Last updated: 23 July 2026
Kreo is the personal information controller for the data described here, and complies with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
Clients (business or individual): business or full name, business/representative name, email, contact number, address, niche(s), optional monthly budget, chosen username, and consent records.
Creators: name, social handles, city, gender, follower counts, rates, portfolio links, and a selfie captured at sign-up. If a Creator applies for the verified badge, we also collect a government-issued ID and a selfie holding that ID — used solely for identity verification.
Payments: GCash payment proofs and Creator payout account details (GCash or bank).
Performance: Kreo-verified 30-day analytics (followers, reach, engagement).
Technical: IP address and basic request data used for security and abuse prevention, and an essential session cookie to keep you signed in.
To operate the marketplace and your account; to vet Creators and businesses; to run campaigns, escrow, and payouts; to verify creator identity for the badge; to prevent fraud and abuse; to provide support; and to comply with legal, tax, and dispute-resolution obligations.
We process personal data on the bases of your consent (recorded at registration and application), the performance of our contract with you, our legitimate interests (security, fraud prevention, running the platform), and legal obligations.
Government IDs, selfies, and payment proofs are stored in a private, access-controlled bucket visible only to Kreo administrators. Row-level security restricts every record to the people entitled to see it. Creator identities and rates are hidden from unregistered visitors, and contact details are never shared between Clients and Creators — all communication runs through Kreo. Data is encrypted in transit.
We do not sell your personal data. We share it only with: our infrastructure providers who host the application and database on our behalf (currently Supabase and Vercel); Kreo administrators who operate vetting, escrow, and disputes; and government authorities where required by law or valid legal process.
Cross-border transfer: our hosting providers may process data on servers outside the Philippines. Where this happens we require appropriate safeguards consistent with RA 10173.
We keep personal data while your account is active and as needed to provide the service. Government IDs and verification selfies are retained only for the verification purpose and removed when no longer needed or on deletion. Records required for legal, tax, or dispute purposes (e.g. completed-transaction history) are retained for the period the law requires, then deleted.
Under RA 10173 you may access, correct, object to processing, request erasure or blocking, and obtain a copy of your personal data. You may also lodge a complaint with the National Privacy Commission (privacy.gov.ph). Email us at privacy@kreo.ph and we will act on verified requests within 15 business days.
Registration and creator applications require an explicit consent checkbox, and we record the timestamp of your consent. You may withdraw consent at any time by requesting account deletion, subject to records we must retain by law.
Kreo is not intended for anyone under 18, and we do not knowingly collect data from minors.
For any privacy question or to exercise your rights, contact our Data Protection Officer at privacy@kreo.ph.
To delete your account and personal data, email privacy@kreo.ph from your registered email with the subject "Data deletion request." We verify the request, remove your profile, any government ID and selfies, and personal data, and confirm within 15 business days. Records required for legal, tax, or dispute-resolution purposes may be retained for the period the law requires, then deleted.
