Privacy Policy

Krevo operates Cloud file storage, an authenticated client portal, public marketing pages, support tools, and managed website services from Texas. This policy explains what personal information we collect, why we use it, where service providers process it, and the choices available to you.

This policy applies to visitors, account holders, Cloud customers, managed website clients, and people who contact us.

We use information to:

• Create accounts, authenticate users, and recover account access.
• Store, organize, transfer, preview, download, and share Cloud files.
• Enforce quotas, subscription access, security controls, and abuse limits.
• Process subscriptions, invoices, cancellations, and approved refunds through Stripe.
• Respond to support, privacy, sales, waitlist, and service requests.
• Operate managed websites and deliver work described in client proposals.
• Measure aggregate product performance and improve reliability and usability.
• Comply with law, valid legal process, accounting obligations, and security requirements.

We do not sell personal information or share it with advertising networks or data brokers.

Where law requires a legal basis, we rely on contract to provide purchased or requested services, legitimate interests to secure and improve Krevo, consent for optional marketing communications, and legal obligation for accounting, fraud prevention, and valid government requests. You can withdraw consent without affecting processing already completed.

Account, billing, storage metadata, and support records are held in Supabase Postgres. Cloud file objects are held in Cloudflare R2. The application runs on Vercel. Data is transferred between your browser, Krevo, and these providers using TLS.

We use access controls, authenticated server routes, row-level security where appropriate, scoped object keys, short-lived presigned file URLs, rate limiting, password hashing, security headers, validation, and audit logging. No system can guarantee absolute security, so keep independent copies of critical files and protect your credentials and share links.

• Supabase provides authentication and Postgres database infrastructure.
• Cloudflare R2 stores Cloud file objects and serves transfers through time-limited URLs.
• Have I Been Pwned provides k-anonymous breached-password screening without receiving the full password or full password hash.
• Stripe processes checkout, payment methods, subscriptions, invoices, billing portal sessions, cancellations, and refunds.
• Vercel hosts the application, edge delivery, server logs, BotID abuse detection, and privacy-friendly analytics.

These providers process data for Krevo under their own terms and privacy commitments. We may replace a provider with a comparable service and will update this policy when a change materially affects personal information.

Krevo uses first-party cookies required for Supabase authentication and application security. Vercel Analytics provides aggregate traffic insights without third-party advertising cookies. We do not use advertising pixels, cross-site profiling, or retargeting trackers.

We share account and authentication information with our identity and hosting providers, file contents and transfer details with our storage provider, billing information with our payment processor, and usage and security signals with our hosting and security providers. Our hosting and database providers also process support, privacy, and inquiry records on our behalf. We may also disclose information when required by law, to protect rights and security, in connection with a corporate transaction, or at your direction, such as when you create and distribute a Cloud share link.

A share link is controlled by the customer who creates it. Anyone with an unprotected link, or with both a protected link and its password, may be able to access the shared file until the link expires or is revoked.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of personal information, and to withdraw consent or opt out of marketing.

If the Texas Data Privacy and Security Act applies to your request, you may ask us to confirm whether we process your personal data, access it, correct inaccuracies, delete it, or obtain a portable copy of data you provided, subject to applicable exceptions. Texas law also provides opt-out rights for sales of personal data, targeted advertising, and profiling used for decisions with legal or similarly significant effects. Krevo does not sell personal data, use it for targeted advertising, or discriminate against you for exercising your privacy rights.

Use the public privacy request form to exercise your rights. No account is required. We may ask you to verify your identity before acting. We generally respond within 30 days. For requests covered by Texas law, we respond without undue delay and within 45 days of receipt. If we need a permitted extension of up to 45 additional days, we explain why within the initial period.

If we decline a covered request, we explain why and how to appeal. To appeal, use the appeal link below. In the details, write “Privacy appeal,” identify the original request, and tell us what you want reviewed. We provide a written decision on a Texas appeal within 60 days of receipt. If we deny it, you can submit a complaint to the Texas Attorney General.

• Submit a privacy request
• Appeal a privacy decision
• File a complaint with the Texas Attorney General

We retain account information, Cloud files, file metadata, and support records while needed to provide and secure an active service. After cancellation or account deletion, we retain or remove data according to the product's communicated access period, operational deletion process, backup rotation, legal obligations, and any open dispute or security investigation.

Billing and transaction records may be retained for tax, accounting, fraud-prevention, and legal requirements. Privacy requests are retained long enough to demonstrate receipt and completion. Public form submissions and operational logs are retained only as long as reasonably needed for review, security, and troubleshooting.

When you need a copy of Cloud files, download them before cancelling or request an export while access is available. Presigned transfer URLs expire quickly, but the underlying file remains stored until it is deleted under the account's storage lifecycle.

Krevo is operated from the United States, and our providers may process data in the United States and other locations where they operate. Where required, provider agreements use recognized safeguards for international transfers.

Krevo is not directed to children, and accounts require a person able to enter a binding contract. We do not knowingly collect personal information from children under 13. Submit a public privacy request if you believe a child provided information to Krevo.

We may update this policy as products, vendors, or laws change. We will update the date above and provide additional notice when a change is material.

Use the public privacy request form for privacy questions, complaints, or rights requests. Signed-in customers can also contact support through the portal.