Privacy Policy

1. Who We Are

Kretell is an AI-powered Voice Intelligence Platform operated by TCUS LLC dba Kretell, a company incorporated in Texas, United States, headquartered at 5511 Parkcrest Dr, Suite 103, Austin, TX 78731, United States.

For privacy matters, all users including those in the EU and UK may contact us at support@kretell.com.

2. Data We Collect

We collect the following categories of personal data:

Account Data

Name, email address, password (stored in hashed form and never readable by Kretell staff), and profile information provided during registration.

LinkedIn Content You Upload

LinkedIn posts you voluntarily upload to build your voice profile. This content is used exclusively to refine and improve your personal Voice Profile over time. We do not access your LinkedIn account directly — all uploads are manual.

LinkedIn Marketing API Analytics (OAuth)

If you connect your LinkedIn account via OAuth, Kretell accesses your LinkedIn post performance data (impressions, likes, comments, shares) through LinkedIn's Marketing API. This requires your explicit authorisation via LinkedIn's OAuth 2.0 flow. You can revoke this access at any time from your Kretell account settings or directly from your LinkedIn account's app permissions page.

We store analytics metrics (impression counts, engagement totals) for up to one year in accordance with LinkedIn's data storage requirements. We do not store the text content of your LinkedIn posts retrieved via the API. Analytics data is displayed exclusively to you and is never shared with third parties, used for advertising, or used to train AI models. Upon revoking LinkedIn OAuth access or deleting your account, all LinkedIn API-sourced analytics data will be deleted within 30 days.

Kretell does not store or retain profile data of third-party LinkedIn members (for example, users who comment on your posts). Any such data encountered incidentally via the API is not persisted beyond the immediate API response.

Voice Profile Data

Derived data from your uploaded posts — writing patterns, tone markers, structural preferences — stored as your Voice Profile (up to 99 voice markers). This is the core of Kretell's personalisation. Voice Profile data is yours and is not used for general model training or shared with third parties for that purpose. This constitutes profiling of your writing behaviour under GDPR. You may request deletion of your Voice Profile at any time by contacting support@kretell.com, without deleting your entire account.

Usage Data

How you interact with the platform — features used, content generated, content quality scores (platform-generated ratings used to improve suggestion relevance), session duration. Used to improve the product and your experience.

Payment Data

Billing is handled entirely by Polar.sh, our third-party payment processor acting as Merchant of Record. We do not store credit card numbers or full payment details. We receive only transaction confirmation and subscription status. Polar.sh operates under a Data Processing Agreement with Kretell and complies with PCI-DSS standards.

Device and Technical Data

IP address, browser type, operating system, and approximate geographic location (country level). Used for geo-based pricing and security purposes. Your IP address is transmitted to ipapi.co solely to determine your country for geo-based pricing. This only occurs when you choose “Accept All” on our cookie consent banner. It is not stored by Kretell or retained by ipapi.co beyond the duration of the lookup.

Cookie Data

Session tokens and preference data stored in browser cookies. Used to maintain your logged-in session. See Section 10 for full cookie details.

3. How We Use Your Data

We use your data to:

• Provide and operate the Kretell platform
• Generate content that matches your authentic writing voice
• Refine and improve your personal Voice Profile over time
• Process payments and manage subscriptions via our payment processor
• Send transactional emails (account confirmation, password reset) via Resend
• Detect and prevent fraud, abuse, and security threats
• Display geo-appropriate pricing based on your country
• Comply with legal obligations

4. Legal Basis for Processing

Where required by applicable law, we process your personal data on the following legal bases:

5. Data Storage and Security

Your data is stored on Supabase (PostgreSQL), hosted on AWS infrastructure with servers in the United States. We implement the following security measures:

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• Row-level security on all database tables
• Periodic security reviews and vulnerability assessments
• Access controls limiting employee data access

6. Third-Party Services

We work with the following trusted third parties. We only share the minimum data necessary for each service to function. Each third party operates under their own privacy policy and applicable data processing agreements (DPAs) with Kretell:

We do not engage advertising networks, data brokers, or social media tracking pixels.

7. Your Rights

Depending on your location, you have the following rights regarding your personal data:

Universal Rights (All Users)

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and all associated data
• Portability — receive your data in a machine-readable format
• Withdrawal — withdraw consent at any time where processing is consent-based

EEA / UK Users (GDPR / UK GDPR)

• Objection — object to processing based on legitimate interests
• Restriction — request we restrict processing in certain circumstances
• Complaint — lodge a complaint with your local supervisory authority (e.g., ICO in the UK, your national DPA in the EU) if unsatisfied with our response. A full list of EEA supervisory authorities is available at edpb.europa.eu

California Users (CCPA / CPRA)

• Right to know what categories and specific pieces of personal information are collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — Kretell does not sell or share personal information for advertising purposes. See Section 13 for the formal disclosure.
• Right to non-discrimination for exercising your rights

India Users (DPDPA 2023)

• Right to access information about personal data being processed
• Right to correct and update inaccurate personal data
• Right to erasure of personal data no longer necessary for the stated purpose
• Right to grievance redressal — contact support@kretell.com
• Right to nominate a person to exercise rights in the event of death or incapacity

All Other Users: Users in other jurisdictions may have additional rights under local law. Contact support@kretell.com to enquire about rights applicable in your country.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we permanently delete your personal data and Voice Profile within 30 days, except where retention is required by law (e.g., billing records for tax purposes, retained for up to 7 years depending on jurisdiction). Anonymised, aggregated usage statistics may be retained indefinitely as they cannot identify you.

For LinkedIn Marketing API data specifically: analytics metrics (impressions, engagement counts) are retained for a maximum of one year from the date of collection, in accordance with LinkedIn's data storage requirements. Post content retrieved via the LinkedIn API is not stored. Authenticated LinkedIn member profile data (name, profile picture) is retained for the duration of your account as permitted by LinkedIn's terms. Upon revocation of LinkedIn OAuth access, all LinkedIn-sourced analytics data is deleted within 30 days.

9. International Data Transfers

Kretell's primary infrastructure is located in the United States. If you access Kretell from outside the United States, your data will be transferred to and processed in the United States.

EEA / UK Users

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK International Data Transfer Addendum, to lawfully transfer personal data to the United States and other third countries.

All Other Users

For users in all other jurisdictions, we ensure appropriate safeguards are in place for international data transfers in accordance with applicable local law. Where local law requires explicit consent for cross-border transfers, that consent is obtained at account creation. We will update our transfer mechanisms as regulations in each jurisdiction evolve.

10. Cookies and Local Storage

We use the following types of storage technologies:

Essential Cookies

Required for login and core platform functionality. These cannot be disabled without impacting your ability to use Kretell. They include session authentication tokens.

Preference Cookies

Used to remember settings like your preferred language, region, or display preferences. You may clear these without losing access.

We do not use advertising, tracking, or cross-site cookies. We do not deploy third-party tracking pixels or beacons. For EEA and UK users, non-essential cookies will only be set following your explicit consent. When you first visit kretell.com or app.kretell.com, a banner presents three options: Accept All (enables analytics and personalisation cookies, activates region detection), Essential Only (strictly necessary cookies only, no region detection), or Decline (strictly necessary cookies only, no region detection). Your choice is stored for one year.

11. Children's Privacy

Kretell is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not use Kretell or provide any personal information.

If you believe someone under 18 has provided us with personal data, contact us at support@kretell.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the 'Last Updated' date at the top of this Policy
• Send an email notification to the address associated with your account
• For significant changes that expand how we use your data: obtain fresh, explicit consent before applying the change to existing users

We will never retroactively apply changes to permit broader data use without clear notice and, where required, explicit consent. Continued use of Kretell after minor changes constitutes acceptance of the updated policy.

13. Do Not Sell or Share My Personal Information (CCPA / CPRA)

Kretell does not sell personal information. Kretell does not share personal information for cross-context behavioral advertising. This section is included for legal completeness under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

California residents who wish to confirm this or submit a related request may contact us at support@kretell.com.

14. India — DPDPA 2023 Specific Disclosures

Kretell processes personal data of Indian users in compliance with the Digital Personal Data Protection Act, 2023. We collect and process data only for the lawful purposes described in this policy, with your consent obtained clearly at account creation.

You have the right to withdraw consent at any time. Withdrawal of consent will result in deletion of your account and associated data within 30 days. For grievances, contact support@kretell.com. We will respond within the timeframe prescribed by DPDPA implementing rules once notified.

15. Contact Us and How to Lodge a Complaint

For any privacy-related questions, requests, or complaints:

Supervisory Authority Escalation

If you are not satisfied with our response to a privacy complaint, you have the right to escalate to the relevant supervisory authority in your jurisdiction:

• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• European Union: Your national data protection authority — edpb.europa.eu/about-edpb/board/members_en
• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca
• Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
• South Korea: Personal Information Protection Commission (PIPC) — pipc.go.kr
• Japan: Personal Information Protection Commission — ppc.go.jp
• India: As designated by the Indian government under the DPDPA 2023
• South Africa: Information Regulator — inforegulator.org.za

For users in other jurisdictions, please contact your national data protection authority. A global directory is available at globalprivacyassembly.org.