Privacy Policy

Effective date: 17 September 2026 Last updated: 17 September 2026

This Privacy Policy explains how Kepio collects, uses, stores and shares personal data when you visit kepio.eu or use the service.

Controller for account, website and commercial-relationship data: kepio.eu Perikleous 38C, 56224, Thessaloniki, Greece VAT number: EL135768757 Privacy contact: info@kepio.eu

1. Who this Policy applies to

This Policy applies to:

• visitors to public kepio.eu pages,
• people who create or use a Kepio account,
• owners, admins and team members of a company account,
• people who submit a beta application, feedback, lead form or support request,
• professional contacts involved in billing or subscriptions.

2. Our roles in processing

For account information, billing relationships, website analytics, support, security and our own operations, Kepio generally acts as a controller.

For personal data that a merchant uploads or connects solely so Kepio can analyse the merchant’s business, Kepio may act as a processor on the merchant’s behalf depending on the specific data flow.

When Kepio processes personal data on a merchant’s behalf as processor, the current Data Processing Agreement (DPA) is publicly available at /en/dpa and can be accepted by a company owner/admin before a new store connection.

3. Account data

We may process:

• user name and email,
• company membership and role,
• company or store details,
• password hash and authentication/security information,
• language and account preferences,
• acceptance records for Terms/Privacy,
• timestamps and status relating to onboarding and activation.

We do not store your password in plain text.

4. E-commerce business data

Depending on how you use the service, we may process:

• orders and order identifiers,
• products, SKU and product cost / COGS,
• gross/net revenue,
• discounts, refunds and return-related amounts,
• shipping / fulfilment costs,
• payment fees,
• ad spend and marketing metrics,
• store/channel performance,
• manual entries and CSV imports,
• operating/fixed costs and cost rules,
• calculated metrics such as Estimated Profit, Profit Margin and Data Quality.

A store connection is not mandatory. Manual or CSV data may be used where supported.

5. Integration credentials and tokens

When you enable a provider integration, we may process:

• OAuth access/refresh tokens,
• provider account IDs,
• selected advertising/store account IDs,
• sync state, freshness and error status,
• permissions/scopes required for the integration.

Stored integration credentials and tokens supported by Kepio are protected with application encryption before storage.

Do not send API secrets, passwords or provider credentials through support messages or chat when a secure field is available inside the application.

6. Billing and tax data

For subscriptions and invoicing we may process:

• billing name and billing email,
• legal/business name, country and VAT/tax identifiers,
• subscription plan/status,
• invoice/tax-document metadata,
• payment-provider customer/subscription identifiers,
• transaction status and reconciliation information.

When payment takes place in a hosted payment flow provided by a third party such as Stripe, full card details are provided to that payment provider and do not need to be stored by Kepio.

7. Lead forms, beta, feedback and support

We may collect:

• email,
• optional store URL,
• request or interest type,
• feedback message,
• beta application fields,
• support request information,
• optional marketing consent,
• source page and first-touch attribution context.

In the SEO Lead flow, email and optional store URL are stored in the separate lead record and are not copied into the anonymous SEO analytics event stream.

8. First-party website measurement

Kepio uses privacy-minimised first-party measurement to understand use of public pages and funnel progression.

The event stream may include:

• a random session visitor identifier,
• page/landing path,
• source/channel,
• locale,
• event type such as page_view, calculator_use, lead_submit or signup,
• limited non-personal metadata such as CTA placement.

The first-party analytics table does not store IP address or user agent.

We do not send email, name, token, secret, store URL or calculator financial values to this event stream.

First-party SEO analytics events are scheduled for periodic cleanup and may be retained for up to approximately 400 days under the current service configuration.

9. Google Analytics

On public pages we may use Google Analytics 4 only after you choose to accept analytics through the consent banner.

Under the current basic-consent implementation:

• the Google Analytics tag does not load before consent,
• analytics_storage becomes granted only after acceptance,
• ad_storage, ad_user_data and ad_personalization remain denied,
• Google Signals is disabled by the application,
• we do not send calculator financial inputs, lead email or store URL as GA4 event parameters.

According to Google’s documentation, Google Analytics may collect device/browser information, site activity and approximate geographic information. Google states that GA4 does not log or store IP addresses in Analytics.

Retention in Google Analytics depends on the retention settings configured for the relevant GA4 property.

10. Cookies and browser storage

We use cookies and similar technologies for session/security, storing your analytics-consent choice and, only after consent, Google Analytics.

See the Cookie Policy for details.

11. Why we use data

We use personal data where necessary to:

• create and manage accounts,
• provide dashboards, calculations, reports and integrations,
• operate billing and subscriptions,
• authenticate users and protect security,
• prevent abuse and troubleshoot technical problems,
• provide customer support and operational communications,
• analyse and improve the product,
• manage leads, beta applications and feedback,
• comply with legal, tax or accounting obligations,
• establish, exercise or defend legal claims.

12. Legal bases

Depending on the processing, we may rely on:

• performance of a contract or steps before entering a contract,
• compliance with a legal obligation,
• legitimate interests such as security, fraud prevention, support, service improvement and business operations, where those interests are not overridden by your rights,
• your consent, especially for Google Analytics cookies and optional marketing communications.

Where processing is based on consent, you can withdraw that consent for the future.

13. Operational and marketing communications

We may send operational emails that are necessary for your account or for a request you made, such as:

• email verification,
• password reset,
• security/operations notifications,
• billing/subscription notifications,
• a requested profitability checklist or acknowledgement,
• important service notices.

Where we ask for separate marketing consent, the choice is optional. If you opt in to product/content updates, you can withdraw at any time through the available unsubscribe/preference mechanism or by contacting info@kepio.eu.

14. Who receives data

We may share data only where necessary with:

• hosting/infrastructure providers,
• transactional email providers,
• payment/billing providers,
• Google for analytics only after consent and for Search Console/admin integrations where enabled,
• Meta or Google Ads APIs when a merchant enables the relevant integration,
• professional advisers or authorities where legally required,
• other processors/subprocessors required to operate the service.

See Subprocessors & Third-Party Services for more information.

We do not sell personal data to data brokers.

15. International data transfers

Some providers may process data outside the EEA.

Where required, the safeguards available under applicable law and the relevant provider’s contractual framework are used, such as adequacy decisions or Standard Contractual Clauses.

The exact mechanism may vary by provider and service.

16. Data retention

We keep data only for as long as reasonably necessary for the purpose for which it was collected unless a longer period is legally required.

Examples:

• account/company data: while the account is active and for a reasonable period afterwards where needed for support, security, disputes or legal obligations,
• billing/tax records: for the period required by applicable tax/accounting rules,
• integration tokens: until disconnect, revocation, account deletion or when no longer required,
• first-party SEO analytics events: up to approximately 400 days under the current cleanup policy, managed through the restricted retention registry,
• GA4 data: according to the Google Analytics property retention setting,
• leads/beta/feedback: according to the documented retention policy configured for the relevant dataset; production retention periods must be reviewed before automatic cleanup is enabled.

Backups and security logs may follow different, limited retention cycles.

17. Security

We use measures designed to protect confidentiality, integrity and availability, including:

• HTTPS,
• password hashing,
• prepared database statements,
• CSRF protections,
• role/access controls,
• encryption of stored provider credentials/tokens where supported,
• operational logging and health/error monitoring.

No measure can eliminate all risk.

18. Your rights

Depending on applicable law, you may have rights to:

• information and access,
• correction,
• deletion,
• restriction,
• portability,
• object to certain processing,
• withdraw consent,
• complain to a competent supervisory authority.

We may need to verify your identity before responding to a request.

Some information may need to be retained where a legal obligation or other lawful basis allows retention.

19. Privacy controls inside Kepio

The Privacy Center provides, where available:

• an immediate JSON personal-account export without passwords, API keys, OAuth tokens or other secrets; owners/admins can also export company/merchant data for the active company,
• current DPA status and acceptance by a company owner/admin,
• workflows for access, rectification, restriction, objection and deletion requests,
• request history and status.

Privacy requests are recorded with a response target aligned to applicable legal deadlines. Deletion is not automatic where it may affect other company users or where lawful retention is required for billing/tax, security, disputes or backups.

You can also contact info@kepio.eu for an additional privacy request.

20. Children’s data

Kepio is a business service and is not directed to children.

We do not knowingly seek to collect children’s personal data through the service.

21. Changes to this Policy

We may update this Policy when the service, providers, law or processing practices change.

The latest update date is shown on this page. Material changes may be communicated separately.

22. Contact and complaints

Controller: kepio.eu Perikleous 38C, 56224, Thessaloniki, Greece VAT number: EL135768757

Privacy contact: info@kepio.eu

Because Kepio is established in Greece, you may in particular contact the Hellenic Data Protection Authority (HDPA): https://www.dpa.gr/en/individuals/complaint-to-the-hellenic-dpa. Depending on your circumstances, another competent EEA supervisory authority may also be available.