Privacy Policy

Krevo represents creators towards collaboration partners. To do that we process data about the creators who sign up, and about the companies we approach on their behalf. Here is what that means in detail.

Who is responsible

Paul Geiser
Karlsplatz 5
80335 München
Reachable at paul@krevomanagement.com.

What we store about a creator

• Account: username, email address, a password hash. We do not store the password itself and cannot read it.
• Profile: a description of their content, previous collaboration partners, preferred term, minimum price and target price.
• Channels: the addresses of their social media profiles and, if the creator connects an account, the data the platform returns: profile picture, follower count, reach, the age, gender and country distribution of the audience, and per post the views, likes, comments and a thumbnail. From Twitch, additionally the number of paid subscribers, new followers and, while the channel is live, the current viewer count once an hour.
• Uploads: screen recordings of their own insights and an introduction video, if provided.
• History: which brands were found, contacted or removed, and which offers came out of it.

What we use it for

To find suitable collaboration partners, approach them on the creator's behalf and negotiate up to an offer. The numbers are the argument in that conversation: a brand decides on reach and audience, and without them an enquiry is worthless.

The legal basis is performance of the contract with the creator (Art. 6(1)(b) GDPR). For approaching companies we rely on the legitimate interest in business contact (Art. 6(1)(f) GDPR).

What is public, and what is not

Every creator gets a MediaKit at its own address. It is public: whoever has the link can see it, and the link is in every mail we send to a brand.

The creator decides on both: whether the page exists at all, and whether the numbers appear on it. Both can be switched off in the settings. The minimum price, the target price, the email address and the negotiation history are never on that page.

Who else is involved

• A hosting provider runs the servers and the database. The data lives in its network of data centres.
• AI services help us research brands, word our requests and read uploaded screen recordings so their numbers can be taken over. For a recording the file is transferred, not the creator's profile. We use paid tiers only: the providers do not use the data to improve or train their products, and no human reads it.
• Meta (Instagram) and TikTok, if the creator connects an account. We request read access only: profile, posts and their metrics. We have no access to messages and we publish nothing.
• YouTube (Google), if the creator connects their channel. Krevo uses the YouTube API Services. By connecting, the creator also agrees to the YouTube Terms of Service and the Google Privacy Policy. We request read access only: channel, videos and their metrics, plus the YouTube Analytics reports for that channel (watch time, retention, age, gender, country and traffic sources). We do not upload, change or delete anything, and we do not read comments or messages. Access can be withdrawn at any time under https://myaccount.google.com/permissions.
• LinkedIn, if the creator connects their account. We request read access only to the statistics of their own posts: impressions, members reached, reactions and comments. We publish nothing and have no access to messages or connections. Access can be withdrawn at any time in the LinkedIn settings, as described in the LinkedIn Help.
• Google (Gmail) hosts our own company mailbox, through which we correspond with brands. Their replies are stored with us so that they show up in the negotiation. We have no access to the mailbox of a creator and never ask for one.

Some of these providers are based in the United States. Transfers there rely on the EU-US Data Privacy Framework or on the EU standard contractual clauses. Which provider does what we tell you on request.

How we protect the data

• Every connection runs encrypted over TLS. A request over http is redirected to https.
• Database and file storage sit with our hosting provider and are encrypted there at rest with AES-256.
• A password is stored only as a hash, PBKDF2 with SHA-256, 600,000 rounds and its own salt per account. The password cannot be recovered from it.
• The access tokens of Instagram, TikTok, YouTube, LinkedIn and Twitch live in that database only, are passed to nobody and are deleted when the connection is removed. The access to our own mailbox is additionally encrypted with AES-GCM before it is stored.
• The session cookie is signed and set as HttpOnly, Secure and SameSite=Lax: no script in the browser can read it, and it is not sent over an unencrypted connection.
• We request read access only, and only the permissions a function really needs. The revenue figures of a YouTube channel, for instance, we do not request at all.
• Access to the database and to the mailbox is limited to the operator named above and to the processors listed here.

Data we receive through a Google API is used only for the functions the account was connected for. We do not sell it, do not pass it on beyond the processors named here, do not use it for advertising, and neither we nor those processors use it to develop, improve or train general models for AI or machine learning. Where content of the mailbox goes to an AI service so that a request can be worded or a reply sorted, we use its paid tier, in which the data is not used for training. This follows the Limited Use requirements of the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

• Account data for as long as the account exists.
• Uploaded recordings until they have been read; after that only the resulting numbers remain.
• Profile pictures and company logos are cached for up to 30 days so the page does not have to fetch them on every visit.
• Instagram, TikTok, YouTube and Twitch access tokens until the connection is removed, at the latest until they expire. Data fetched from the YouTube API that is no longer covered by an authorisation is deleted or refreshed within 30 days.

Cookies

All of them are needed for what you asked the site to do, none of them tracks you across other sites, and none is passed on. That is why they need no consent.

• cos_session keeps a creator logged in and holds nothing but a session token. Set on login, deleted on logout.
• cos_konten remembers which accounts are logged in on this device, so you can switch between them without signing in again.
• cos_vertretung exists only while we work inside a creator account with their permission, and it is what takes us back out.
• cos_haus marks a device as ours when we log in, so our own visits do not end up in a creator’s page statistics.
• cos_geraet counts the free request checks on this device, for a year. It is the only one you get without an account, it holds a random string and no personal data.

A MediaKit additionally keeps a random id for the open tab (cos_besuch, in session storage, not a cookie). It lets us count how far visitors read; it is gone when the tab closes and never recognises anyone on a second visit.

How we improve the site

On the website and in the app (not on a MediaKit, not on a price overview) we count which pages are opened, which buttons are pressed, how far a page is scrolled and how far the onboarding gets. With it we store the country and city our hosting provider derives from the request, device type, browser, language and the page you came from. Your IP address is not stored with the visit. Without your consent this uses a random id that only lives while the page is open; nothing is stored on your device. Legal basis is our legitimate interest in a working site (Art. 6(1)(f) GDPR). Visits are deleted after 400 days.

Only if you switch it on below, we also record how you use the site: page changes, mouse movements, scrolling and clicks, so we can replay it and see where things get stuck. What you type is never recorded and shows up as asterisks. The recording stays with us (stored with our hosting provider), is not passed on and is deleted after 90 days, or with your account. For this, your browser keeps your choice (cos_mitschnitt), a random id for the visit (cos_rundgang, session storage) and one for this device (cos_besucher, local storage). Legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can give and withdraw here at any time:

Your rights

Access, rectification, erasure, restriction, data portability and objection. An informal mail to paul@krevomanagement.com is enough. How deletion works in practice is described under Data deletion.

You also have the right to lodge a complaint with a data protection supervisory authority.

What we do not do

No advertising trackers, no third-party analytics services, no sale or sharing of data beyond the processors named above. The MediaKit loads no images from third-party servers: profile pictures and logos are served through us, so that a brand visiting the page does not show up in someone else's logs.