Privacy Policy

1. Who We Are

Kretell is a LinkedIn content generation platform operated by TCUS LLC dba Kretell, a company incorporated in Texas, United States, headquartered at 2126 English Ivy Rd, Frisco, Texas 75033, United States. For privacy matters, all users including those in the EU and UK may contact us at privacy@kretell.com.

2. Data We Collect

We collect the following categories of personal data:

• Account Data: Name, email address, hashed password, and profile information provided during registration.
• LinkedIn Content You Upload: LinkedIn posts you voluntarily upload to build your voice profile. Used exclusively to refine your personal Voice Profile. We do not access your LinkedIn account directly — all uploads are manual.
• LinkedIn Post Analytics (Chrome/Edge Extension Only): If you install our browser extension, it automatically reads post performance data (impressions, likes, comments, and shares) visible on your LinkedIn feed. This data belongs to you and is used solely to display your analytics. We do not share it or use it to build general-purpose models. The extension reads only data already visible to you. It does not access private messages, connection data, or profile information of other users.
• Voice Profile Data: Derived data from your uploaded posts — writing patterns, tone markers, structural preferences — stored as your Voice Profile (up to 97 markers). Voice Profile data is yours and is not used for general model training or shared with third parties for that purpose.
• Usage Data: How you interact with the platform — features used, content generated, quality scores, session duration. Used to improve the product and your experience.
• Payment Data: Billing is handled entirely by our third-party payment processor, who acts as Merchant of Record. We do not store credit card numbers or full payment details. We receive only transaction confirmation and subscription status. The identity of our payment processor will be updated in this policy once finalised.
• Device and Technical Data: IP address, browser type, operating system, and approximate geographic location (country level). Used for geo-based pricing and security.
• Cookie and Extension Storage Data: Session tokens and preference data stored in browser cookies or extension local storage. See Section 10 for full details.

3. How We Use Your Data

We use your data to: provide and operate the Kretell platform; generate content that matches your authentic writing voice; refine and improve your personal Voice Profile over time; process payments and manage subscriptions; send transactional emails via Resend; detect and prevent fraud, abuse, and security threats; display geo-appropriate pricing; comply with legal obligations.

4. Legal Basis for Processing

Where required by applicable law, we process your personal data on the following legal bases: Contractual necessity (to provide the service you signed up for); Legitimate interests (security, fraud prevention, product improvement); Legal obligation (compliance with applicable laws); Consent (where explicitly required, e.g. non-essential cookies for EEA/UK users).

5. Data Storage and Security

Your data is stored on Supabase (PostgreSQL), hosted on AWS infrastructure in the United States. Security measures include: encryption in transit (TLS 1.2+); encryption at rest (AES-256); row-level security on all database tables; regular security audits; access controls limiting employee data access.

6. Third-Party Services

We work with trusted third parties and share only the minimum data necessary for each service. Each operates under their own privacy policy and applicable data processing agreements (DPAs) with Kretell. We do not engage advertising networks, data brokers, or social media tracking pixels.

7. Your Rights

Depending on your location, you have the following rights:

Universal Rights (All Users)

Access; Correction; Deletion; Portability; Withdrawal of consent.

EEA / UK Users (GDPR / UK GDPR)

Objection to processing; Restriction of processing; Right to lodge a complaint with your local supervisory authority (e.g., ICO in the UK — ico.org.uk; your national DPA in the EU — edpb.europa.eu).

California Users (CCPA / CPRA)

Right to know; Right to delete; Right to correct; Right to opt out of sale or sharing (Kretell does not sell or share personal information for advertising — see Section 13); Right to non-discrimination.

India Users (DPDPA 2023)

Right to access; Right to correct; Right to erasure; Right to grievance redressal at privacy@kretell.com; Right to nominate a person to exercise rights in event of death or incapacity.

All other users may have additional rights under local law. Contact privacy@kretell.com.

8. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, personal data and Voice Profile are permanently deleted within 30 days, except where retention is required by law (e.g., billing records for tax purposes, up to 7 years depending on jurisdiction). Anonymised, aggregated usage statistics may be retained indefinitely.

9. International Data Transfers

Kretell's primary infrastructure is located in the United States. EEA/UK users: we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum. All other users: appropriate safeguards are in place in accordance with applicable local law.

10. Cookies and Extension Storage

• Essential Cookies: Required for login and core functionality. Cannot be disabled.
• Preference Cookies: Remember settings like language, region, display preferences. Can be cleared without losing access.
• Browser Extension Storage: The Kretell Chrome/Edge extension uses browser local storage for session and preferences. Data stays on your device. You may clear it via browser extension management settings. The extension does not execute remotely hosted code.

We do not use advertising, tracking, or cross-site cookies, or third-party tracking pixels. For EEA and UK users, non-essential cookies require explicit consent via cookie consent banner.

11. Children's Privacy

Kretell is not directed at individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided personal data, contact privacy@kretell.com and we will delete it promptly.

12. Changes to This Policy

We may update this policy periodically. For material changes we will: update the Last Updated date; send email notification; obtain fresh explicit consent for changes that expand data use. Continued use after minor changes constitutes acceptance.

13. Do Not Sell or Share My Personal Information (CCPA / CPRA)

Kretell does not sell personal information. Kretell does not share personal information for cross-context behavioral advertising. California residents may confirm this or submit requests at privacy@kretell.com.

14. India — DPDPA 2023 Specific Disclosures

Kretell processes personal data of Indian users in compliance with the Digital Personal Data Protection Act, 2023. We collect and process data only for lawful purposes described in this policy, with consent obtained at account creation. You may withdraw consent at any time, resulting in account and data deletion within 30 days. For grievances contact privacy@kretell.com.

15. Contact Us and How to Lodge a Complaint

Contact: privacy@kretell.com | TCUS LLC dba Kretell | 2126 English Ivy Rd, Frisco, Texas 75033, United States.

Supervisory Authority Escalation (if unsatisfied with our response):

• United Kingdom: ICO — ico.org.uk
• European Union: edpb.europa.eu/about-edpb/board/members_en
• Australia: OAIC — oaic.gov.au
• Canada: priv.gc.ca
• Singapore: pdpc.gov.sg
• South Korea: pipc.go.kr
• Japan: ppc.go.jp
• India: As designated under DPDPA 2023
• Global directory: globalprivacyassembly.org