Privacy policy

Who is responsible

Krealo Media is responsible for your account and billing data. For the data YOU put into your workspace — your contacts, your leads, your conversations — you are the controller: we process it on your instructions and only to provide the service.

Person in charge of data protection: joseph@krealomedia.com.

What we process

Three groups, and it matters to tell them apart:

• Account data: name, email, language, role in the workspace and how you signed in (password or Google).
• Workspace content: contacts, companies, leads, deals, tasks, notes, documents, and the communications that go through the CRM — email, SMS, WhatsApp, chat and calls — with their attachments and recordings where they exist.
• Technical data: access and error logs, IP address and browser, and usage measurements to tell whether something is slow or broken.

What for

We do not sell data. We do not hand it to anyone for their advertising. We do not use your workspace content to train models.

• Providing the service and keeping your workspace running.
• Charging the subscription and add-ons.
• Telling you what happens in your account and answering your support requests.
• Detecting failures, abuse and security problems.
• When the AI add-on is subscribed, generating drafts and summaries from the content you point it at.

Where it is stored, and a warning

The CRM database and functions run on Google Cloud, in the us-central1 region, which is in the United States. That means your data leaves Canada and becomes subject to that country's laws, including the possibility of access by its authorities.

We say it plainly because Quebec's Law 25 requires disclosing it beforehand, not afterwards.

Who it is shared with

Only with those needed for the service to work, and only what is needed. Some receive data only if you connect that integration:

• Google Cloud / Firebase — hosting, database, authentication and functions (United States, us-central1 region).
• Stripe — payments and subscriptions. It receives billing data; the CRM never stores card numbers.
• Twilio — sending and receiving SMS, when the add-on is subscribed.
• Google / Gmail — sending and receiving email, when the mailbox is connected.
• WhatsApp Business and LiveChat — customer messaging, when connected.
• Shopify and Microsoft Dynamics 365 Business Central — orders, quotes and catalogue, when the workspace connects them.
• OpenAI and Google (Gemini) — assisted drafting and summaries, when the AI add-on is subscribed.
• Google Analytics and Meta Ads — only if the workspace connects ITS own property or account.
• Krealo Publisher — publishing and catalogue, when the workspace connects it.

For how long

You can request an export of your content before closing, and we provide it in a machine-readable format.

• Workspace content, while the account is active. If you close it, we delete or anonymise it within 90 days, except what we must keep for accounting or tax obligations.
• Technical and error logs, 12 months at most.
• Invoices and their trail, for as long as the applicable law requires.

Your rights

You can ask us to access your data, correct it, delete it, take it elsewhere, withdraw a consent you gave, or stop processing it. Write to joseph@krealomedia.com and we answer within 30 days.

If you believe something was handled badly, you can complain to your data protection authority; in Quebec, the Commission d'accès à l'information.

Security, and what we do if something goes wrong

Access to each workspace's data is restricted by server-side rules: a person only reaches their own organisation, and their role decides what they can do inside it. Traffic is encrypted and integration credentials are stored encrypted.

No system is infallible. If there were a confidentiality incident with a risk of serious injury, we will notify those affected and the competent authority, as Law 25 requires.

Changes

If this policy changes materially, we will say so inside the product before it applies. The date of the current version is always at the top.