Privacy Policy

1. Who is responsible

Krevya is provided by AUTOEER LLC, a limited liability company organised in Wyoming, USA. AUTOEER LLC is the controller of the data processed when you use your account and Krevya. For your store's customers, Krevya is a processor acting for you (see section 9 and the Data Processing Addendum).

Email: support@krevya.com. Postal address: 30 N Gould St Ste 58362, Sheridan, WY 82801, USA. Phone: +90 539 735 98 53.

2. What we process

• Identity and contact: your name and email address.
• Account: a one-way hash of your password (never the password itself), your workspace name, and your language and region preferences.
• Store data: your connected Shopify store's address, and your products, product images, prices and descriptions.
• What you upload and create: reference images, your brand kit, the directions you write, and the images, store pages and emails made with Krevya.
• Payments and usage: subscription, invoice and credit records. Krevya never sees or stores your card details; Whop processes payments.
• Support: what you write in support requests.
• Security: IP address, browser information, session and error logs.
• Usage analytics: the pages you visit and the steps you take, a random identifier and, once you sign in, your user id (never sent for users in Türkiye); where you allow it, also privacy-masked session recordings. When and how this runs depends on where you are (section 4). Your name and email are never sent to PostHog.

3. Why, and on what basis

Data is collected electronically and automatically when you sign up, use the service and connect your store.

• To open your account, provide the service, and read your products to make images, store pages and emails: performance of the contract.
• To take payments, invoice and manage credits: performance of the contract and legal obligations.
• To answer support requests: performance of the contract.
• To keep the service secure, prevent abuse and fix faults: legitimate interest.
• To establish and defend legal claims: legitimate interest.
• To measure how Krevya is used and improve it: in Türkiye, the EEA and every other country outside the US, your explicit consent, which you can withdraw at any time. In the US, our legitimate interest in improving the service, which you can opt out of at any time.

4. Analytics and session recordings, by region

Krevya measures usage with PostHog. We work out your country roughly (to country level only) from where your browser's request comes from, and we do not store it. If the country cannot be determined, the strictest rules apply.

• Türkiye: PostHog analytics for users in Türkiye runs only after explicit consent. PostHog's code is not even loaded before you allow it; after you do, no user or workspace id, name, email address or Shopify customer data is sent. If you withdraw, PostHog is stopped and what it stored in your browser is deleted.
• The EEA and every other country outside the US: analytics and preferences stay off until you allow them, and PostHog's code is not even loaded before you do. We currently ask for consent in Switzerland and the UK as well; that is our choice.
• The EEA and every other country outside the US: analytics and preferences stay off until you allow them, and PostHog's code is not even loaded before you do. We currently ask for consent in Switzerland and the UK as well; that is our choice.
• The US: limited analytics (page views and steps) may run by default where permitted. You can turn it off at any time with "Privacy choices" at the foot of every page, and that choice is remembered. Session recording never runs in the US.
• Session recordings are under stricter controls: they run only where consent is required and only after you have allowed analytics. Form inputs and sensitive areas are configured to be masked or excluded, and the admin, sign-in and sign-up, password reset, billing and settings screens are never recorded. Sensitive parameters such as access tokens, codes and email addresses are removed from recorded addresses.
• If your browser sends a Global Privacy Control (GPC) signal, we honour it as an opt-out of the sale or sharing of personal information and of targeted advertising. In addition, as our own choice, we treat it as an opt-out of analytics.

5. Who we share it with

Data is shared only as far as the service needs, with these providers (sub-processors):

• Cloudflare: hosting, database and file storage.
• Whop: payment processing and receipts.
• OpenAI and Google: product research and text and image generation. They receive your product information, images and directions; never your password.
• Resend: sending email.
• Shopify: on your instruction, access to your connected store and publishing drafts.
• PostHog Inc. (US): usage analytics and, where allowed, privacy-masked session recordings (section 4). Names and email addresses are never sent. Our data processing agreement with PostHog includes the EU Standard Contractual Clauses and the UK Addendum.

6. Selling, sharing and advertising

Krevya does not sell your personal information and does not share it for cross-context behavioural advertising. There are no advertising or retargeting pixels on Krevya's pages today. We honour GPC as described in section 4.

7. International transfers

Krevya is provided by AUTOEER LLC, a company established in the United States. Certain service providers process information on our behalf: Cloudflare for hosting and content delivery, Whop for payments, OpenAI and Google for AI generation, Resend for email, Shopify for the store integration and PostHog for analytics. Where processing of personal data relating to individuals in Türkiye involves an international transfer within the meaning of Article 9 of Law No. 6698, Krevya applies the transfer mechanism required by applicable law. The mechanisms applicable to individual providers are maintained in our compliance records.

For the EU and the UK: our data processing agreement with PostHog includes the EU Standard Contractual Clauses and the UK Addendum.

Transfers and cookie consent are separate matters: the consent you give in the cookie preferences concerns only what is stored and run on your device.

8. How long we keep it

Your data is kept while your account is open. When it is closed, it is deleted or anonymised, except where the law requires it to be kept or it is needed to resolve a dispute. Analytics data is kept in PostHog for the period set in our project settings; when you opt out, the PostHog keys in your browser are deleted at once.

9. About your store's customers

For people who sign up through the popup on your store and enter your email flows, you are the controller; Krevya processes their data only on your behalf and on your instructions. That relationship is governed by the Data Processing Addendum (krevya.com/legal/dpa), which forms part of the Terms. Informing them and obtaining their consent is your responsibility. Krevya sends them only the emails they agreed to receive, and every email carries an unsubscribe link.

10. Your rights

Which rights you have depends on where you are.

• Turkey (KVKK article 11): to learn whether your data is processed and how; to learn the purpose and whether it is used for that purpose; to know the recipients in Turkey and abroad; to ask for corrections, deletion or destruction, and for recipients to be told; to object to an adverse result reached solely by automated means; and to claim compensation for damage caused by unlawful processing.
• The EEA (GDPR): access, rectification, erasure, restriction of processing, data portability and objection; where processing is based on consent, you may withdraw it at any time. You may complain to the supervisory authority in your country.
• The UK (UK GDPR): the same rights, and you may complain to the Information Commissioner's Office (ICO).
• The US: where your state's law gives you these rights, you may ask to access, correct, delete or receive a portable copy of your data, and opt out of the sale or sharing of personal information and of targeted advertising. If we refuse a request, you may appeal. You will not be treated differently for using these rights.

11. How to apply

Send your request in writing, with information that lets us identify you, to 30 N Gould St Ste 58362, Sheridan, WY 82801, USA, from your registered email address to support@krevya.com, or by secure e-signature, mobile signature or registered electronic mail (KEP). It is answered free of charge within thirty days. If we refuse a request, you can appeal by writing to the same address. You do not need to apply to opt out of analytics: "Cookie preferences" or "Privacy choices" at the foot of every page does it.