Privacy Policy

1. Data controller

The controller of personal data processed in connection with the use of the Korevo Service is Interactive Jakub Stawski, VAT ID (NIP): 8291758638, registered address: 98-161 Marżynek 105, Poland ("Service Provider", "Korevo").

For any matters related to personal data protection, please contact kontakt@korevo.pl.

2. What data we process

In connection with registration and use of the Service, we process: first and last name, email address, password (stored only in hashed form), phone number (optional), Company name and industry, and — if provided — billing details (name, tax ID, address).

We also process data entered by a Company while using the CRM (its customers, leads, jobs). In this respect, the Company acts as the controller of that data, and Korevo acts as a processor on its behalf.

3. Purposes and legal basis

We process data in order to: conclude and perform the agreement to use the Service (Art. 6(1)(b) GDPR), handle billing and issue invoices (Art. 6(1)(c) GDPR — legal obligation), and pursue the Service Provider's legitimate interest, e.g. ensuring the Service's security and preventing abuse (Art. 6(1)(f) GDPR).

4. Recipients of data — third-party processors

To provide the Service, we rely on the following processors acting on our behalf:

— Stripe — payment and subscription processing; — Fakturownia — VAT invoice issuance; — Google reCAPTCHA — protecting forms against spam and abuse; — our hosting provider (OVH) — data storage and server infrastructure; — Sentry — application error monitoring to keep the Service stable; — Meta Platforms Ireland Limited — receiving and sending Facebook Messenger and Instagram messages when a Company connects its profiles (see section 4a); — an AI model provider (currently OVHcloud AI Endpoints) — drafting the AI agent's replies when a Company enables that add-on (see section 4a).

Each of these providers is bound by an appropriate data processing agreement, or acts under its own privacy policy as an independent controller (in particular Stripe and Google).

4a. Facebook and Instagram messages (AI Agent)

A Company that uses the AI Agent add-on can connect its Facebook Page (Messenger) and Instagram professional account to Korevo. For this purpose the Company is the controller of its customers' data and Korevo processes it on the Company's behalf (as a processor).

We process only what is needed to handle the conversation: the content of messages sent to the Company's profile, the sender identifier assigned by Meta, the profile name (first and last name or username) and the replies. This data is used to show the conversation to the Company's staff, to prepare suggested replies and bookings by the AI agent and — when a staff member confirms it — to link the conversation to a customer record in the CRM. We do not use it for advertising or to train models, we do not sell it and we do not combine data of different companies.

Message content may be sent to the AI model provider solely to draft a reply. Conversations are kept for as long as the profile is connected and the Company's subscription lasts; the Company can disconnect a profile in its settings, which stops further message collection.

A person who wrote to a Company's profile can request deletion of their data — see the "Data deletion" page (korevo.pl/usuwanie-danych).

5. Data retention and deletion

Company data is retained for the duration of the subscription and for the period necessary for billing and potential claims.

A Company Owner may, at any time, export a full copy of their Company's data or permanently delete the Company along with all associated data from the account settings ("Data & Privacy" tab) — deletion is irreversible.

6. Rights of data subjects

Anyone whose data we process has the right to: access their data, rectify it, erase it, restrict its processing, request data portability, and object to processing based on legitimate interest.

You also have the right to lodge a complaint with the Polish data protection authority (UODO — Prezes Urzędu Ochrony Danych Osobowych) if you believe our processing violates data protection law.

To exercise any of these rights, please contact us at kontakt@korevo.pl.

6a. Visit analytics (with consent)

If you consent to analytics cookies in the banner, we measure with our own in-house system (first-party, no external tools) how visitors move through the site and the signup form: which steps they take, from which source (UTM parameters, referrer) and on which device (phone or computer). For this we store a random, anonymous identifier in your browser (localStorage: korevo_aid, sessionStorage: korevo_sid). We store no IP address or full User-Agent, and events contain no name, email address or other personal data.

Without your consent events are counted in aggregate, without an identifier, and nothing is stored in your browser. The legal basis is consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with the "Cookie settings" button in the page footer. Analytics data is kept for 13 months and then deleted automatically.

7. Cookies and localStorage

Information about the cookies and localStorage mechanisms used by the Service is available in a separate Cookie Policy.