Effective date: July 10, 2026
Krinova is a boutique growth agency specialising in performance marketing and e-commerce strategy for consumer health, beauty, and wellness brands. This policy explains what data we collect, why we collect it, and how we use it, across both our agency website (krinova.agency) and our proprietary analytics platform, KrinovaTracking, which integrates with Meta Ads, Google Ads, and Shopify to provide performance reporting to our clients.
1. Who We Are
Krinova operates under the domain krinova.agency. For the purposes of data protection law, Krinova acts as the data controller for information collected through our website, and as a data processor for advertising and transactional data we access on behalf of our clients through their connected platforms.
2. Data We Collect
We collect data in two contexts: through our public website, and through our analytics platform on behalf of clients.
- Contact information (name, email address, company name) collected via contact forms and discovery calls.
- Ad performance data (campaign spend, impressions, ROAS, conversions) retrieved via Meta Ads API and Google Ads API, with explicit client authorisation.
- E-commerce data (order revenue, customer counts, product performance) retrieved via Shopify API, with explicit client authorisation.
- Aggregated attribution data (UTM parameters, click identifiers such as fbclid and gclid, channel attribution) collected via client storefronts.
- Usage data (pages visited, browser type, referring URL) collected via our website server logs and analytics.
- Credential data (OAuth tokens, API keys) provided by clients during platform onboarding and stored encrypted at rest.
We do not intentionally collect sensitive personal data. Individual end-customer data from client stores is processed only in aggregate or pseudonymised form. We store hashed email identifiers, never plain-text customer emails.
3. How We Use Your Data
- To deliver our services: analysing ad performance, calculating P&L metrics, and providing reporting dashboards. Legal basis: contract performance.
- To respond to enquiries: replying to contact form submissions and booking requests. Legal basis: legitimate interest.
- To improve our platform: understanding feature usage and identifying errors. Legal basis: legitimate interest.
- To comply with legal obligations: retaining records as required by applicable law. Legal basis: legal obligation.
- To send service communications: onboarding instructions, platform updates, and critical notices. Legal basis: contract performance.
We do not use client advertising or e-commerce data for our own marketing purposes, nor do we train machine learning models on client data.
4. Third-Party Services
Our platform integrates with the following services on behalf of clients. Each integration requires explicit authorisation from the client account holder.
- Meta (Facebook) Ads API for retrieving campaign spend, impressions, and reported conversion data.
- Google Ads API for retrieving campaign performance data and attributed spend.
- Shopify for retrieving order, revenue, and customer cohort data.
- Railway cloud hosting provider for our backend application and database infrastructure.
Each integration is governed by that provider's own terms of service and privacy policy in addition to this document.
5. Data Sharing
We do not sell personal data. We do not share client data with third parties for their own marketing purposes. Data may be disclosed in the following limited circumstances:
- Service providers: companies that help us deliver our platform, under confidentiality agreements.
- Legal requirements: when required by law, court order, or governmental authority.
- Business transfers: in the event of a merger or acquisition, with prior notice to affected parties.
Each client's data is logically isolated within our multi-tenant platform. No client can access another client's data.
6. Data Retention
- Active client data: retained for the duration of the service agreement plus 12 months.
- Aggregated reporting data: may be retained in anonymised form beyond the above period for benchmarking.
- Contact enquiries: retained for 24 months from the date of last contact.
- API credentials: deleted within 30 days of contract termination or upon client request.
7. Security
- All data is transmitted over TLS-encrypted connections.
- API credentials and OAuth tokens are encrypted at rest.
- Customer email addresses are stored as SHA-256 hashes, never in plain text.
- Access to production systems is restricted by role, with JWT-based authentication.
- IP addresses captured for attribution are truncated to the /24 subnet before storage.
No method of transmission over the internet is 100% secure. We commit to prompt notification in the event of a confirmed breach affecting personal data.
8. Cookies & Tracking
Our public website (krinova.agency) may use:
- Strictly necessary cookies: required for the website to function and cannot be disabled.
- Analytics cookies: help us understand site usage and are set only with your consent.
Our analytics platform (KrinovaTracking) uses a lightweight tracking script that may set a first-party cookie on client storefronts to support attribution. This script captures page view events and click identifiers (fbclid, gclid) to measure ad-driven traffic. The data is processed solely to generate attribution reports for the store operator, not for cross-site profiling or advertising.
You can manage cookie preferences through your browser settings at any time.
9. Your Rights
If you are located in the European Economic Area, United Kingdom, or another jurisdiction with applicable data protection law, you have the following rights:
- Right to Access: request a copy of the personal data we hold about you.
- Right to Rectification: ask us to correct inaccurate or incomplete data.
- Right to Erasure: request deletion of your data, subject to legal retention requirements.
- Right to Portability: receive your data in a structured, machine-readable format.
- Right to Object: object to processing based on legitimate interests.
- Right to Restriction: ask us to limit how we process your data in certain circumstances.
To exercise any of these rights, contact us at the address below. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
10. International Transfers
Our platform infrastructure is hosted in the European Union. Where data is transferred to third-party providers outside the EEA (such as Meta or Google), we rely on Standard Contractual Clauses or equivalent approved frameworks.
11. Changes to This Policy
We may update this policy as our services or legal obligations evolve. When we make material changes, we will update the effective date at the top of this page and notify active clients by email where appropriate.
12. Contact
For any questions about this policy, to exercise your data rights, or to report a privacy concern:
Krinova
Website: krinova.agency
Email: privacy@krinova.agency
We aim to respond to all privacy-related enquiries within 5 business days.
© 2026 Krinova