@kreel.ai. We will respond within 30 days.

8. Security

We encrypt data in transit (TLS 1.2+) and at rest. OAuth tokens are stored encrypted. Access to production systems is limited to a small number of personnel, logged, and reviewed quarterly. For more, see our Security page.

9. Children

Kreel is not intended for individuals under the age of 16 and we do not knowingly collect their data.

10. Changes

We may update this policy. Material changes will be notified by email or in-product at least 30 days before they take effect. The "Last updated" date reflects the most recent change.

11. Contact

For questions about this policy: privacy@kreel.ai.