Privacy Policy

Effective date: 16 May 2025  ·  Kreo Technologies Private Limited

1. Who We Are

Kreo is a creator commerce platform operated by Kreo Technologies Private Limited, incorporated in India. We help content creators track affiliate links, automate Instagram DMs, and publish personalised storefronts. Our registered contact for privacy matters is privacy@kreo.in.

2. Data We Collect

2a. From Instagram (via Meta Graph API)

• Public profile: username, display name, profile picture, bio, follower count, account category
• Media metadata: post captions, media URLs, publish timestamps (public content only)
• Messaging: ability to send DMs to users who trigger a keyword on your post (instagram_manage_messages permission — only after Meta approval)

2b. From YouTube (via Google APIs)

• Channel public data: channel ID, display name, subscriber count, video list, video titles and descriptions (read-only)
• We use the YouTube Data API v3 in read-only mode. We do not access private playlists, watch history, or financial data.

2c. Directly from you

• Email address (if you use email login)
• Payout details: UPI ID or bank account number + IFSC (encrypted at rest; used only for payouts)
• Affiliate link URLs you add to the platform
• Video clips you upload to AI Video Studio

2d. Automatically collected

• Click events on your affiliate links (anonymous: IP anonymised, no cross-site tracking)
• Browser type, device type, and general location (country/state level) for analytics
• Session tokens (stored in httpOnly cookies)

3. How We Use Your Data

• Creator account creation — Your Instagram/YouTube profile data is used to create and populate your Kreo creator profile
• Affiliate link tracking — We track clicks on your Kreo-managed links to calculate your earnings
• DM automation — With your explicit configuration, we send automated DMs to your Instagram followers who comment a keyword on your post
• Payout processing — Your bank/UPI details are passed to our payout processor (Razorpay) to transfer your earnings
• Product improvement — Aggregated, anonymised analytics help us improve Kreo
• Communication — We email you payout confirmations, important product updates, and (with your opt-in) promotional content

We do not sell your data. We do not use your data to train AI models without your explicit consent.

4. Data Sharing

• Affiliate networks (Amazon Associates, Flipkart Affiliate, Myntra/vCommission/Admitad) — we share tracked link click data as required to attribute commissions to you
• Razorpay — payout processor; receives your bank/UPI details under their own privacy policy
• Cloud infrastructure — your data is stored on AWS and/or Google Cloud servers located in India (ap-south-1 / asia-south1)
• AI services (Phase 2 — AI Video Studio) — video clips may be processed by a third-party AI provider for editing; clips are deleted after processing
• Legal requirements — we may disclose data if required by Indian law or a valid court order

We do not share your Instagram or YouTube data with any third party except as described above.

5. Meta Platform Data Policy

Our use of Instagram data via the Meta Graph API complies with the Meta Platform Policy. Specifically:

• We only request permissions that are necessary for the features you use
• We do not store Instagram user data beyond what is needed to operate the service
• We do not use Instagram data to target advertising
• We provide a data deletion mechanism (see Section 8)

6. Google API Services User Data Policy

Kreo's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access YouTube data only to display your channel information within your Kreo dashboard and to link products to your specific videos.

7. Data Retention

• Active account data: retained while your account is active + 90 days after deletion request
• Click / earnings records: 3 years (required for financial record-keeping under Indian law)
• Uploaded video clips (AI Studio): deleted within 24 hours of processing
• Payout records: 7 years (Income Tax compliance)

8. Your Rights & Data Deletion

You can request deletion of your Kreo account and all associated data at any time:

• In-app: Settings → Account → Delete my account
• By email: privacy@kreo.in with subject "Data Deletion Request"
• Via our dedicated page: kreo.in/data-deletion

We will confirm deletion within 30 days. Financial records legally required to be retained will be anonymised rather than deleted.

You also have the right to access, correct, and export your data. Contact privacy@kreo.in for any of these requests.

9. Cookies & Tracking

We use strictly necessary cookies for session management (httpOnly, Secure) and optional analytics cookies. No third-party advertising cookies are used. You can opt out of analytics cookies in Settings → Privacy.

10. Children

Kreo is intended for users 18 years of age or older. We do not knowingly collect data from anyone under 18. If we discover a minor has created an account, we will delete it promptly.

11. Changes to This Policy

We will notify you by email and in-app notification at least 14 days before any material changes to this policy. Continued use after that date constitutes acceptance of the new policy.

12. Contact

Privacy-related questions or complaints: privacy@kreo.in
Registered address: Kreo Technologies Private Limited, India
Grievance Officer (as required under Indian IT Rules 2021): reachable at the email above.