Kreedl - Privacy Policy

Kreedl is an AI building manager for residential and facility management ("Kreedl"). On behalf of property managers, facility teams, building operators and developers ("Customers"), it answers phone calls, WhatsApp, SMS and email from tenants, residents, store managers, facility users and vendors, and arranges repairs, viewings and other requests. Kreedl is operated by KREEDL.

If you are a Customer or a Customer's employee - KREEDL is the data controller for your account, contact, billing, usage and marketing data. This policy governs that data.

If you are a tenant, resident, facility user, prospective tenant or buyer, vendor or any other person contacting a building that Kreedl serves - the data controller is the Customer (your building operator, landlord, property owner or real-estate agent with whom you enter into a contractual relationship). KREEDL is only a processor and acts solely on the Customer's documented instructions, under the Data Processing Agreement available at kreedl.com/dpa. To exercise your rights under section 12, contact your building operator, or write to [email protected] and we will forward your request and help resolve it.

In the case above, the duty to inform you under Articles 12, 13 and 14 GDPR rests with the Customer. Has the Customer not informed you about the processing of your personal data or your related rights? Contact us at [email protected].

If you visit kreedl.com - KREEDL is the controller for website, cookie and analytics data (section 11).

Each Customer chooses one of three operating modes. The mode determines what Kreedl stores.

Mode A - No personal records. Kreedl answers general questions (house rules, opening hours, how to report a fault) and does not have access to any tenant or facility-user records. It stores only the communication itself - call recordings, transcripts, messages and the phone number or email address of the person contacting it.

Mode B - Access without storage. Kreedl reads data in the Customer's own system (property management software, ticketing tool, CRM) at the moment of a request, for example to confirm which unit a caller lives in or which vendor covers a site. It does not copy those records into its own database. It stores the communication itself - recordings, transcripts, messages, the contact number or email, and whatever the person says or writes during the conversation, which may include details about their tenancy.

Mode C - Kreedl stores records. The Customer uploads or syncs tenant, unit, contract and vendor records to Kreedl so the assistant can act on them. Kreedl keeps them for no longer than the term of the contract, together with the communication data as in modes A and B.

Which mode applies to your building is set by your building operator, landlord or property owner. If you are not sure, ask that person. Has the data controller not informed you about the transfer of your data or the mode in which it is handled within the Kreedl service, or do you believe there is no legal basis for this processing? Contact us at [email protected].

4.1 Customer data (KREEDL as controller)

• Name, work email, phone number, job title, company and billing details
• Account settings, escalation rules, vendor lists and site configuration
• Support and sales communication with us
• Usage and technical data - device, browser, IP address, timestamps, actions in the platform

4.2 Tenant, resident, facility-user, applicant and vendor data (KREEDL as processor)

Depending on the mode chosen by the Customer, this may include -

• Identity and contact data - name, surname, phone number, email address
• Tenancy and unit data - building, flat or unit number, move-in and move-out dates, rent amount, tenancy conditions, lease documents, deposit and payment status, overdue amounts and payment reminders (only where the Customer instructs us to handle payment matters)
• Request data - fault reports, photos, voice notes, viewing requests, access questions and everything else said or written during the conversation
• Prospective tenant and buyer data - expected move-in date, household size, employment, income, method of financing and references, where the Customer requires them to assess the application
• Vendor data - name, company, phone, email, contracts and service areas of technicians and suppliers
• Communication data - call recordings, transcripts, summaries, WhatsApp, SMS and email content, timestamps and metadata
• Public-source information - see section 4.4

Czech national identification number (rodné číslo). Kreedl does not require it. In exceptional cases, and only when the Customer instructs us to verify a caller's identity, Kreedl may compare the four digits after the slash of the national identification number provided by the caller against the Customer's records. Kreedl does not store the full number. The Customer is responsible for compliance with Section 13c of Act No. 133/2000 Coll. where it provides this number.

4.3 What we do not collect

• Door codes, key safe codes, alarm codes or other physical access credentials. Kreedl does not store or send these. If a Customer needs them communicated, it does so outside Kreedl.
• Special-category data (health, religion, ethnic origin, sexual orientation, political opinions) unless a person volunteers it in a conversation. Such data is not extracted into structured records and is deleted together with the recording or transcript.
• Payment card numbers. Card payments by Customers are handled by Stripe.

4.4 Information from public sources

Where a Customer instructs us, Kreedl may collect and summarise publicly available information about a prospective tenant, such as public social-media profiles, public registers and other openly accessible websites, to support the Customer's decision on a tenancy application. In that case -

• The Customer is the controller and its legal basis is legitimate interest (Article 6(1)(f) GDPR).
• You will be informed of the source of the data, the purpose and your rights no later than at first contact, in line with Article 14 GDPR.
• You may object to this processing at any time (see section 12).
• The output is a recommendation only. Kreedl never decides whether a tenancy is concluded. See section 5.

4.5 Why we process data and on what legal basis

For the data listed in section 4.2, the Customer as controller determines both the purpose and the legal basis of processing. KREEDL processes it solely for those purposes and on the Customer's instructions. The Customer typically processes your data as follows -

• Tenants, residents and facility users - handling your request (reporting a fault, booking a technician, arranging a viewing, answering a question) and passing it on to the Customer or, where relevant, a vendor. The legal basis is the performance of a lease or other contract (Article 6(1)(b) GDPR) and the Customer's legitimate interest in the proper management and operation of the property (Article 6(1)(f) GDPR).
• Prospective tenants and buyers - handling your enquiry, arranging a viewing and summarising your answers for the Customer as a basis for assessing the application. The legal basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and the Customer's legitimate interest in assessing the application (Article 6(1)(f) GDPR).
• Call recordings, transcripts and summaries - a record of what was agreed, so that both the Customer and you can verify it afterwards, and quality control of the service. The legal basis is the Customer's legitimate interest in evidencing the content of the communication and in quality control (Article 6(1)(f) GDPR).
• Vendors and technicians - passing on the job and arranging access. The legal basis is the performance of the contract between the vendor and the Customer (Article 6(1)(b) GDPR); for the vendor's employees and contractors, the Customer's legitimate interest in getting the repair done (Article 6(1)(f) GDPR).
• Public-source information - see section 4.4.

This processing is not based on your consent, and we therefore do not ask for it. Should the Customer request your consent for a specific purpose, it will inform you in advance and you may withdraw consent at any time. You may object to processing based on legitimate interest (section 12).

4.6 Do you have to provide the data?

Providing the data the assistant asks for is neither a statutory nor a contractual requirement, and you are not obliged to share it. Without some of the data, however, it may not be possible to handle your request (for example to report a fault or arrange a viewing) or to assess your application for a tenancy or purchase.

Kreedl uses AI models to understand requests, answer, triage, book appointments, dispatch vendors within limits the Customer sets, and where instructed, rank applicants or summarise public-source information.

• All rankings, scores and recommendations are decision support only. The final decision on any tenancy, viewing, termination, payment or access rests with the Customer and its staff. Kreedl does not make solely automated decisions with legal or similarly significant effects. Recommendations are based on criteria set by the Customer (for example move-in date, income or references), never on special-category data or other protected characteristics such as origin, religion or health.
• The Customer sets the boundaries of what Kreedl may do on its own (for example which service vendors Kreedl may dispatch and up to what value of work). Anything outside those limits is escalated to a person. Details are in our Terms of Service.
• You have the right to obtain human intervention, to express your point of view and to contest any recommendation that affects you. Contact your building operator or [email protected].
• Every action the assistant takes is logged and auditable by the Customer.
• We do not train AI models on your data. Neither Customer data nor tenant, resident or facility-user data is used to train or fine-tune any AI model, ours or a provider's.
• On automated decision-making under Article 22 GDPR, see section 12 below.

Every conversation with Kreedl starts with a disclosure -

• Phone - at the start of every call, inbound or outbound, the assistant states that it is an AI assistant acting for the named building operator, that the call is recorded and transcribed, and that you may ask for a person at any time. On outbound calls it also states the business purpose of the call.
• WhatsApp and SMS - the first message of every conversation states that you are messaging an AI assistant for the named building operator, that messages are processed and stored, and how to reach a person.
• Email - every email identifies the sender as a Kreedl AI assistant acting for the named building operator.

Disclosure is not conditional on local law. We do it everywhere.

We share data only as needed to run the service. We never sell personal data.

Mobile phone numbers and SMS opt-in status are used only to provide the messaging service and are never sold or shared with third parties or affiliates for marketing purposes.

Your building operator (the Customer). All communication and request data is available to the Customer whose building you contacted.

Vendors and technicians. To arrange a repair, Kreedl passes the vendor the details needed to do the job - building, unit, description of the fault, photos, and a contact number if access must be arranged.

Processors (subprocessors). We use these providers under data-processing agreements -

• AI models - Anthropic (Claude), OpenAI, Google Cloud (Gemini)
• Voice - ElevenLabs (speech), Twilio and DIDWW (telephony and SMS)
• Messaging - Meta (WhatsApp Business Platform), Slack
• Hosting and data - Amazon Web Services, Google Cloud Platform, Railway, MongoDB Atlas
• Analytics and consent - PostHog, Cookiebot, LinkedIn (advertising measurement, website only)
• Business tools - Stripe (billing), Google Calendar, Notion

Should any other third party become a subprocessor of KREEDL, we will update this list and notify Customers of the change in advance in accordance with the Data Processing Agreement.

Legal requirements. We disclose data on processors and other recipients where required by law or a competent authority.

Kreedl can run entirely on EU infrastructure or with AI processing in the United States. The Customer chooses; unless the Customer requests an EU-only configuration in writing, AI processing and telephony may also take place outside the EEA. Where any provider processes data outside the EEA or the UK, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified). Ask your building operator which configuration applies to your building.

When a Customer contract ends, we export all tenant, resident and facility-user data to the Customer and delete it within 30 days. Encrypted backups are purged within 90 days. Where a person asks for deletion earlier, we carry it out on the instruction of the Customer as controller; for data controlled by KREEDL, we delete sooner unless a legal obligation prevents it.

Access to data subjects' personal data is role-based and limited to staff who need it to run the service, and every access and every assistant action is logged. Provider credentials and API keys are stored in a secrets manager and never exposed to users. We test and review our controls regularly. In the event of a personal data breach we notify affected Customers without undue delay, and no later than 48 hours after becoming aware of it. Notification of the supervisory authority and of data subjects is made by the party designated in the Data Processing Agreement; for data controlled by KREEDL, KREEDL makes the notification where the law requires.

The controller and the processor have undertaken in the Data Processing Agreement to implement technical procedures that take into account the need to protect personal data.

kreedl.com uses Cookiebot to manage consent. On your first visit you can accept or reject non-essential cookies, and you can change your choice at any time at kreedl.com/cookies.

• Necessary - sign-in, security and consent storage. Always on.
• Statistics - PostHog product analytics and session recording (mouse movements, clicks, page content; passwords and payment fields are masked). Only with your consent.
• Marketing - LinkedIn Insight Tag for measuring advertising. Only with your consent.

The full list of cookies, updated automatically by Cookiebot, is at kreedl.com/cookies.

Under the GDPR you have -

• the right of access and to information about your personal data, including a copy of the recording or transcript of your call;
• the right to rectification;
• the right to erasure ("right to be forgotten");
• the right to restriction of processing;
• the right to data portability;
• the right to withdraw consent to the processing of personal data;
• the right not to be subject to automated processing, unless an exception under Article 22(2)(a) to (c) GDPR applies;
• the right to object to processing; and
• the right to lodge a complaint about the processing of personal data.

Right to object. Where your data is processed on the basis of legitimate interest (section 4.5), in particular the recording of calls and the collection of information from public sources (section 4.4), you may object to that processing at any time on grounds relating to your particular situation. The controller will then no longer process your data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or unless it needs the data for the establishment, exercise or defence of legal claims.

To exercise your rights, contact us at [email protected]. To verify your identity it is usually enough to write to us from the same phone number or email address you used to contact us. For data controlled by KREEDL, we respond without undue delay and no later than within one month. If your data is controlled by a building operator, we forward your request to them within 3 working days and help them respond. You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or, where that authority has jurisdiction over you, in the United Kingdom with the Information Commissioner's Office (ico.org.uk).

The service is not intended for children as independent users, but a minor may communicate with it when contacting a building. We process the data only to the extent necessary for the specific request and on the controller's instructions. A request from a parent or legal guardian for access or erasure is forwarded to the controller, who assesses the requester's authority, the child's interests and the statutory conditions.

We may update this policy. Material changes will be announced to Customers by email at least 14 days in advance and reflected by a new effective date.

KREEDL s.r.o., Záhřebská 562/41, Vinohrady, 120 00 Praha 2, Czech Republic

[email protected]