Privacy Policy
Last updated: October 2026
Also available in German.
This policy explains how KREISO handles your personal data on all our websites and apps.
1. Who we are
KREISO is run by Nikita Konstantinovskiy, Görresstraße 11, 80798 Munich, Germany, support@kreiso.app.
Data Protection Officer: dpo@kreiso.app
2. What we collect
- Account: such as phone number, email address and sign-in data from providers like Google or Apple.
- Profile: such as name, date of birth, gender, country of origin, languages, city, photos, a short description, questionnaire answers, preferences, and the language and time zone we use for you.
- What you share: such as messages, voice and video messages, reactions, photos, locations you choose to share, reviews, reports and blocks.
- Purchases: such as tickets, payments and payment references. Card details are handled by our payment provider.
- Usage and device data: such as how you use KREISO, device and browser details, device, cookie and advertising IDs, IP address, approximate location and crash reports.
- From others: such as a member who invites you, sign-in providers, app stores and advertising partners (for example, which ad brought you to us).
You need an account and a profile to use KREISO; everything else is optional. Country of origin and languages are not sensitive data under Art. 9 GDPR.
3. Why we use it, and how long we keep it
| Purpose | Legal basis | How long |
|---|---|---|
| Running KREISO: your account, matching and groups, events, tickets, chats and support | Contract (Art. 6(1)(b) GDPR) | While your account exists; after you delete it, up to 12 months for safety and legal claims |
| Payments and accounting | Contract and legal duty (Art. 6(1)(b), (c) GDPR) | Up to 10 years (§ 147 AO, § 257 HGB) |
| Messages about your account, groups and events, including new events you can join | Contract (Art. 6(1)(b) GDPR) | While your account exists |
| News about similar events, if you bought tickets | Legitimate interest (Art. 6(1)(f) GDPR, § 7(3) UWG); unsubscribe with the link in every message | Until you unsubscribe |
| Other promotional messages | Consent (Art. 6(1)(a) GDPR) | Until you withdraw consent |
| Safety, moderation, preventing abuse and fraud | Legitimate interest in a safe service (Art. 6(1)(f) GDPR); legal duty where it applies (Art. 6(1)(c) GDPR) | Up to 6 years; banned accounts as long as needed to stop them returning |
| Improving KREISO, including matching, our models, app analytics and crash reports | Legitimate interest in a service that works (Art. 6(1)(f) GDPR) | Reviews and matching signals while your account exists, then anonymised; diagnostics up to 12 months |
| AI features, including Boris (section 5) | Contract, or legitimate interest in running KREISO efficiently (Art. 6(1)(b), (f) GDPR) | As long as the data they use |
| Analytics and advertising with our partners (section 4) | Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) | Up to 26 months |
| Legal claims and proof of consent | Legal duty and legitimate interest (Art. 6(1)(c), (f) GDPR) | Until claims expire, normally 3 years from the end of the year the claim arose |
| Waitlist and sign-ups without an account | Contract (Art. 6(1)(b) GDPR) | Until you unsubscribe, or 36 months without contact |
Messages you sent stay in the conversation for the other members after you delete your account. When you edit or delete a message, copies can remain, such as on other members' devices, in backups, in reports and with our support team. After these periods we delete or anonymise data, unless the law requires us to keep it longer.
4. Analytics and advertising
With your consent, we work with Google, Meta and TikTok to see how KREISO is used and to measure, improve and target our ads, on our websites and in our apps. They receive what you do on KREISO, such as pages you visit, meetups you open, checkouts and purchases, and data that lets them recognise you, such as your hashed email address and phone number, device and advertising IDs and IP address. This happens through their tools on our websites and in our apps, or directly from our servers. We measure whether our emails are opened and their links clicked, with your consent where the law requires it.
We and each partner are joint controllers for advertising (Art. 26 GDPR): we ask for your consent and send the data; the partner is responsible for what it does with it afterwards, under its own privacy policy. You can exercise your rights with us or with the partner.
You can withdraw your consent at any time where you gave it, or by writing to dpo@kreiso.app. Partner cookies last up to 2 years. Strictly necessary cookies and storage (sign-in, language, security, fraud checks when you pay) need no consent (§ 25(2) TDDDG).
5. Artificial intelligence
Boris, the assistant in KREISO, is an AI assistant. We use AI to run and improve KREISO, for example for Boris, support, messages, forming groups and moderation. AI providers such as OpenAI, Anthropic and Google process data for this on our behalf.
Groups are formed automatically. This is not a decision with legal or similarly significant effects on you (Art. 22 GDPR); there is no entitlement to a particular group.
6. Who receives your data
- Other members see your profile, such as your first name, photos, age and country of origin, and what you share with them. In chats, they also see your activity, such as when you have read or played their messages.
- Service providers working for us, such as for hosting, payments, email, SMS and AI.
- Our advertising partners Google, Meta and TikTok (section 4).
- Authorities and advisers, where the law requires it or to defend legal claims.
- A buyer or successor, if KREISO is sold or restructured.
Some of them are outside the EU, such as in the US or, for TikTok, China. These transfers rest on EU adequacy decisions, including the EU-U.S. Data Privacy Framework, or on standard contractual clauses (Art. 45, 46 GDPR). Ask us for a copy.
7. Security
We protect your data with appropriate technical and organisational measures. No system is completely secure; if you find a vulnerability, tell us at support@kreiso.app.
8. Your rights
You can:
- get access to your data
- have it corrected or deleted
- restrict how it is used
- take it with you (data portability)
- withdraw consent at any time
Your right to object (Art. 21 GDPR). Where we rely on legitimate interest, you can object at any time on grounds relating to your situation. You can object to direct marketing at any time, without giving reasons.
Write to dpo@kreiso.app; we reply within one month. You can delete your account in the app under Settings or at kreiso.app/delete-account.
You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, https://www.lda.bayern.de.
9. Age
KREISO is for people aged 16 and over; we don't knowingly collect data from anyone younger. Some events are 18+.
10. Changes
We may update this policy. The version published here applies.