Privacy policy

Under the Nigeria Data Protection Act 2023, whoever decides why personal data is held is its controller, and whoever holds it on their instructions is a processor. KREO is one of each, depending on whose data you mean, and almost everything below follows from that split.

Your account: we are the controller

Your name, your email address, your password and the record of you signing in exist because you have a relationship with us. We decide what to do with them, so we answer for them.

Your workspace: we are only the processor

The creators, clients, deals, contracts, fees and files in your workspace were put there by your agency, for your agency’s purposes. We hold them on your instructions and do nothing else with them. Your agency is the controller, and the questions a creator would ask - why is my number in there, take it out - are your agency’s to answer. Clause 13 tells a creator what to do if they cannot get an answer.

When you create an account we hold your name, your email address and a hashed password. The hash is one-way: nobody here can read your password, which is also why nobody here can recover it for you.

You can sign in with Google instead. If you do, Google tells us your name, your email address and the identifier it uses for your account, and there is no password here to hold at all. We do not receive your Google password and we cannot read anything else in your Google account - not your contacts, not your mail, not your files. Google is not one of our suppliers in this: it runs the sign-in itself, on its own terms, and it will know that you use KREO. If you would rather it did not, use an email address and a password.

We hold the workspace you belong to and your role in it, because that is what decides what you can see. We hold the notifications addressed to you, and, in your workspace’s activity log, a record of the changes you made to commercially significant records: who did what, to which record, and when.

Serving the application produces ordinary operational logs, which include the IP address a request came from and the page it asked for. When something breaks, an error report is written with the error, the page and the identifiers of the workspace and user involved - not the contents of your records.

The two forms that can put email in a stranger’s inbox - password reset and invitations - are rate limited. Those counters store a hash of the address or IP address rather than the address itself, and are erased after a day.

These are your records, not ours. We list them so you know what is in the box you are responsible for.

• Clients and campaigns: the organisation, the brief, the budget, the dates.
• Creators: the record set out field by field in clause 4.
• Deals and deliverables: fees, payment terms, what was due and what arrived.
• Contracts: the agreement files you upload, in private storage.
• Assets: the creative your creators deliver, every version of it, and the review and approval notes on each one.
• Rights records: what was licensed, for which channels and territory, exclusive or not, and when it ends.
• Invoices and payments: amounts, dates, methods and references.
• Activity: an entry for each change to a commercially significant record, including the values before and after it.

Contracts and creative sit in private storage and are reachable only through links that expire shortly after they are made. There is no public address for a file in KREO.

KREO is built to collect only what the service needs to work. That is a claim, and a claim like it is worth nothing unless it can be defended field by field, so here is the defence. Every column of the creator record is below with the reason it exists. Only the name is required; everything else can be left empty, and a field you have no use for should be.

The two numbers, said plainly

Audience size and engagement rate are the fields that look like profiling, so they get their own paragraph. KREO does not connect to any social platform, does not read anybody’s account, and does not measure or refresh either number. They are figures your team types in, and they are as current as the day somebody typed them. Nothing in KREO scores, ranks or decides anything about a person automatically.

Shorter than the list of what it does, and easier to check. As of the date at the top of this page:

• No advertising, no ad networks, no advertising identifiers.
• No cross-site tracking and no advertising analytics. There is no Google Analytics, no product-analytics SDK, no session recorder and no advertising pixel. KREO does measure its own pages, and clause 15 says exactly what that collects.
• No selling or sharing of personal data. The only outside parties who can reach anything are the three suppliers in clause 9.
• No training of machine learning models on your records, by us or by anyone else.
• No scraping of social platforms and no reading of any creator's account.
• No automated decision-making with legal or similarly significant effect. Rights statuses are arithmetic on dates you entered, not judgements about a person.

Running a service means someone has to be able to tell whether it is working, and answer you when it is not. KREO staff have an administrative panel for that, and this clause says exactly what it shows, because the honest version is more useful to you than a reassuring one.

• Counts and dates across every workspace: how many campaigns, creators, rights records and files exist, how much storage is used, when the workspace was created and when it was last worked in.
• The name of each workspace. The name, email address and role of each of its members are visible only to the staff whose role includes answering support requests - see below.
• That a change happened, when, and to what kind of record - never what the change was.

What it does not show is the substance of your work: no campaign, deal, deliverable, asset, contract, rights record, invoice or payment can be opened from it. That is not a promise about restraint, it is the same mechanism described in clause 11 — staff are not members of any workspace, so the database policies that stop one agency reading another’s records refuse staff in exactly the same way. Files in storage are covered by the same rule.

Reaching the panel takes a place on a short list held inside the database and a second factor from an authenticator app; a password on its own is refused. Every time a member list is opened, that is recorded with the address of the staff member who opened it, and that record is kept apart from the workspace so it survives the workspace being closed.

Not everyone on that list can see the same things. Each member of staff holds a role, and the names and email addresses described above are limited to the two roles that need them — the people who answer support requests, and the people who run KREO. Staff whose work is operational, such as watching queues and re-running scheduled jobs, can see the counts and not the people. That limit is enforced by the database rather than by the screen, on the same principle as the rest of this clause: the panel asks the database for the roster and is refused, rather than being trusted not to ask.

For the account data we control, we rely on the performance of a contract: we cannot give you an account without holding an address to identify it by. Keeping the service secure and available - the rate limits, the activity log, the operational logs - rests on our legitimate interest in running a service that is not trivially abused, balanced against the fact that each of those holds as little as it can and for as short a time as it can.

For the workspace records we merely process, the lawful basis is your agency’s to establish, not ours. It will usually be legitimate interest or contract - a creator you are negotiating with reasonably expects you to hold their handle and their fee. It is your job to be able to say which, and to tell the creators concerned.

The database and the file storage are hosted in Ireland (eu-west-1). Your records do not stay in Nigeria, and under the Nigeria Data Protection Act 2023 that is a transfer of personal data out of the country, so it is named here rather than left to be assumed.

The transfer is to a jurisdiction with a comprehensive data protection regime of its own, and each supplier below is engaged under terms that bind it to process data only on instructions and to protect it to a comparable standard. If you need the transfer arranged differently for a client of yours, write to us and say so before you upload.

Three suppliers, and between them they hold everything. There is no fourth.

We will tell workspace owners by email before adding a supplier that can reach personal data, with enough notice to object.

• Workspace records: for as long as the workspace is open. Archiving a record hides it from the working views and keeps it; deleting one is permanent and is restricted to owners and admins.
• Records with history attached: not deletable at all while that history exists. A campaign with deals under it, or a creator with a licence, cannot be destroyed by a single click, because that would destroy the evidence of a commercial agreement.
• The activity log: for the life of the workspace. It holds the values before and after each change, which means details of a record you deleted can survive in the log of its deletion. This is the point of an audit trail, and it is also a limit on erasure that you should know about.
• Rate limit counters: one day, and hashed for that day.
• Operational and error logs: kept only as long as they are useful for diagnosing a fault, and in no case beyond 90 days.
• After a workspace is closed: 30 days, so an accidental closure can be undone, and then deleted.

One agency’s records must never be visible to another. That is enforced in the database rather than in the application: every table carries a row-level security policy tying it to the organisation that owns it, so a mistake in the application code cannot expose another workspace’s contracts. The application checks permissions as well, but it is the second line, not the first.

• Contracts and creative live in private buckets and are served only through short-lived signed links, generated for a signed-in member of the owning workspace.
• Passwords are stored hashed and are never visible to us.
• Access inside a workspace is graded by role, and the grading is enforced by the same database policies rather than by hiding buttons.
• Every request is served over HTTPS.
• Password reset and invitation are rate limited to keep the service from being used to send mail to strangers.

No system is beyond reach, and we do not claim otherwise. What we can say is where the boundary is drawn and what it is made of.

Under the Nigeria Data Protection Act 2023 you may ask for a copy of the personal data held about you, ask for it to be corrected, ask for it to be erased, ask us to restrict what is done with it, object to processing based on legitimate interest, and ask for it in a portable form. You may also withdraw consent wherever consent is what we relied on.

Write to [privacy@example.com]. We will answer within 30 days, and if a request is complicated enough to need longer we will tell you inside those 30 days rather than at the end of them. Exercising a right costs nothing.

If your request is about records inside an agency’s workspace, we will pass it to that agency, because they are the controller and the decision is theirs. Clause 13 is written for you.

You never signed up for KREO. An agency you work with entered your details into its workspace, which means the agency decides what is held about you and why, and your rights are exercised against them rather than against us. Ask the agency directly: they can see the record, they can correct it, and they can delete it.

If you do not know which agency, or you have asked and had no answer within 30 days, write to [privacy@example.com] with whatever you have - the campaign, the brand, the address they contacted you on. We will identify the workspace and put your request in front of the people who can act on it, and we will tell you that we have done so.

We cannot delete an agency’s record for them, any more than a filing cabinet can empty itself. What we can do is make sure your request reaches somebody who can, and tell you if it does not.

KREO sets cookies for one purpose: keeping you signed in. They hold your session and nothing else, they are read only by this application, and they are strictly necessary, which is why there is no banner asking you to accept them.

There are no advertising cookies, because there is no advertising. The page measurement in clause 15 does not set one either. Clearing your cookies signs you out.

KREO measures how its own pages are used and how quickly they load, using Vercel Web Analytics and Vercel Speed Insights. Vercel already hosts the application and is named in clause 9; this adds a purpose, not a new company.

What a page view records is the path that was requested, the country it came from, the kind of device, the referring page and the browser. Speed Insights records timings: how long a page took to become usable. There is no identifier that follows you between sites, no profile built about you, and nothing that reaches inside a workspace - the measurement sees the address of a page, never the records on it.

It is aggregate. We can see that a page was opened four hundred times from Nigeria this week; we cannot see that you opened it, and neither can anyone else looking at the same figures.

If personal data is breached, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the Act requires. Where the breach is likely to result in a high risk to the people affected, we will tell them too, in plain language: what happened, what was reached, what we have done, and what they should do.

Where the data belongs to a workspace, we will notify that workspace’s owners and admins without undue delay so they can meet their own obligations as controller.

KREO is a business tool and is not for anybody under 18. Do not create an account if you are under 18. If a creator you work with is a child, holding their data carries obligations this service was not designed around, including consent from a parent or guardian - that responsibility sits with your agency, and you should take advice before entering the record.

We will update this policy as the service changes. The date at the top says which version is in force, and where a change materially affects how personal data is handled we will tell workspace owners by email at least 30 days before it takes effect.

[Registered company name] ([RC number])
[Registered address, Nigeria]
[privacy@example.com]

If we have not resolved something to your satisfaction, you may complain to the the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. You do not have to come to us first, though it is usually faster.

The terms of service govern the rest of the relationship, and this policy forms part of them.