Legal

KREO Privacy Policy

This Privacy Policy applies to the KREO application and website operated by Moneyinteractive di Vio Diego (“Moneyinteractive”, “we”, “us”). It explains how we collect, use, store, share, and delete personal data, including Google user data obtained through Google APIs (Gmail / Google Workspace) when you connect a mailbox to KREO Posta.

Effective date: 26 October 2026 · Official URL: https://kreoquotes.com/privacy.html · Homepage: https://kreoquotes.com/ · App: https://app.kreoquotes.com/

Controller: Moneyinteractive di Vio Diego, Via Carlo Goldoni 13/4, 35049 Santa Caterina d'Este (PD), Italy · VAT IT05479510280 · [email protected]

1. What KREO is

KREO is a B2B SaaS product by Moneyinteractive for sales teams: customer files, quotes, timelines, integrations, and an email hub (“Posta”) with integrated webmail. Optional AI features help draft or summarize content when enabled by the customer. KREO is not an advertising product and is not directed to children.

2. Google user data — required disclosures

The following statements address Google’s App Privacy Policy requirements (support.google.com/cloud/answer/13806988): what Google user data KREO accesses; how KREO uses it; with whom it is shared; how it is protected; how long it is retained and how to delete it; and Limited Use / AI restrictions.

These practices apply only after a user or tenant administrator connects Gmail or Google Workspace via OAuth in Settings → Posta.

2.1 What Google user data is accessed by KREO

Our application, KREO, will access Google user data you authorize through Google OAuth, including:

• Your Google account email address and basic identity signals from openid / email scopes (to identify the connected mailbox).
• Gmail mailbox contents needed for Posta: email messages (headers and body), labels and folders as required by the product, and attachments when you use them in KREO.
• The ability to send email on your behalf from the connected mailbox.
• OAuth access tokens and refresh tokens used to keep the connection active without storing your Google password.

OAuth scopes requested by KREO: openid, email, https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.send, and https://mail.google.com/. The https://mail.google.com/ scope is required so KREO’s integrated webmail can authenticate to Gmail over IMAP/SMTP with XOAUTH2; Gmail API scopes alone do not enable IMAP.

We may collect, or process on behalf of our customers (tenants), the categories of personal data listed above when you use or interact with KREO Posta after connecting Google.

2.2 How KREO uses Google user data

We will use your Google user data to provide you with the services you requested in KREO, specifically the user-facing Posta features that are prominent in the product interface:

• synchronize and display email in KREO Posta and customer timelines;
• read, search, reply to, and compose messages;
• send email (including quote PDFs where the product supports it);
• open the connected mailbox in KREO’s integrated webmail;
• optionally generate AI drafts or summaries only when you or your tenant explicitly use AI features on that mail content.

We will not sell your Google user data to third parties. We may share it only with partners who help us provide our services, as described in section 2.3.

KREO does not use Google user data for: targeted advertising; selling to data brokers; providing data to information resellers; determining credit-worthiness; lending purposes; user / personalized / retargeted / interest-based advertisements; or creating advertising databases.

Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models. Any optional AI processing of mail content is limited to providing the personalized, user-requested feature in KREO (for example a draft reply the user asked for). We do not use Google user data to train generalized or non-personalized AI/ML models.

2.3 With whom we share, transfer, or disclose Google user data

We do not transfer or disclose your Google user information to third parties for purposes other than the ones provided in this Privacy Policy.

We may share or disclose Google user data only as follows:

• Infrastructure partners that host KREO (servers, databases, backups) strictly to provide or improve the KREO service;
• AI providers chosen by Moneyinteractive, only when you/your tenant use AI features on mail content (to generate the requested output);
• Other users in your tenant, according to roles configured by your administrator (company mailbox / shared timeline);
• Legal / security disclosures when required by law or to investigate abuse or security incidents;
• Corporate transaction (merger, acquisition, or sale of assets) only with the user’s explicit prior consent, as required by Google Limited Use.

We do not transfer Google user data to third parties for advertising, data brokerage, information resale, credit/lending, or training generalized AI/ML models.

2.4 Data protection mechanisms for Google user data

Security procedures are in place to protect the confidentiality of your Google user data. We use encryption to protect your information in transit (HTTPS/TLS). OAuth tokens and other secrets are stored with access controls on our servers. KREO enforces authentication, authorization, and tenant isolation so one customer organization cannot access another organization’s data. Access by Moneyinteractive personnel to mailbox content is restricted (see section 2.6).

2.5 Data retention and deletion

We store your personal information for a period of time that is consistent with our business purposes. We will retain your personal information for the length of time needed to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.

OAuth tokens are retained while your Google connection remains active in KREO. Synced message copies and related metadata are retained while needed for Posta, timeline, and legal/contractual duties of the tenant. When the data retention period expires for a given type of data, we will delete or destroy it (or anonymize it where deletion is not immediately feasible).

You may request for your data to be deleted by:

1. Disconnecting Google in KREO under Settings → Posta (tokens are revoked or removed; KREO stops accessing that mailbox); and/or
2. Revoking KREO in your Google Account under Security → Third-party access; and/or
3. Emailing [email protected] to request deletion of synced copies, your user account, or (via your tenant admin) the tenant workspace, subject to the customer contract and applicable law.

2.6 Human access to mailbox content

Moneyinteractive does not routinely read users’ Gmail content. Human access to Google user mailbox data occurs only: (a) with the user’s affirmative agreement for support on specific messages; (b) when necessary for security (investigating a bug or abuse); (c) when required to comply with law; or (d) when data are aggregated and used for internal operations in accordance with applicable privacy requirements.

2.7 Google API Services User Data Policy — Limited Use

KREO’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We limit use of Google user data to providing or improving user-facing features that are prominent in KREO’s interface. We require our employees, agents, contractors, and relevant sub-processors to comply with this policy.

3. Other personal data (non-Google)

Separately from Google OAuth, KREO processes account data (name, login email, roles), tenant company profile, CRM/quote content you enter, technical logs, and demo-request fields from kreoquotes.com (name, work email, company; optional phone/role/message) to operate the SaaS and respond to demo requests. Microsoft 365/Outlook connects use Graph and IMAP/SMTP OAuth scopes for the same Posta purposes; Google Limited Use does not apply to Microsoft data, but the same no-sale / no-ads / retention / deletion principles apply.

4. Cookies

KREO uses essential cookies and local/session storage for authentication, session, and UI preferences. We do not use third-party advertising cookies inside the application.

5. Your rights and contact

Depending on applicable law (including GDPR for EU users), you may request access, rectification, erasure, restriction, objection, or portability by emailing [email protected]. You may also contact the Italian Data Protection Authority (Garante). In-product legal documents are available in KREO under Settings → Legale e privacy, including a link to this Privacy Policy.

6. Changes

We may update this Privacy Policy. The effective date above shows the latest revision. If we change how KREO uses Google user data, we will update this page and notify users as required, including obtaining new consent where necessary before using Google user data in a new way.

Informativa privacy KREO (italiano)

Versione italiana della Privacy Policy di KREO, prodotto di Moneyinteractive di Vio Diego. Per i reviewer Google OAuth, la sezione inglese §2 sopra è la disclosure completa su access / use / share / protect / retain / delete e Limited Use. In caso di conflitto sui diritti GDPR degli interessati UE, prevalgono questa sezione italiana e la legge applicabile; sugli impegni Limited Use Google le due lingue dicono le stesse regole.

Ultima revisione: 26 ottobre 2026 · https://kreoquotes.com/privacy.html

Titolare

Moneyinteractive di Vio Diego, Via Carlo Goldoni 13/4 — 35049 Santa Caterina d'Este (PD), Italia. P.IVA 05479510280. Contatto: [email protected]. L’azienda cliente (tenant) determina finalità e mezzi sui propri contenuti operativi; Moneyinteractive li elabora per erogare il servizio.

Dati trattati

Account e tenant; anagrafiche, preventivi, note, allegati; log tecnici; form demo sul sito; e, se colleghi Google/Microsoft a Posta, i dati della casella descritti in §2 (inglese) / sotto.

Google — accesso, uso, condivisione, protezione

Se colleghi Gmail/Workspace in Impostazioni → Posta, KREO accede via OAuth a: email account, messaggi (intestazioni/corpo), etichette/cartelle necessarie, allegati usati nel prodotto, invio mail, token OAuth. Scope: openid, email, gmail.readonly, gmail.send, https://mail.google.com/ (necessario per webmail IMAP/SMTP).

Uso: solo funzioni Posta richieste (sync, lettura, risposta, composizione, webmail; AI opzionale solo se la chiedi). Non vendiamo i dati. Non li usiamo per ads, data broker, credit/lending. Non usiamo le Google Workspace API per sviluppare, migliorare o addestrare modelli AI/ML non personalizzati.

Condivisione: solo infrastruttura necessaria, provider AI se usi AI sulla posta, colleghi del tenant secondo ruoli, obblighi di legge/sicurezza, M&A con consenso esplicito. Non trasferiamo i dati a terzi per scopi diversi da quelli indicati.

Protezione: procedure di sicurezza per la riservatezza; cifratura in transito (HTTPS); controlli di accesso e isolamento tenant. Conservazione: per il tempo necessario alle finalità di questa informativa e agli obblighi di legge; allo scadere cancelliamo o distruggiamo (o anonimizziamo). Cancellazione: scollega in Impostazioni → Posta, revoca in Account Google, oppure scrivi a [email protected].

KREO’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft, AI, cookie, diritti

Microsoft: Graph + IMAP/SMTP OAuth per le stesse finalità Posta. AI: provider di terzi scelti da Moneyinteractive; non mettere segreti nei prompt. Cookie: tecnici/essenziali, niente ads nell’app. Diritti GDPR: [email protected]; reclamo al Garante. In app: Impostazioni → Legale e privacy.

Aggiornamenti

Possiamo aggiornare questa informativa. Se cambia l’uso dei dati utente Google, aggiorniamo questa pagina e, dove richiesto, chiediamo un nuovo consenso.