Kreskio Privacy Policy
What data Kreskio collects, for what purpose, whom we share it with, how long we keep it and what rights you have.
Who is the data controller
This is a translation for information. The Polish version of this document is binding.
The controller of the data of Kreskio users is Marcin Maj, Słowiańska 24 43-180 Orzesze (unregistered business activity – działalność nierejestrowana – under Polish law). Contact for personal data matters: admin@kreskio.pl.
If you send a report through the “Report a bug” button on someone else’s website, the controller of your data is the owner of that website (e.g. the agency that builds it). Kreskio processes the data on the owner’s behalf – details below.
Data of account users
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, password (stored as an encrypted hash), profile picture | Creating and maintaining the account, signing in | Contract (Art. 6(1)(b) GDPR) |
| Buyer details from the order (name, company, address, tax ID (NIP), e-mail) | Handling payments and issuing the bill | Contract and legal obligations (Art. 6(1)(b) and (c) GDPR) |
| IP address, data about sign-ins and administrative actions | Security of the account and the service, detecting abuse | Legitimate interest (Art. 6(1)(f) GDPR) |
| Content of correspondence | Answering questions and complaints | Legitimate interest (Art. 6(1)(f) GDPR) |
Data collected by the widget on websites
When someone clicks “Report a bug” on a website with the Kreskio widget and sends a report, we collect: the reporter’s name and e-mail, the description, a screenshot with marks or a screen recording (with sound, if the reporter turned on the microphone), the page address, technical browser data (e.g. version, operating system, window size) and the page’s most recent console messages and network requests.
- We process this data on behalf of the website owner (a Kreskio customer), under the data processing agreement contained in the Terms of Service. Please direct questions about this data to the website owner first.
- On screenshots, fields with passwords and card data are covered automatically. In addresses and logs we remove values that look like passwords and tokens.
- Screen recording and the microphone work only after the reporter explicitly turns them on, and the browser always asks for permission.
- Dictating the description uses the speech recognition built into the browser; in Chrome the audio is processed by Google. Dictation is optional – the description can be typed.
Applications for the pilot
On the kreskio.pl/pilotaz page, agencies apply for the Kreskio pilot programme. We store the e-mail, company name, team size, the platform the websites are built on (if provided), the campaign the link came from, and the moment consent was given. The legal basis is consent to be contacted about the pilot (Art. 6(1)(a) GDPR) – we do not send a newsletter or other offers to this address.
- Consent can be withdrawn at any time by writing to us – we then delete the application.
- An application we did not accept into the pilot is deleted automatically after 12 months.
- After acceptance into the pilot, further cooperation takes place on the terms of a Kreskio account.
Chrome extension
- The extension takes a screenshot or recording of a tab only when you click “Report a bug” or “Record this tab”. It does not track the pages you visit or your browsing history.
- Screenshots, recordings, the page address and title, and technical browser data are sent only to your workspace in Kreskio.
- The Kreskio sign-in key is stored in the extension’s storage on your computer. A recording waits locally until it is sent or cancelled, or for at most 24 hours.
- The microphone is used only while recording, if you turn it on.
- Data from the extension is not sold, is not used for advertising or for creditworthiness assessments, and is not used for any purpose other than running Kreskio.
AI assistants
Kreskio itself does not use AI and does not send reports to providers of AI tools. However, an account user may connect an AI coding tool of their own choice (e.g. Claude Code or Cursor) to help them fix the reported bugs.
- The “Copy for AI” button copies the report content only to the clipboard on the user’s computer. Kreskio sends nothing when doing so.
- In Settings → AI assistants, the user can create a key. A tool connected with it retrieves reports from the workspaces the user belongs to: the description, page address, technical browser data, console and network logs, comments and the screenshot. A key with “Also allow changes” ticked also allows adding comments, changing the status and priority, setting a due date and assigning reports on the user’s behalf. We mark such changes as made by an AI assistant.
- Data reaches the AI tool at the user’s instruction, and the tool’s provider (e.g. Anthropic or Anysphere) is not our processor. The user is responsible for choosing the tool, and whether the team may use such tools with reporters’ data is decided by the workspace owner as the controller of that data.
- A key is valid for 90 days and can be deleted at any time – the tool loses access immediately. We store the key’s name, the date it was created and the date it was last used.
Whom we share data with
- DigitalOcean, LLC – the provider of the servers on which Kreskio runs and data is stored (data centre in the European Union).
- Zoho Corporation – the provider of the e-mail service through which we send notifications, links to reports and bills (data centre in the European Union).
- Members of the team of the workspace the report was sent to and – if the workspace owner has set them up – the tools to which it sends reports (e.g. via a webhook to Slack).
- AI tools that an account user has connected themselves with their own key (see the “AI assistants” section above).
- Public authorities, where required by law.
We do not sell data. Data is stored in data centres in the European Union. DigitalOcean is based in the USA and Zoho in India, so in exceptional situations (e.g. during technical support) their staff outside the European Economic Area may have access to the data. Such transfers take place on the basis of data processing agreements concluded with these providers and standard contractual clauses approved by the European Commission (Art. 46 GDPR), and in the case of DigitalOcean also on the basis of the EU-U.S. Data Privacy Framework.
How long we keep data
- Account data – until the account is deleted. Together with the account we delete the workspaces you own, with their projects, reports and files.
- Reports, screenshots and recordings – until they are deleted by the workspace team, or until the workspace or project is deleted. A deleted report is permanently erased after 30 days.
- Console logs and network requests attached to reports – 90 days from when the report was sent.
- Unfinished file uploads (e.g. when the reporter closes the page before sending) – deleted automatically within 24 hours.
- Webhook delivery log – 30 days.
- AI assistant keys – until deleted by the user, at most 90 days from creation.
- Orders and bills – for the period required by tax law (as a rule, 5 years from the end of the year), also after the account is deleted.
- Log of administrative actions – for the period needed to ensure security.
Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. Write to admin@kreskio.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).
Security
- Connections are encrypted (HTTPS).
- Report files are not publicly accessible – only people with access to the report can open them.
- We store passwords as encrypted hashes and integration secrets in encrypted form.
- An account can be further secured with two-factor authentication (2FA) or a passkey.
Changes to the privacy policy
We will inform you of significant changes by e-mail and on this page. The current version is always available at this address.