Your work. Your data. Your context.

This Privacy Policy explains how Kretopia collects, uses, shares, stores and protects personal information when you use Kretopia websites, products and related services.

The final published policy must identify the legal entity that acts as the data controller or equivalent responsible entity for the relevant users and services.

To complete before publication
Insert Kretopia’s confirmed legal entity, registered address and any jurisdiction-specific controller or representative details.

Kretopia may collect account information, professional profile information, work and collaboration information, opportunity and hiring information, payment-related information, communications, device and browser information, usage events, cookie data where used, and source, provenance, permission, version and audit information needed to keep records trustworthy and access-controlled.

Kretopia may process personal information to create and operate accounts and Creative Passports; provide Studio, Scout, search, messaging, booking and payment-related features; preserve source, version, approval, permission and professional evidence context; secure the Services; prevent abuse and fraud; respond to support, privacy and safety requests; personalise and improve product experiences; and comply with legal obligations.

The lawful basis for particular processing can vary by jurisdiction and purpose, including performance of a contract, legitimate interests, consent and legal obligations.

Kretopia contains information with different audiences. A public profile or published Creative Passport is different from a private relationship record, restricted client file, organisation membership, internal note or Work Room audience.

Visibility
Information you choose to publish may be visible to other users or the public according to the relevant setting.

Private relationship data
Private contacts, imported rosters, relationship notes and restricted workspace content are not intended to become public by default.

Scoped access
Organisation and Work Room access should remain scoped to authorised users and records.

Retention after sharing
Changing visibility or revoking access may not erase information another party is legally required to retain or that forms part of an independent record, transaction or dispute.

Kreto and other AI-assisted features may process permissioned context to help prepare drafts, organise work, retrieve relevant information, explain options or coordinate supported actions.

Access to information for AI-assisted features should remain subject to the same authority and workspace boundaries as the underlying product. A prompt, model output or external content should not expand a user’s permissions.

Kretopia may retain execution history, source references, approvals and receipts where needed to make AI-assisted actions inspectable and recoverable.

Training use is not stated here
The supplied Kretopia materials do not establish a final policy for whether customer content is used to train general-purpose models. That point should be decided explicitly before publication rather than implied.

Kretopia may share personal information only as needed for the purposes described in this Policy, including with authorised users, service providers, for legal and safety reasons, or in connection with a business transaction subject to applicable safeguards.

Subprocessors
A current subprocessor list should be maintained separately once confirmed.

Where Kretopia enables payment-related features, payment providers may collect and process information needed for checkout, identity verification, fraud controls, settlement, refunds, disputes and payouts.

Kretopia may receive transaction references, status events, provider fees, settlement information and other records needed to reconcile an engagement or invoice. Payment method details may be handled directly by the applicable payment provider rather than stored by Kretopia.

Available providers, countries, currencies and payment methods may vary. The Privacy Policy should be updated when the production payment architecture and subprocessors are confirmed.

Kretopia may use cookies or similar technologies that are necessary for authentication, security, preferences and operation of the Services. Additional analytics or measurement technologies may be used where configured and permitted.

Where applicable law requires consent for non-essential technologies, Kretopia should provide an appropriate consent mechanism and explain the relevant categories and providers in a Cookie Policy.

Cookie inventory required
The supplied materials do not establish the live cookie and analytics inventory. Do not publish a detailed cookie claim until the production site has been audited.

Kretopia uses technical and organisational measures intended to protect personal information against unauthorised access, loss, alteration or disclosure. Security controls may include authentication, access controls, encrypted transport, scoped permissions, logging and other safeguards appropriate to the Services.

No internet or storage system can be guaranteed to be completely secure. Users are responsible for protecting their credentials and should report suspected unauthorised access promptly.

Kretopia retains personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, preserve professional or transaction records, secure the Platform, resolve disputes and comply with legal obligations.

When an account is deleted, Kretopia may delete, anonymise or restrict personal information that is no longer needed. Some information may need to remain where it is connected to another party’s engagement, payment, legal record, fraud investigation, dispute, audit trail or other legitimate retention requirement.

Previous 30-day promise
The current source set does not confirm that Kretopia can operationally guarantee deletion or anonymisation within 30 days across canonical records, backups, payment evidence and revocation propagation. The fixed promise is therefore removed pending technical and legal confirmation.

Depending on where you live and the law that applies, you may have rights to request access, correction, deletion, restriction or objection, portability, withdrawal of consent, and information about relevant automated processing or human review where required by law.

These rights can be subject to legal exceptions and identity verification. Kretopia may retain information where required by law or where another lawful basis applies.

Kretopia may use service providers or infrastructure located in countries other than the country where you live. Where personal information is transferred internationally, Kretopia should use safeguards required by applicable data-protection law.

The final policy should identify the relevant transfer mechanisms once the production hosting, provider and contracting structure is confirmed.

Kretopia is intended for users aged 18 and over. Kretopia does not knowingly intend to provide accounts to children under 18 under the current policy.

If Kretopia learns that personal information was collected from a person who is not eligible to use the Services, it may take appropriate steps to restrict the account and delete or otherwise handle the information as required by law.

The Services may contain links to external websites, opportunities, platforms or services that Kretopia does not control. Their privacy practices are governed by their own policies.

Opening an external link or using an external service does not make Kretopia responsible for that third party’s privacy, security or content practices.

Kretopia may update this Privacy Policy as the Services, providers, legal requirements or data practices change. Material changes should be communicated through the Platform, by email or through another reasonable channel where required.

The “Last updated” date at the top of the page identifies the version currently displayed.

Privacy questions and requests can be sent to privacy@kretopia.com.

Depending on where you live, you may also have the right to complain to a competent data-protection or privacy authority.

Before publication
Confirm that the privacy mailbox is monitored, add the legal entity and registered address, and determine whether Kretopia has appointed a Data Protection Officer or other required privacy representative.