Privacy Policy

Last Updated: June 26, 2026

This Privacy Policy explains how Kreafilo ("we", "us", or "our") collects, uses, stores, and shares your personal data when you use our Service at www.kreafilo.com. Please read this policy carefully. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use the Service, we collect:

  • Name - provided during registration.
  • Email address - used for authentication, communications, and support.
  • Password - stored in hashed form; we never store plain-text passwords.
  • User Content - images you upload for processing by our tools.
  • Support communications - messages you send us via email.

1.2 Information We Collect Automatically

When you access the Service, we automatically collect:

  • IP address - for security monitoring and fraud prevention.
  • Usage analytics - pages visited, features used, session duration, error logs, and interaction events.
  • Device and browser information - browser type, operating system, and device type.
  • Cookies and similar technologies - see Section 5 for details.

1.3 Payment Information

We do not collect or store your full payment card details. Payment transactions are processed directly by Midtrans. We receive only a transaction confirmation, reference number, and the amount charged. Please review Midtrans' privacy policy for details on how they handle your payment data.

1.4 Information from Third Parties

If you log in using Google OAuth, we receive your name and email address from Google. We do not receive your Google password or access to your Google account beyond what is necessary for authentication.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Authentication and Account Management - to create and manage your account and verify your identity.
  • Providing the Service - to process your uploaded images and generate AI-powered prompt outputs.
  • Customer Support - to respond to your questions, reports, and feedback.
  • Billing and Payments - to manage your credit balance, process transactions, and send receipts.
  • Security and Fraud Prevention - to detect, investigate, and prevent fraudulent transactions, abuse, and unauthorized access.
  • Analytics and Product Improvement - to understand how users interact with the Service and to improve features and performance.
  • Communications - to send service-related notices, updates to these policies, and, where you have opted in, promotional messages.
  • Legal Compliance - to comply with applicable laws, respond to lawful requests, and enforce our Terms.

We will not use your personal data for purposes incompatible with those listed above without first obtaining your consent or as otherwise permitted by law.

3. Third-Party Services

We use the following categories of third-party service providers who may process your data on our behalf or in connection with the Service. We take reasonable steps to ensure that these providers offer adequate data protection.

Service Category Purpose

  • Authentication Provider (Google OAuth) - to enable sign-in via your Google account.
  • Payment Processor (Midtrans) - to securely process credit purchases and payment transactions.
  • Email Service - to send transactional emails such as password resets and account notices.
  • Cloud Hosting Provider - to host the Service, store data, and ensure availability.
  • Analytics Provider - to collect and analyze usage data to improve the Service.
  • Error Monitoring Service - to capture and diagnose application errors and performance issues.

4. How We Share Your Information

We do not sell your personal data. We may share information only as needed with:

  • Service Providers - we share data with our third-party providers (listed in Section 3) solely to the extent necessary for them to perform services on our behalf.
  • Analytics and monitoring providers that help us operate and improve the service
  • Legal authorities or other parties - we may disclose your information if required by law, court order, or government authority, or to protect our legal rights.
  • Business Transfers - if Kreafilo is acquired, merged, or transferred, your information may be transferred as part of that transaction, subject to the same privacy protections.
  • AI and model providers that process prompts and image analysis requests on our behalf
  • Authentication providers that support account login

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. We also use similar technologies such as local storage and session tokens.

5.2 Types of Cookies We Use

Essential Cookies

These cookies are necessary for the Service to function. They enable core features such as user authentication, session management, and security. You cannot opt out of these cookies without disabling the Service.

Analytics Cookies

These cookies help us understand how users interact with the Service by collecting aggregated, anonymized usage data. They allow us to measure traffic patterns and improve the Service. You may opt out of analytics cookies in your browser settings or by using available opt-out tools.

Functional Cookies

These cookies remember your preferences and settings (such as display language or theme) to enhance your experience. Disabling functional cookies may reduce the convenience of the Service.

5.3 Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Service. For more information on managing cookies, visit www.allaboutcookies.org.

6. Data Retention

We keep data for as long as it is reasonably needed to:

  • Deliver the service
  • Ensure account functionality
  • Assist with subscription management and invoicing
  • Maintain records for security, logging, and abuse prevention.
  • Comply with legal, tax, accounting, or regulatory obligations.

The duration for keeping data can differ based on the kind of information and the manner in which the feature is utilized.

7. Your Data Rights

Subject to applicable Indonesian law, you have the following rights regarding your personal data:

  • Right to Access - you may request a copy of the personal data we hold about you.
  • Right to Correction - you may request that we correct inaccurate or incomplete personal data.
  • Right to Deletion - you may request deletion of your personal data by deleting your account through account settings or by emailing kreafilo@gmail.com.
  • Right to Data Portability - you may request an export of your personal data in a structured, commonly used format, where technically feasible.
  • Right to Withdraw Consent - where we process your data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
  • Right to Object - you may object to certain types of processing, such as direct marketing.

To exercise any of these rights, please contact us at kreafilo@gmail.com. We will respond within a reasonable timeframe and in accordance with applicable law.

8. Data Security

We implement reasonable technical and organizational safeguards to protect your personal data against unauthorized access, loss, destruction, or alteration, including:

  • Encryption in Transit - all data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
  • Password Hashing - user passwords are hashed using a strong cryptographic algorithm; we never store plain-text passwords.
  • Access Controls - access to production systems and personal data is restricted to authorized personnel only.
  • Regular Updates - we apply security patches and updates to our software and dependencies on a regular basis.
  • Error Monitoring - we use automated error monitoring to detect and respond to security incidents.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable law.

9. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us at kreafilo@gmail.com and we will promptly delete such data.

Users between the ages of 13 and 17 should use the Service only with the knowledge and consent of a parent or guardian.

10. International Users and Data Transfers

Kreafilo is operated from Indonesia. If you access the Service from outside Indonesia, please be aware that your personal data may be transferred to and processed in Indonesia or in countries where our service providers are located.

Where your data is transferred outside your country of residence, we will take reasonable steps to ensure that the transfer is lawful and that your data receives an adequate level of protection in accordance with applicable law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will:

  • post the updated Privacy Policy on our website with a revised "Last Updated" date;
  • where practicable, send an email notice to your registered email address at least 7 days before the changes take effect.

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the updated policy. If you do not agree, please stop using the Service and delete your account.

12. Contact Us

If you have any questions about these terms, please contact us through the following methods:

  • Email: kreafilo@gmail.com
  • Website: https://kreafilo.com

We will respond to your inquiries within 24-48 hours.

Effective Date: June 26, 2026

These terms of service were last updated on June 26, 2026. We recommend that you review this page regularly for any updates.