Privacy Policy

Last updated: October 2026

1. Controller

Krevato (“we”, “us”) is the controller of the data about you as a customer and user: your account, your payments and how you use the service. Contact: privacy@krevato.se

The content you add to the service for your business, such as photos of staff and posts, we process on your business’s behalf and on its instructions. For that content your business is the controller and we are the processor.

2. Data we process

Account: name, email address, phone number if you give it, language. Your password is stored hashed by our sign-in service. If you sign in with Google, Google gives us your name and email address.
Business and brand: business name, content from your website, brand profile, guidelines, products, logo and the images in your image library.
People in images: name and photo of the people you add so they can appear in images Krevato creates. You confirm for each photo that the person has agreed.
Facebook and Instagram: when you connect a Page or account: its id and name, an access token (stored encrypted), your earlier posts, which we fetch to get to know the brand, and statistics for your posts.
Payment: plan, billing address, VAT number and payment history. Card details are handled by Stripe and never stored by us.
Technical data: IP address (to limit the number of requests and protect against abuse), error reports and logs.

3. Why we process the data, and on what basis

Providing the service (contract): your account and sign-in, writing posts and creating images with AI, publishing to your channels, analysing how the posts perform, and email about the service.
Payment and bookkeeping (legal obligation): invoices and payments are kept as long as Swedish bookkeeping law requires, seven years.
Security and troubleshooting (legitimate interest): protecting the service against abuse and finding and fixing errors.
The waitlist (consent): your email address, to let you know when we open. You can ask us to remove it at any time.

4. AI

Krevato writes text with Anthropic’s language model Claude and creates images with Google’s Gemini. They receive what the task needs: the brand profile, guidelines, the posts’ content, descriptions of images and, when a person is to appear in an image, that person’s photo. None of this is used to make decisions about you.

5. Providers (processors)

Supabase: database, sign-in and file storage (Stockholm)
Vercel: hosting of the website and the service (Stockholm)
Anthropic: AI text
Google: AI images and sign-in with Google
Meta: publishing to and statistics from Facebook and Instagram
Stripe: payments, invoices and VAT
Resend: email from the service
Sentry: error reports
Upstash: limiting the number of requests (IP address)

Some providers process data outside the EU/EEA, mainly in the United States. Such transfers rely on the European Commission’s decision on the EU–US Data Privacy Framework or on the Commission’s standard contractual clauses.

6. How long we keep the data

Your account and content are kept as long as the account exists. If you cancel your subscription, the account stays on the free plan until you delete it.
If you delete your account (Settings → Delete account), the data is deleted at once. Copies in our backups disappear as the backups are replaced, within 30 days at the latest.
If you disconnect Facebook or Instagram, the access token is deleted at once.
Invoices and payments are kept for seven years under Swedish bookkeeping law.

7. Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive your data (data portability). Where you have given consent you can withdraw it. Write to privacy@krevato.se.

If you have connected Facebook to Krevato, you can also remove Krevato and request deletion in Facebook’s settings for apps and websites. We then delete the connections to your Pages and accounts and what we fetched from them.

If you are unhappy with how we process your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

8. Cookies

About cookies, see our cookie policy.

9. Changes and contact

If we change this policy we update the date above, and for larger changes we let you know by email or in the service. Questions: privacy@krevato.se.