1. Who we are

Kreel is a private, invitation-only team collaboration app (messaging, files, calendar, notes), operated by the publisher of kreel.eu (“we”). For any question about your data: support@kreel.eu.

2. Data we process

Account data: display name, e-mail address, password (stored only as a hash, never in plain text), preferred language, and your role within your team.

Content you create: messages and attachments, uploaded files, calendar events, notes and vault items.

Technical data: a device token for push notifications (if you enable them), security logs (timestamps of sign-ins and sensitive actions) and the session cookie required for authentication.

We collect no browsing data for advertising purposes: no trackers, no third-party cookies, no analytics tools.

3. Why we process it

To provide the service: deliver your messages, store your files, display your calendar, keep your devices in sync. Legal basis: performance of our contract with you (GDPR, art. 6.1.b).

To notify you: send the push notifications you have enabled, through your device manufacturer’s notification service (Apple Push Notification service). Legal basis: your consent, revocable at any time in your settings.

To secure the service: detect abnormal access and limit abuse. Legal basis: our legitimate interest in protecting the service and its users (art. 6.1.f).

4. Where and how your data is protected

Your data is hosted in the European Union (France, OVHcloud). We do not transfer it outside the EU.

In transit, all communications are encrypted (HTTPS/TLS). At rest, the database is fully encrypted, and vault items carry an additional encryption layer with a separate key.

Passwords are protected with industry-standard cryptographic hashing and are never stored or transmitted in plain text.

5. Who we share it with

Your data is only disclosed to two technical providers, strictly necessary to operate the service: our hosting provider (OVHcloud, France), which stores data on our behalf, and Apple (Apple Push Notification service), which delivers push notifications if you enabled them — it only receives your device token and the minimal notification content.

We do not sell or rent any data. No ad networks, no data brokers, no profiling tools.

6. How long we keep it

For as long as your account exists. Deleting your account (available directly in the app, under Account) erases your personal data; encrypted technical backups are overwritten by their rotation cycle (14 days at most).

7. Your rights

Under the GDPR you have the rights of access, rectification, erasure, portability and objection. The app lets you directly edit your information, export your data and delete your account.

For any other request: support@kreel.eu. You may also lodge a complaint with your supervisory authority (in France, the CNIL — cnil.fr).

8. Cookies

Kreel uses a single, strictly necessary cookie: the session cookie that keeps you signed in. It is only readable by our server, expires with your session and is not used for any tracking.

9. Changes

If this policy changes, this page will be updated and the date above revised. In the event of a substantial change, users will be informed in the app.