In short
- We only use your data to run and improve Creya, send your alerts and prevent abuse. We sell nothing.
- Is your name in annual accounts? Then we show only your name, role and since when, from the latest accounts. You can always object.
- Your data is stored in the EU (Frankfurt). A few services we use are in the US, with the legal safeguards.
- You can download your data and delete your account in your settings. For anything else: email us.
1.Who is responsible
The controller is Tijl Cresens, trading as T-labs. For any privacy question: info@creya.be. We have no data protection officer (DPO): we are not required to. The founders handle your question themselves.
- Operator
- Tijl Cresens, trading as T-labs (sole trader)
- Address
- Korte Vorenstraat 3, 3900 Pelt, Belgium
- Enterprise number
- 0805.477.211
- VAT
- BE 0805.477.211, small business under the VAT exemption scheme
- info@creya.be
- Phone
- +32 483 65 89 46
2.Who this is about
- Users: anyone with an account.
- Visitors: anyone visiting the website without logging in.
- People in annual accounts: directors, managers, auditors and permanent representatives, and sole traders in the Crossroads Bank for Enterprises (KBO).
- Email recipients, such as someone invited by a colleague or by us.
3.If you have an account
| What for | Which data | Legal basis |
|---|---|---|
| Your account and logging in | Email address, password (only stored encrypted), name, language. If you log in with Google: that account's name, email address and profile picture. | Contract |
| Running Creya | Your organisation, members and invitations, followed companies (sole traders too, until you unfollow them or delete your account), your own company, notifications, preferences, shared links. If you import a customer list, the file stays on your computer: only the company numbers, and the names of rows without a number, reach us, and we keep only what you follow. | Contract |
| Service emails: logging in, alerts, monthly summary, your trial, payments and withdrawal, changed terms | Email address, name, the companies you follow. | Contract |
| Payments and invoices, if you buy a plan | Name, email address, billing address, your VAT number if you give it, your plan, payments, invoices and credit notes. Your card or bank details go straight to Stripe: we never see them. | Contract; keeping invoices is a legal obligation |
| Asking for feedback, without selling anything | Email address, name. | Legitimate interest; unsubscribe in every email |
| Tips, news and offers from Creya | Email address, name, your consent with date and text version. | Consent; withdraw any time in your settings |
| Security and preventing abuse | IP address and browser of your sessions, which companies you opened and when, counters for person search. | Legitimate interest |
| Knowing how people find us | The first page and the link that brought you to Creya (for example an ad or a search engine), and which button on our website you used to create your account. | Legitimate interest |
| Improving Creya | When you use Creya, which tools you open, searches that find nothing, whether you click in our emails, when you reach a limit or the payment page, and your answer if you reply to a short question in the app. Never for advertising and never sold. | Legitimate interest; you can switch it off at any time in your settings (Privacy & data), without any effect on your limits |
| Proof of what you accepted | Which version of the terms and which consents, with the date. | Legitimate interest |
A "Why" text in an alert is sometimes written by AI. For that we only send the company's figures, never data about you.
We take no decisions about you based solely on automated processing. Our verdicts are about companies, not people.
4.If you visit the website
Our hosting partner Vercel keeps technical logs (IP address, requested page, browser) to run the website and stop attacks. They are erased after 1 day. Legal basis: legitimate interest.
Statistics, only with your consent
If you turn on Statistics in the cookie choice, we measure how visitors use Creya, to improve it: which pages you view, where you click and where you get stuck. We also record your visit. In those recordings input fields are hidden, as are your settings, followed companies, notifications, search results and your name in the menu. We send page addresses without names, company numbers or search terms. If you're logged in, we link this to a random code of your account, never to your name or email address. We also remember for 30 days which link brought you to Creya, in case you create an account.
We use PostHog and Vercel Web Analytics for this, never for advertising. PostHog keeps it for 1 month. If you delete your account, we also erase you at PostHog. Legal basis: your consent. You can withdraw it at any time through "Cookie settings" at the bottom of every page. We use no advertising cookies. All cookies are on the cookie page.
If you send us a privacy request or report a mistake, we keep what you fill in (your name and email address if you give them, your message, the company and the page) to handle it. Legal basis: a legal obligation for privacy requests, legitimate interest (correct data) for mistake reports. To limit abuse we keep an unreadable code of your IP address for 1 day, never the address itself.
5.Is your name in annual accounts?
Companies must publish their annual accounts at the National Bank, including who runs them. The law requires this so that anyone doing business with a company can see who is behind it. Creya shows that information for the same purpose.
What we show
- Your name, your role (for example manager or auditor), since when, and the company. For a registered auditor also the IBR number.
- Only from the company's latest annual accounts. No older mandates, no address, no date of birth.
- If you are a sole trader, we show your business's data from the KBO: name, establishment address, activity and status.
Where it comes from
From the annual accounts at the National Bank of Belgium and from the Crossroads Bank for Enterprises.
Why we may do this
Based on our legitimate interest and that of our users: businesses want to know who they deal with, especially before giving credit. We weighed that against your interests and therefore limit what we do:
- There are no person pages and your name is not a link to a profile.
- Searching for a person needs an account, has a limit and has no export.
- Directors of a company that has stopped and whose latest annual accounts are more than 5 years old can no longer be found through person search.
- We never use this data to contact you or for marketing.
For how long
As long as you are in the company's latest annual accounts. If new accounts come without you, your name disappears from that company.
Objecting or having something corrected
Fill in our privacy request, or email us at info@creya.be with your name and the company. If something is wrong, we correct it. If you no longer want to be shown, we review your request and answer within one month. If your objection is justified, we stop showing your name at that company and you can no longer be found through person search. We only ask for proof of identity if we doubt the request comes from you.
6.Who receives your data
We don't sell personal data and don't share it with advertisers. These providers process data on our behalf, under a data processing agreement:
| Service | What for | Where | Transfer outside the EU |
|---|---|---|---|
| Supabase | Database and login | Frankfurt (EU); support may be from the US or Singapore | Standard contractual clauses |
| Vercel | Hosting the website and app; visitor statistics (Web Analytics), only with your consent | Servers in Frankfurt; network worldwide; company in the US | EU-US Data Privacy Framework and standard contractual clauses |
| PostHog | Visitor statistics and recordings of visits, only with your consent | Stored in Germany (EU); network worldwide; company in the US | EU-US Data Privacy Framework and standard contractual clauses |
| Resend | Sending emails | Sent from Ireland; data about emails in the US | EU-US Data Privacy Framework and standard contractual clauses |
| GitHub | Our daily jobs that process public annual accounts and KBO data | US | EU-US Data Privacy Framework and standard contractual clauses |
| Anthropic (Ireland) | AI explanations in alerts; receives only company figures, no data about you | EU company; processing may be outside the EU | Standard contractual clauses |
| Stripe (Ireland) | Payments, subscriptions, invoices and credit notes, if you buy a plan | EU company; processing also in the US | EU-US Data Privacy Framework and standard contractual clauses |
| Billit (Ghent) | Sending invoices and credit notes over Peppol | Belgium; in principle within the EEA | Only through their own subcontractors, with appropriate safeguards |
If you log in with Google, Google processes your data for that login under its own privacy policy.
Stripe is also responsible itself for what it does to prevent fraud and to meet legal duties, such as anti-money-laundering checks. Stripe's privacy policy applies to that.
7.How long we keep data
| Data | Kept |
|---|---|
| Your account, organisation, followed companies, preferences and consents | Until you delete your account |
| An account nobody logged into for 3 years | Deleted; we warn you by email 30 days ahead |
| Which companies you opened and when | 24 months, and deleted with your account |
| How you use Creya (to improve Creya) | 24 months, and deleted with your account; the text of a search that found nothing 90 days |
| Notifications in the app | 90 days |
| An invitation for someone who doesn't have an account yet | 90 days after the last email, or until we withdraw it |
| Technical logs at Vercel | 1 day |
| Statistics and recordings at PostHog (with your consent) | 1 month; if you delete your account, there too |
| Cookie with the link that brought you to Creya | 30 days |
| Invoices and credit notes, with the data on them | 7 years from 1 January after the year of the invoice, as accounting and VAT law require |
| Your privacy requests and our answer | 3 years after our answer, as proof we handled them |
| Mistakes you report to us | 1 year after we handled them |
| An unreadable code of your IP address, when you send a form | 1 day |
After that period we erase the data automatically.
8.Your rights
You have the right to:
- see your data and get a copy;
- have wrong data corrected;
- have your data erased;
- have processing restricted;
- object to processing based on legitimate interest;
- take your data with you in a common format;
- withdraw a consent at any time.
Much of this you can do yourself in your settings: download your data, change your emails and delete your account. For anything else, use our privacy request or email us at info@creya.be. We answer within one month.
If you are not satisfied, you can file a complaint with the Belgian Data Protection Authority (its complaint page is in Dutch, French and German), Drukpersstraat 35, 1000 Brussel, contact@apd-gba.be, +32 2 274 48 00.
9.Security
- All connections to Creya are encrypted (HTTPS).
- Passwords are never stored readable, only as an encrypted hash.
- The database shows each user only their own data. Only the founders have administrator access.
- If something does go wrong with personal data, we report it to the Data Protection Authority within 72 hours and, if the risk is high, to you as well.
10.Changes
If we change this policy, the new date is at the top. We tell you about important changes by email before they take effect.