How Kreel handles your data
Kreel reads your store and ad accounts and never writes to them. Your AI gets only what you allow, which never includes customer personal data, and every call it makes is logged.
14 days free. A card is needed to start, and nothing is charged until the trial ends.
Read-only at the source
Kreel connects to Shopify, Meta, Google Ads, TikTok, Klaviyo and GA4 through each platform’s own sign-in. It only reads from them and never writes to them: it doesn’t create, edit, pause or send anything there. Your passwords never reach Kreel.
| Platform | What Kreel reads and reports on | Permission requested |
|---|---|---|
| Shopify | orders · customers · products · inventory levels | read_orders, read_all_orders, read_customers, read_products, read_inventory |
| Meta Ads | campaigns · adsets · ads · creatives · account-level performance · campaign-level daily performance · creative intelligence · creative lifecycle stage | ads_read, pages_show_list, pages_read_engagement |
| Google Ads | campaigns · ad-groups · keywords · ads · search-terms · shopping products · pmax asset-groups · account-level performance · campaign-level daily performance · campaign impression share · keyword quality score · ad strength · creative asset performance | adwords, userinfo.email, userinfo.profile, openid |
| TikTok Ads | campaigns · ad groups · ads · account-level performance · campaign-level daily performance · ad-group and ad daily performance · per-ad-group attribution windows · creatives · creative intelligence | Reporting, Get Creative Report, Read Campaigns, Read Ad Groups, Read Ads, Read Image Library, Read Video Library, Read Playable Ads, Read identity (Spark Ad posts) |
| Klaviyo | campaigns · flows · lists · segments · templates | accounts:read, campaigns:read, flows:read, lists:read, segments:read, metrics:read, templates:read, tags:read, events:read |
| Google Analytics 4 | website summary for the one selected property + web stream · session-scoped traffic acquisition by source / medium, default channel group and GA4 campaign, paid and unpaid · landing pages by device and session source · device comparison · shopping activity · coverage, time zone, currency and GA4 quality metadata on every result | analytics.readonly |
Google Ads has one API permission, adwords, and it also allows changes; Kreel only reads. On that row, userinfo.email, userinfo.profile and openid identify the Google account you sign in with.
Your AI asks before it connects
When someone adds Kreel to Claude or ChatGPT, a Kreel consent screen asks what that AI may do. Read is required. Write is a box they can untick. Even with write, the AI can only change things inside Kreel (Brand Knowledge, plans, costs, reports); it can’t touch the platforms. Kreel re-checks the person’s role and the workspace’s subscription on every call, so someone who loses access loses it at once.
Customer data stays out of your AI
Your AI never receives customer names, emails, phone numbers or addresses. It works with counts, totals and segment sizes, and the Ask button never hands over a customer row. Inside Kreel, viewers see customer lists with names and emails hidden. Exporting a customer segment is limited to owners and admins, asks them to confirm a lawful basis, and is recorded in the audit log.
Who can see which brand
Roles are owner, admin, member and viewer. Owners and admins see every brand; members and viewers see only the brands they’re given. Viewers are read-only: they can look at their brands in the dashboard, and any AI connection or API key a viewer creates can only read those brands. Viewers don’t get the Ask button. The audit log records who changed access, connections, API keys and billing, and when.
How data is stored
Platform credentials are encrypted at rest, with keys kept outside the codebase; production won’t start without them. API keys are stored hashed and shown once. Client reports sit on their own subdomain per brand, behind a password, with repeated wrong guesses blocked. Kreel is hosted in the EU.
When you disconnect a source or delete a brand
Disconnect a source and Kreel deletes its credentials at once and stops syncing. Its data is kept for 90 days so reconnecting keeps your history, then it’s purged. Shopify and Klaviyo access is also revoked on their side. Kreel doesn’t revoke Google, Meta or TikTok access for you, so remove it in each platform’s own settings as well. Deleting a brand purges its data and stored files. Shopify’s customer-data privacy requests are handled automatically.
How fresh each source is
A status light in the top bar shows each brand’s sources as fresh, still loading history, stale, failed or needing re-authorisation, with the reason and the fix in words. New brands open once their recent data has arrived, so a half-finished import never looks like a real zero. Every page says which comparisons its history can’t cover instead of showing a number.
The one place Kreel sends data to an AI model
Kreel doesn’t run an AI for your questions; that’s your own Claude or ChatGPT. Kreel does call one third-party model, to tag ad creative: it sends ad creative media (images and video) and the associated ad copy to a third-party AI model provider, on its free tier, to generate descriptive tags. Under the free-tier terms, the provider may use submitted content to improve its products. The provider is listed with the other sub-processors in our privacy policy.
What Kreel doesn’t claim
- Kreel isn’t SOC 2 or ISO 27001 certified.
- No single sign-on with SAML.
- No warehouse sync, and the dashboard’s tables and charts can’t be exported. Owners and admins can export a customer segment as a CSV.
Questions about Kreel, answered plainly
Does Kreel change anything in my ad accounts or store?
No. Kreel only reads from Shopify, Meta, Google, TikTok, Klaviyo and GA4 and never writes to them. It doesn’t create, edit, pause or send anything there.
Does customer data reach my AI?
No. Your AI gets counts, totals and segment sizes. Customer names, emails, phone numbers and addresses stay in Kreel.
Where is the data hosted?
Kreel is hosted in the EU. Its sub-processors, including the AI model provider that tags ad creative, are listed in the privacy policy.
Are you SOC 2 or ISO 27001 certified?
No. Kreel isn’t SOC 2 or ISO 27001 certified. The security page lists the controls it has: read-only at the source, consent before an AI connects, encrypted credentials, roles and brand-scoped access, an audit log and an agent activity log.
Grow your ecommerce brand from one place.
14 days free. A card is needed to start, and nothing is charged until the trial ends.