Privacy Policy

Information You Provide Directly

Account & Profile Information

When you register for a Korrero account, we require your full name and email address. We also require you to create a password, which we store in a secure, hashed format (meaning we can never see your actual password). You may also voluntarily choose to upload a Profile Picture (Avatar) to personalize your account. We collect this information to create your account, identify you within the Service, and communicate important service-related notices to you (like password resets or billing notifications).

Project & Team Member Information

Our Service allows you to create projects to manage your notifications. We store the project names you create and the secure API keys we generate for those projects. If you invite other team members to a project, we process the email address you provide to send the invitation. To facilitate collaboration, once a team member has joined your project, their name, email address, and Profile Picture (Avatar) will be visible to you and other members within that project's team management view.

Notification Content

As a core part of our service, we process the data you send through our API. This includes the content of the notifications themselves and any associated media files you upload or link to. We process this data solely on your behalf and according to your instructions, which are to deliver it to your specified channels. You are the Data Controller for this information and are responsible for its content.

Information We Collect Automatically

Usage & Analytics Data

When you use our service, we collect data about your activity. This includes analytics on your notifications, such as impressions, clicks, and Click-Through Rate (CTR). We collect this information to display it to you on your analytics dashboard and to help us understand how our Service is performing, allowing us to improve it.

Technical Log Data

Like most websites and services, our servers automatically collect technical information when you access or use our console or API. This includes your IP address, browser type and version, operating system, and the date and time of your interactions. We use this log data for the legitimate interests of securing our Service, preventing abuse, diagnosing technical problems, and ensuring stability. These logs are retained for a fixed period of 90 days.

Information We Receive from Third Parties

Payment Information

We use Paddle as our official Merchant of Record to handle all subscription payments and invoicing. When you choose to upgrade to a paid plan, we securely pass your email address and a unique Korrero user identifier to Paddle to initiate the checkout process. You provide your payment details directly to Paddle's secure checkout page. We do not receive or store this sensitive payment information. After a successful payment, Paddle provides us with confirmation details, such as your name, country of residence, and which plan you purchased.

Third-Party Authentication Information

We offer the ability to sign up and log in using third-party authentication services ("OAuth"), such as Google or other providers we may support in the future. If you choose to use one of these services, you authorize that service to share certain information with us. We will receive information like your identifier, name, email address, and profile picture from the provider to create and authenticate your Korrero account. We do not receive your password from these third-party services.

a) To Provide Our Service (Based on "Performance of a Contract")

This is our primary reason for processing your data. When you sign up for Korrero, you are entering into a contract with us to provide you with a notification service. We use your data to fulfill this contract, which includes:

• Creating and Managing Your Account: We use your Account Information (name, email, password) to create your account, secure it, and allow you to log in.
• Delivering the Core Service: We process your Project Data and Notification Content to send, manage, and track notifications as you instruct through our API and Console.
• Managing Your Subscription: We use information from our payment processor, Paddle, to apply the correct subscription plan to your account and manage your access to paid features.
• Providing Essential Communications: We use your email address to send you critical service-related messages, such as password resets, security alerts, and subscription status updates.

b) For Legitimate Business Interests (Based on "Legitimate Interest")

We use some data for legitimate business purposes to maintain, secure, and improve our service. We only do this when our interest is not overridden by your fundamental rights and freedoms. These purposes include:

• Security and Fraud Prevention: We process Technical Log Data to protect the security of our Service.
• Debugging and Service Improvement: We use Technical Log Data and aggregated Usage Analytics to diagnose problems, troubleshoot errors, and understand how our service is being used.
• Customer Support: If you contact us for help, we will use your Account Information and any other information you provide to investigate and resolve your issue.

c) With Your Explicit Permission (Based on "Consent")

For any activities that are not essential to providing the core service, we will always ask for your consent first. This includes:

• Marketing Communications: We will only send you promotional emails or newsletters about new features or offers if you have explicitly opted in to receive them.
• Analytics and Performance Cookies: As described in our Cookie Policy, we use services like Google Analytics to understand how users interact with our website.

Account and Notification Data

Your Account Information, Project Data, and Notification Content are retained for as long as your Korrero account is active. The indefinite storage and archiving of your notification history is a core feature of the Service that we provide to you.

As our client, you are the Data Controller for this information and are responsible for its lifecycle. You can and should use our built-in features to manually delete any or all your notification data at any time.

If you choose to delete your account, all personal data associated with it (including your profile, projects, and notification history) will be permanently deleted from our active systems within a reasonable period.

Technical and Log Data

We retain Technical Log Data, which includes your IP address and information about your interactions with our service, for a fixed period of 90 days. This data is used for security analysis and debugging purposes. After 90 days, these logs are automatically and permanently deleted.

Legal Obligations

Please note that we may be required to retain some information for a longer period to comply with our legal or regulatory responsibilities. For example, we may need to keep basic transactional records provided by Paddle for several years to comply with financial and tax laws in the EU.

How to Exercise Your Rights

We have built tools to help you easily exercise your rights:

• Access, Rectification, and Deletion: You can access and update most of your Account Information directly from your account settings page. You can also delete your data by using the project and notification deletion features, or by using the "Delete Account" function in your settings.
• Data Portability: You can download a machine-readable file of your account and project data using the "Export My Data" function in your account settings.

For any other requests, or if you need assistance, please contact us directly by emailing [email protected]. We will respond to your request within 30 days, as required by law.

Right to Lodge a Complaint

While we hope to resolve any concerns you have directly, you have the right to lodge a complaint with your local data protection authority if you believe your privacy rights have been infringed.

As we are based in Lithuania, our lead supervisory authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija). You can find their contact details on their website.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons.

We will notify you of any changes by posting the new Privacy Policy on this page. We will also update the "Last Updated" date at the top of this policy. For any significant changes, we will provide a more prominent notice, such as by sending you an email notification to the address associated with your account. You are advised to review this Privacy Policy periodically for any changes.