Skip to Main Content
Krealo Media logo
Updated October 19, 2026

Trust & privacy

  1. What you will find here

    Krealo Média inc. (Laval, Quebec) runs six software products: Krealo Publisher, Krealo Chat, Krealo CRM, Krealo Wallet, Krealo QR and Krealo Labels. They handle your customers’ information. This page says, product by product, where it is stored, who sees it, how long we keep it and which artificial-intelligence providers it may be sent to. It describes what our software actually does today. We claim no certification.

  2. Person in charge of the protection of personal information

    Keneth Walters, Krealo Média inc. — info@krealomedia.com. Write to him with any question, a request for access, correction or deletion, or a complaint (Quebec Law 25, s. 3.1).

  3. Where your data lives

    Everything is hosted on Google Cloud / Firebase, but not all in the same place. For every product, sign-in (Firebase Authentication) and web hosting are global Google services with no selectable region.

    ProductDatabaseUploaded filesServer functions
    Krealo CRMMontréal (northamerica-northeast1)United States (us-central1)Montréal; some addresses also answer from us-central1 for integrations already configured (they write to the Montréal database)
    Krealo WalletMontréalMontréalMontréal
    Krealo LabelsMontréalMontréalMontréal
    Krealo QRMontréalUnited States (us-east1): logos, PDFs and photosMontréal, except the check of uploaded files (us-east1)
    Krealo PublisherUnited States (nam5)United States (us-central1)United States (us-central1)
    Krealo ChatUnited States (nam5)United States (us-central1)United States (us-central1)

  4. What that means (Law 25)

    Part of your information is processed outside Quebec and Canada and may be subject to another country’s laws, including access by its authorities. We say so beforehand, as Law 25 requires.

  5. Artificial intelligence: providers and training

    AI is only called for a specific feature (drafting, summarizing, transcribing, generating an image). Krealo Wallet, Krealo QR and Krealo Labels send nothing to any AI provider. The providers below process data in the United States. The last column summarizes what their own terms say.

    ProviderProductsWhat is sentTraining
    OpenAI (API)Publisher, CRMText, audio (speech, transcription), image requestsData sent to the API is not used to train models; data sharing is turned off in our account. Abuse-monitoring logs up to 30 days.
    Anthropic (Claude API)Publisher (assistant)The conversation with the assistantNo training on API data by default; sharing is turned off in our account.
    Google (Gemini API)Publisher, Chat, CRM (fallback when OpenAI does not answer)The requested text: draft, summary, voice-message transcriptionPer Google’s terms: for paid services, Google does not use prompts or responses to improve its products and logs them for a limited time to detect abuse; for unpaid services, it may use them.
    Ollama (API)Publisher (assistant)The conversation with the assistantPer its policy, Ollama does not use inputs or outputs to train models, and content is processed transiently.
    RunwarePublisher (images)Image-generation promptsIts terms exclude training on “Customer Material” and Runware takes no licence in the images produced; they say nothing explicit about prompts on the standard API.

  6. Assistants you connect yourself

    In Krealo Chat, a member of the store’s team may connect their own assistant (Claude, ChatGPT or Meta’s Muse). It reads what that member already sees in the console, with emails and phone numbers masked by default; every access is logged and the connection can be revoked at any time.

  7. Who can see what

    Every product enforces server-side rules: a person only reaches the workspaces they belong to, and their role decides what they can do there.

    • At Krealo Média, technical access to the Google Cloud projects is limited to named team accounts, with no shared accounts.
    • In Krealo Publisher, a single platform-admin account can read company data, except the tokens of connected social accounts, which no browser can read.
    • In Krealo CRM, a salesperson’s personal mailbox is visible neither to colleagues nor to the workspace owner.

  8. Encryption and secrets

    All traffic uses HTTPS and Google Cloud encrypts data at rest.

    • In Krealo Publisher, API keys and mailbox tokens (Google, Microsoft, blogs) are additionally encrypted by the application (AES-256-GCM).
    • Other integration tokens are stored where no browser can read them.
    • Our provider keys live in Google Secret Manager, never in code.

  9. Retention and deletion

    What happens, product by product. Shopify requests (customers/data_request, customers/redact, shop/redact) are handled automatically in our Shopify apps.

    ProductRetention and deletion
    Krealo ChatVisitor record anonymized after 30 days; a conversation is deleted automatically after 24 months of inactivity, with its messages and attachments; on request, the identity is erased from the thread. Invoices: 6 years.
    Krealo CRMContent kept while the account is active; on closure, deleted or anonymized within 90 days by our team (not automatic). Deleting your account in the app removes the person’s profile, access and notifications; customer records stay with the company. Backups: daily kept 7 days, weekly kept 8 weeks.
    Krealo PublisherData kept while the account is active; delete from Settings → Delete account (profile, connected social accounts, companies you own) or by email, within 30 days at most.
    Krealo WalletA customer with no visit or change for 6 years is deleted automatically; technical logs 30 days; audit log 1 year; backups 7 days.
    Krealo QRTechnical logs 30 days; deleting the account erases links and clicks.
    Krealo LabelsPrint history 7 to 365 days depending on plan; data deleted on request or within 30 days of the Shopify uninstall.

  10. Law 25 and GDPR: what is in place

    What we do today, and nothing more:

    • A designated, reachable person in charge: Keneth Walters, info@krealomedia.com.
    • A privacy policy in French, English and Spanish for every product, saying where the data goes.
    • Your rights — access, correction, deletion, portability, withdrawal of consent: write to info@krealomedia.com. Answer within 30 days at most.
    • If a confidentiality incident carries a risk of serious injury: notice to the Commission d’accès à l’information and to the people concerned, and an entry in the incident register.
    • GDPR: the same rights apply to people in Europe. We do not have a representative in the European Union.
    • Complaints: Commission d’accès à l’information du Québec.

  11. What we do not do

    To be clear:

    • We do not sell your data or hand it to anyone for advertising.
    • We do not train any AI model on your data. For providers, we say what their terms say, no more and no less (see the table).
    • We do not claim ISO 27001, SOC 2 or any other certification: we do not have one.
    • We do not say everything is in Canada: the table says exactly what is not.
    • We never ask for a card number: payments go through PayPal or Stripe.
    • We do not browse your Shopify customer list: Krealo Chat only looks up orders for an email the visitor gave themselves.

  12. Contact

    Keneth Walters, person in charge of the protection of personal information — info@krealomedia.com. Krealo Média inc., 816-2160 Terry-Fox Avenue, Laval (Quebec) H7T 3B7.