Security and privacy

Kreel stores platform-reported data from Shopify, Klaviyo, Meta, and Google so you and your AI agents can query it in one place. This page explains what access Kreel requests, how credentials and data are protected, how your data stays isolated from other workspaces, and what happens to your data if you disconnect a platform or delete a brand.

Read-only access to every platform

Every platform connection uses OAuth 2.0, and Kreel requests read-only scopes only. Kreel never asks for, stores, or sees your platform passwords.

• Shopify: reads orders, customers, products, and inventory.
• Klaviyo: reads campaigns, flows, lists, segments, metrics, templates, and tags.
• Meta: reads ads and ad account insights, plus the two Facebook Page permissions needed to read the Page-owned video behind an ad’s video creative.
• Google Ads: reads campaign and account data.

Google Ads scope

Google’s OAuth scope for Ads access is a single broad scope, not a narrower read-only one. Kreel’s own code only ever calls Google’s read and query endpoints, never a write or mutation call, so the read-only guarantee comes from what Kreel’s code does with the scope, not from the scope itself.

Kreel never sends, edits, or deletes anything on a connected platform. It only reads data to display it back to you and your agents.

Credentials are encrypted at rest

OAuth tokens for every connected platform are encrypted before they are written to the database. Encryption keys are stored outside source control, separate from the encrypted data itself. Shopify customer personal information, such as names, emails, and phone numbers, is also encrypted at rest and decrypted only when a request needs it.

API keys are stored as hashes

API keys used by the CLI and MCP are shown to you in full only once, at the moment you create them. After that, Kreel stores only a cryptographic hash of the key, never the key itself. If you lose a key, it cannot be recovered - you create a new one instead. See API keys for how to create and manage them.

Your data stays inside your workspace

A workspace is the top-level container for your account. It owns your brands (each brand is one store’s connected-platform data) and your seats (the people on your team). See Workspaces, brands, and seats for how these fit together.

Every request Kreel serves, whether from the dashboard, the CLI, or an AI agent over MCP, is resolved to a specific caller and a specific brand before any data is read. Every data query is filtered to that one brand.

An API key is scoped to a single workspace. It can reach any brand its creator currently has access to inside that workspace, but never a brand in a different workspace. Kreel does not pool or compare data across different brands or workspaces.

Personal data is not exposed by default

Beyond encryption, Kreel also limits who can see decrypted personal information, such as customer names, emails, and phone numbers, even among people and keys that can already reach a brand’s data.

• Dashboard members with the owner, admin, or member role can see personal information. Members with the viewer role cannot.
• API keys cannot see personal information unless they were created with the PII access scope turned on. Without that scope, personal-information fields are left out of API, CLI, and MCP responses, regardless of the creator’s own dashboard role.

What happens when you disconnect a platform

Disconnecting a platform (Connections → Revoke) stops syncing immediately and discards the stored OAuth credential right away. The data Kreel already synced from that platform is kept for 90 days in case you reconnect. If you reconnect the same account within that window, your history stays intact. If you don’t reconnect, an automated job permanently deletes that platform’s data for the brand once the 90 days pass.

Connecting a different account for the same platform, such as a different Shopify store, purges the old account’s data immediately. Kreel cannot represent two different accounts as one brand’s platform data at the same time.

Retention windows for how much history Kreel keeps while a platform stays connected are covered in Sync and data freshness.

Deleting a brand

Deleting a brand (Settings → Danger zone → Delete brand) purges its synced platform data and removes API keys bound to that specific brand. Workspace API keys that are not bound to the deleted brand stay active for the workspace’s other brands. If your goal is to invalidate a credential, revoke or rotate the key itself from the API keys page - see API keys. You have to type the brand’s exact name to confirm, since this cannot be undone. The brand disappears from every surface immediately, and a background job then purges stored reports and ad creative files before permanently deleting the brand’s data.

A brand that has stayed deactivated for 90 days or more is automatically deleted the same way, even if nobody used the Delete button.

Requesting deletion or exercising your privacy rights

If you uninstall the Kreel app from your Shopify admin, Shopify automatically sends Kreel privacy webhooks (customers/data_request, customers/redact, shop/redact). Kreel verifies and processes these automatically.

Delete your whole account

To delete your entire Kreel account, including every workspace, email privacy@kreel.ai with the subject line “Delete my account.” Kreel acknowledges the request within 3 business days and completes it within 30 days. Billing records required by tax law are retained for up to 10 years, accessible only to authorized personnel.

For any other privacy request, such as access, correction, or export of your data, email privacy@kreel.ai. Kreel responds within 30 days.

Hosting and sub-processors

Kreel is operated by Beyond Peaks Ltd, incorporated in Malta. Primary application hosting runs on Hetzner in Germany (EU). The database and authentication run on Supabase in the EU (Frankfurt). The marketing site and this documentation are hosted statically on Vercel’s CDN. Supabase and Hetzner each provide their own encryption at rest for the underlying storage they host.

Current sub-processors: Supabase (database and auth, EU), Hetzner (application hosting, EU), Google (Gemini API, used only to generate descriptive tags from ad creative images, video, and ad copy for the creative-analysis feature), PostHog (product usage analytics), Resend (transactional email), Stripe (billing), and Vercel (marketing and docs hosting).

Primary data storage is in the EU. Any transfer outside the EU, such as to a US-based sub-processor, is made under Standard Contractual Clauses. All traffic uses TLS 1.2 or higher, and unencrypted HTTP is redirected to HTTPS.

Kreel does not sell personal data and does not use connected-platform data to train third-party AI models.

Questions

Email support@kreel.ai with any questions about how Kreel handles your data.