Privacy policy

1. What this policy covers

This policy explains what data [Company name Ltd., company no. 5XXXXXXXX] ("Kreaza") collects and processes, why, who holds it, and what your rights are. It was written in accordance with the Privacy Protection Law, 5741-1981, and its regulations, including Amendment 13.

There are two kinds of data: data about the people who open a Kreaza account and work in it (business owners and team), and data about the customers of the stores. For the customers' data, the business is the database owner, and Kreaza processes it for the business only.

2. What data we collect

About account owners and team: name, email, password (stored as a hash, not as text), language, security settings, the history of actions in the account, and IP address and browser details at sign-in. For billing: name for the invoice, business registration number, email for invoices, and the last four digits of the card. The full card details are held by the payment processor only, and we keep only its encrypted token.

About store customers, on behalf of the business: order details, name, phone, email, shipping address, marketing consent, a customer account if one was opened, reviews, and the content of the chat with the store assistant. Full payment details do not pass through us.

Technical data: server and security logs, and aggregate usage metrics for stores. We do not use advertising cookies and we do not sell data.

3. Why we use the data

To run the service: to display the store, take orders, send the emails and messages the business has set up, back up and restore.

To charge and issue invoices, to secure the system and prevent fraud, to give support, to improve the service on the basis of aggregate metrics, and to meet obligations under the law.

Marketing emails from Kreaza are sent only to those who have agreed, and you can unsubscribe at any time.

4. Who holds the data

Kreaza's servers are hosted by OVHcloud in Frankfurt, Germany, in the European Union. Emails are sent from Kreaza's mail server.

Providers that receive data only for the purpose of the service: Cardcom, for charging plans and issuing invoices. LLM Gateway, for generating texts and for the AI assistant. fal.ai, for images and videos created from product images. Meshy, for 3D models. Google and Microsoft, only for those who choose to sign in through them. Google Firebase Cloud Messaging, for phone notifications for those who have turned them on. When the cloud service is unavailable, short texts are written by a language model that runs on Kreaza's own server, and the data does not leave it. The AI tools are sent only what the task requires, such as a product description or an image, and not customer details, except for the content of the chat that the customer writes to the store assistant.

Services that the business connects itself, such as a payment processor, a shipping company or a domain, receive the data they need according to the business's settings and according to their own policies.

5. How long the data is kept

Account and store data is kept for as long as they are active. After a store is closed and the period for changing your mind has passed, the data is deleted, and its backups are deleted with the backup cycle. Invoices and records that the law requires to be kept are kept for the period the law sets.

6. Security

Communication is encrypted, passwords are stored as a hash, and keys and secrets for connections are stored encrypted. There is two-step verification, role-based permissions, an activity log, and separation between stores. The database is backed up continuously.

If a severe security incident occurs that concerns your data, we will notify you and the Privacy Protection Authority as the law requires.

7. Your rights

You can inspect the data about you, ask to correct or delete it, export it, and object to direct marketing. Most of these actions are available directly in the account and in the store settings.

Customers of a store who want to exercise their rights contact the store itself, which is the database owner. If they contact us, we will pass the request to the store and assist it.

For privacy requests: [legal@kreaza.com]. You can also contact the Privacy Protection Authority.

8. Updates

We will update the policy when the service or the law changes. We will give advance notice of a material change, by email and in the admin.