Privacy Policy | KreativeRock Digital

KreativeRock Digital Limited (RC 1441363), of Lagos, Nigeria, is the data controller for the personal data described below. We serve businesses worldwide, so we comply with both the Nigeria Data Protection Act and, where applicable, the EU General Data Protection Regulation.

KreativeRock provides business messaging and AI automation services — SMS, WhatsApp, RCS, and an AI Sales Assistant — to other businesses ("customers"). This policy covers both visitors to our website and customers using our platform.

What we collect

We only collect what we need to run the service you've asked for.

Website visitors. If you submit our enquiry or newsletter form: your name, business name, email address, country, phone number, industry, company size, the service you're interested in, your message, and your newsletter consent record. Automatically, we also see your IP address (and the country it resolves to) and basic browser/page data.
Platform customers. Your account details (name, email, phone, organization, country) from sign-up; your credit/billing transaction history; any information you enter into your Knowledge Bank (business details used by your AI Sales Assistant); and the contacts you upload for messaging (names, phone numbers, emails, and any custom fields you choose to store). For security reasons we also log the IP address, and the country it resolves to, that you use when you first open your account and when you use it afterwards, together with the time you were last active.
Message content. The content of messages you send through our platform (SMS, WhatsApp, RCS), and conversations your customers have with your AI Sales Assistant, so that we can deliver them, bill you correctly, and let you review your own history.

Why we use it

To provide the service you've signed up for — our lawful basis is performance of our contract with you.
To reply to an enquiry — your request, and our legitimate interest in responding to you.
To send marketing emails, only where you've opted in — your consent.
To bill accurately and prevent fraud — our legitimate interest and legal obligations.
To keep accounts secure — we log IP addresses so that we can investigate suspicious sign-ins, fraud, and misuse of the platform, and help you if you suspect someone else has used your account. This is our legitimate interest, and the logged addresses are visible only to authorised KreativeRock staff.
To understand and improve the platform — our legitimate interest.

We never sell your data, and we never share it with advertisers.

How we count visits to this website

We count visits to our public website with our own counter, which uses no cookies and does not store your IP address. For each page you open we save only the date, the page, your country, the type of device (phone, tablet or computer), where you came from (for example a search engine or a link) and whether you accepted the analytics-cookie banner. To count each visitor once a day, your address and browser are mixed with a secret and the date and turned into a one-way code that changes daily and cannot be turned back into an address. This is our legitimate interest in understanding how the website is used. If you accept the analytics-cookie banner we also use Google Analytics, which sets its own cookies.

Who we share it with

We use a small number of processors, each bound by a data processing agreement:

Vercel — application hosting.
Neon — our database, where your account and messaging data is stored.
Clerk — authentication (sign-in/sign-up).
SendGrid — email delivery.
Inngest — background job processing (e.g. sending a scheduled campaign).
Anthropic — powers the AI Sales Assistant. Your Knowledge Bank content and conversation history are sent to Anthropic's API to generate responses.
Meta (WhatsApp Business Platform) — for customers using our WhatsApp suite, messages are delivered via Meta's WhatsApp Cloud API.
Our SMS and RCS network partners — for message delivery on those channels.
Cloudflare — DNS and network security for our website.
Google Analytics — anonymized website usage statistics.
Paystack / Flutterwave — for payments, once billing is live. We never see or store your card details ourselves.

How long we keep it

Enquiries are kept for three years from your last contact with us, then deleted. Newsletter subscribers are kept until you unsubscribe. Platform customer data is kept for as long as your account is active, and for a reasonable period after closure to meet our legal, tax, and accounting obligations. The IP addresses logged against your account are kept with your account record and deleted with it.

Your rights

Wherever you are, you can ask us to:

Give you a copy of the personal data we hold about you.
Correct anything that is wrong.
Delete your data, subject to our legal retention obligations.
Stop using it for marketing — you can also do this yourself, from the unsubscribe link in any email.
Object to how we use it, or ask us to restrict how we use it.

Email info@kreativerock.com and we will respond within 30 days. If you are in the EU or UK and unsatisfied with our response, you have the right to complain to your local data protection authority. If you are in Nigeria, you may complain to the Nigeria Data Protection Commission.

Security

The site and platform run over HTTPS. Access to customer data is restricted to authorised KreativeRock staff, and access is logged. We do not store card or payment details ourselves — that's handled entirely by our payment processors.

International transfers

Because we serve businesses worldwide, your data may be processed outside your own country, including in the European Union and the United States. Where that happens, we rely on the standard contractual clauses offered by our processors.

Contact

KreativeRock Digital Limited, RC 1441363, Lagos, Nigeria.
Email info@kreativerock.com. Phone +234 809 420 0003.

What we collect

We only collect what we need to run the service you've asked for.

Website visitors. If you submit our enquiry or newsletter form: your name, business name, email address, country, phone number, industry, company size, the service you're interested in, your message, and your newsletter consent record. Automatically, we also see your IP address (and the country it resolves to) and basic browser/page data.

Platform customers. Your account details (name, email, phone, organization, country) from sign-up; your credit/billing transaction history; any information you enter into your Knowledge Bank (business details used by your AI Sales Assistant); and the contacts you upload for messaging (names, phone numbers, emails, and any custom fields you choose to store). For security reasons we also log the IP address, and the country it resolves to, that you use when you first open your account and when you use it afterwards, together with the time you were last active.

Message content. The content of messages you send through our platform (SMS, WhatsApp, RCS), and conversations your customers have with your AI Sales Assistant, so that we can deliver them, bill you correctly, and let you review your own history.

Why we use it

To provide the service you've signed up for — our lawful basis is performance of our contract with you.

To reply to an enquiry — your request, and our legitimate interest in responding to you.

To send marketing emails, only where you've opted in — your consent.

To bill accurately and prevent fraud — our legitimate interest and legal obligations.

To keep accounts secure — we log IP addresses so that we can investigate suspicious sign-ins, fraud, and misuse of the platform, and help you if you suspect someone else has used your account. This is our legitimate interest, and the logged addresses are visible only to authorised KreativeRock staff.

To understand and improve the platform — our legitimate interest.

We never sell your data, and we never share it with advertisers.

How we count visits to this website

Who we share it with

We use a small number of processors, each bound by a data processing agreement:

Vercel — application hosting.

Neon — our database, where your account and messaging data is stored.

Clerk — authentication (sign-in/sign-up).

SendGrid — email delivery.

Inngest — background job processing (e.g. sending a scheduled campaign).

Anthropic — powers the AI Sales Assistant. Your Knowledge Bank content and conversation history are sent to Anthropic's API to generate responses.

Meta (WhatsApp Business Platform) — for customers using our WhatsApp suite, messages are delivered via Meta's WhatsApp Cloud API.

Our SMS and RCS network partners — for message delivery on those channels.

Cloudflare — DNS and network security for our website.

Google Analytics — anonymized website usage statistics.

Paystack / Flutterwave — for payments, once billing is live. We never see or store your card details ourselves.

How long we keep it

Your rights

Wherever you are, you can ask us to:

Give you a copy of the personal data we hold about you.

Correct anything that is wrong.

Delete your data, subject to our legal retention obligations.

Stop using it for marketing — you can also do this yourself, from the unsubscribe link in any email.

Object to how we use it, or ask us to restrict how we use it.