Privacy Policy

This policy explains what personal data Krutio collects, why, who helps us process it and what rights you have under the GDPR (EU Regulation 2016/679). The controller of your data is Krutio. Contact: contact@krutio.com or +40 746 913 532.

What we collect

• Account: your e-mail address, name and password (stored only as a secure hash by our login provider).
• Your business settings: your market, niche, store address, the competitors you follow and your preferences.
• Your Shopify store (only if you connect it): the store address, the access credentials (kept encrypted with AES-256-GCM), and the store information needed to write pages (product fields, existing products, store language).
• How you use Krutio: actions you take, results you record, credits used, and technical logs needed to run, secure and bill the service.
• Offer requests: the name, e-mail, store and message you send through the "Request an offer" form, and your IP address (to stop spam).
• Technical data: IP address, browser type and the cookies strictly needed to keep you signed in. See the Cookie Policy.

We do not collect payment card data, and we do not buy personal data from others.

Why we use it

• To provide the service you signed up for: your account, research, pages, store connection and support (performance of a contract).
• To keep Krutio secure, prevent abuse and fix problems (legitimate interest).
• To answer your offer request and your messages (steps before a contract / legitimate interest).
• To keep accounting and legal records when required (legal obligation).

We do not sell your data. We don't send marketing e-mails without your consent.

AI processing

To write pages and analyse products, we send product information and the text you give us to an AI provider (Anthropic). We do not send your password or Shopify credentials. Product scores are recommendations only: they do not produce legal effects or decisions about you.

Who helps us

We use trusted providers that process data only on our instructions, under data-processing agreements:

• Vercel – hosting of the website and application (United States).
• Supabase – database and login (data stored in the European Union, Ireland).
• Anthropic – AI processing of product and page text (United States).
• Resend – sending e-mails such as replies to offer requests (European Union region).
• Shopify – only if you connect your store, to create draft products in it.
• ScrapeCreators – lookups in public ad libraries; we send search terms, not your personal data.

Transfers outside the EU

Some providers are based in the United States. When your data leaves the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses and, where available, the EU–US Data Privacy Framework.

How long we keep it

• Account and business data: while your account is active. After you ask us to delete it, we delete it within 30 days (backups are overwritten within a further 30 days).
• Offer requests: up to 24 months, unless they become a contract.
• Usage and security logs: up to 24 months.
• Accounting records: as long as the law requires.

Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw any consent you gave. To use these rights, write to contact@krutio.com from the e-mail address of your account. We answer within one month.

You also have the right to complain to the data protection authority of the EU country where you live or work, or to the Romanian authority, ANSPDCP (www.dataprotection.ro), where Krutio is established.

Security

Data travels over encrypted connections (HTTPS). Shopify credentials are stored encrypted, access to data is limited to what each part of the service needs, and administrative access is logged.

Children

Krutio is for businesses and is not intended for anyone under 18.

Changes

If we change this policy in an important way, we will tell you by e-mail or in the app.