Privacy policy

Last updated: 21 September 2026

This policy is written in plain language. We will still have it checked before we call it final, but it already gives an honest picture of how we handle data.

Who is responsible

Krillo (Dutch Chamber of Commerce number 78439620), Gerard Doustraat 22-3V, 1072 VW Amsterdam, the Netherlands, is responsible for the processing described in this policy. Questions? Email hello@krilloai.com.

What data we process

When you use the free check:

The website address you enter.
The content of the pages we scan. That is about the website itself, but such a page can also contain personal data, for example contact details that are on it. We only use that to run the check.

When you run a free visibility test:

Your email address, because you receive the result by email.
The store you had tested, and the outcome of that test.
Whether you ticked that we may send you something later, and when. Without that tick you get this one result and nothing else.
Where you came from on the site, for example a campaign label in the link or the domain of the previous page. No IP address and no cookie.

When you came through a partner's or customer's link:

The code in that link, stored with the store address you check, for 60 days. If that store takes a paid plan, the person who shared the link gets a reward, and they see the store's name in their overview. No cookie; nothing about you as a person.

When you follow the rank of a store:

Your email address and the store. First we send one email to confirm; without your click nothing else follows. After that, an email when the rank changes, with a link to stop in each one.

When you join the waiting list for your country:

Your email address, your store address if you give it, and the country. We use them for one email: when the Krillo Index starts measuring your country. After that email we keep nothing else from the waiting list for marketing.

When you apply as a partner:

Your name or company, email address, website and message, to review your request and pay you. We keep them as long as you are a partner, and afterwards as long as the tax rules require for payments.

When you take out a subscription:

Your email address, and a company name if you fill one in for your invoice.
Payment data is processed by our payment provider Mollie, or by Shopify if you subscribe through our Shopify app. We do not see or store card or bank details ourselves.
Whether you agreed to the terms and to starting right away, and when. We are legally required to be able to show this.
The buying questions for your category, and the full answers the AI models give to them.
What we take from those answers: which stores are named, whether you are among them, and in which place. This is about stores and products, not about people.

When you simply visit the website:

Which page you opened, when, where you came from, and whether you used a phone, tablet or computer.
To count how many different people visit, we make a code of sixteen characters. It is calculated from your IP address, your browser name, today's date and a key of ours. We do not store the IP address itself, nothing can be traced back from the code, and tomorrow the same visitor produces a different code.
Nothing is placed on your device for this and no other party is involved. We do not use Google Analytics or anything similar.
Basic technical data such as IP address and browser type is handled by our hosting to keep the website working and secure.

Stores in the public index:

The index names online stores and their web addresses, taken from the answers of AI assistants and from public sources. That is data about businesses.
To tell a store about its place in the index, we may email the general address the store publishes on its own website, such as info@ or contact@. We never use an address with a person's name in it. Every such email has an unsubscribe link, and after unsubscribing we do not email that address again.

What we use data for

To run the check and the measurements and show you the results.
To process payments.
To keep you informed about your subscription, for example when your place in the ranking changes.
To measure whether AI assistants name your store when shoppers ask buying questions, and to store and assess those answers.

We do not use your data for advertising and we do not sell data to anyone.

On what basis we may do this

The GDPR asks us to state for each processing why it is allowed. For Krillo:

Performance of the contract: running the check, delivering your subscription and processing payments.
Legal obligation: keeping invoices and payment data for the tax authorities, and being able to show consents.
Legitimate interest: keeping the website working, preventing abuse, improving the service, publishing the index and telling stores about their place in it.
Consent: only for the tick at the free visibility test with which you say we may send you something later. You can withdraw it at any time through the unsubscribe link or by email.

How long we keep data

Invoices and payment data: seven years, the Dutch tax retention period.
Recorded consents: seven years, so we can show what you agreed to.
Scan results and reports: as long as you are a customer, and twelve months after that so you can still reach them.
Results of a free check and the free visibility test: twelve months. If you ticked that we may send you something later, we keep your address until you unsubscribe.
Free results are deleted automatically once their twelve months are up. Reports of former customers we still delete by hand, because when a subscription ended is known to our payment providers and not to us. Want your data gone sooner, email us and we delete it within fourteen days.
Measurements with AI assistants: the questions, the answers and what we take from them are kept for the index. They are about stores and products, not about people.

Sharing with other parties

We only share data with parties we need to deliver the service:

Render: hosting of the website and the application.
Neon: the database where your reports and data are stored.
Brevo: sending emails, such as your report and your invoice, and receiving your replies to them.
ImprovMX: forwarding email sent to our addresses to our inbox.
Mollie: processing payments on krilloai.com.
Shopify: if you use our Shopify app, Shopify handles the installation and the payment, and passes us the data of your store that the app needs.
Google Fonts: our pages load fonts from Google. Google sees the IP address of your browser. Nothing else goes there.
Anthropic: to write the buying questions and the texts and to assess AI answers, the content of the scanned pages is processed. That already happens with the free check.
OpenAI and Google: for the free visibility test and for the index we ask buying questions to ChatGPT and Gemini to measure which stores are named. The question goes to these parties, for example "which Dutch online store sells good enamel tableware", without the name of the store we measure. To read which stores an answer names, we send that answer to Anthropic or OpenAI. No customer data goes to any of them.
Brave Search: to find outside pages where your competitors are listed and you are not, we send search queries to the Brave search engine. These are the same kind of bare search terms, based on what you sell. No customer data goes there. If the service is set to Google instead of Brave, those same queries go to Google.

We have agreements with these parties about protecting data. Some of them process data outside the European Economic Area. For that, the standard safeguards set by the European Commission apply.

When we work in your store

If you choose Fix, you give us access to the admin of your store. In some systems, for example WooCommerce, an admin account can also see orders and customer data. We do not need that data and we do not use it: we do not look at it, we do not copy anything from it and we do not store any of it. Where possible we ask for the smallest role the work allows.

For that data we are the processor and you are the controller. If you want a data processing agreement, email hello@krilloai.com and we will send one.

The access is yours. You can withdraw it at any time without giving a reason. Once we are done, feel free to have the account removed. The keys you give us are stored encrypted. With Shopify we work with a key that has to be refreshed; if we do not use it for ninety days, our access ends by itself.

Your rights

You have the right to see, correct or have your data deleted. Email hello@krilloai.com for that. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

The website only uses cookies that are technically needed for it to work.

Our visitor count uses none. It counts the pages that are viewed and recognises a visitor by a code that changes every day and reveals nothing about them. Nothing is placed on your device to follow you, and that is why there is no cookie banner on this site.

Within one visit we do remember in your browser through which link you came in, for example ?utm_source=newsletter. That is one word, it is not linked to who you are, and it disappears as soon as you close the tab. We use it to see which places bring visitors. We do not follow you across visits and we share this with nobody.

Changes

We may change this policy. The latest version is always on this page.