Privacy Policy

This Privacy Policy applies to kruq.ai (the public landing page) and app.kruq.ai (the product, activating once the founding cohort is full — around July–August 2026).

“We”, “us”, “our”, and “Kruq” refer to the operator of this service.

You’re reading version 1.1-draft. We update the “Last updated” date at the top whenever this policy changes materially, and notify active account holders by email for substantive changes.

As of the date above, the matchmaking product has not yet activated. The current site lets you submit an application, complete the 10-question onboarding chat, and pay the $50 access fee. Active matching — agent-to-agent dialogue, AI Judge ranking, mutual-interest identity reveals, paid introductions — begins once the cohort is full and balanced, around July–August 2026.

Until then, your application data sits in our database awaiting cohort opening. You can withdraw and request a full refund at any time per our Terms.

We collect different categories of information depending on where you are in the funnel.

When you apply at app.kruq.ai:

• Authentication identifier from Google OAuth or an email-and-password login
• Full text of your answers to the 10-question onboarding chat — covering intent, hard filters, self-awareness, values, lifestyle, and communication style
• 3–5 photos uploaded by you
• Height (optional)
• Location, looked up via the Google Geolocation API or entered manually. We convert it into an H3 hexagonal grid cell at resolution 8 (~0.7 km² per cell). Exact latitude and longitude are never written to our database.
• Device, browser, language preference, auto-detected

When you pay the $50 access fee:

• Card details are entered on a Stripe-hosted checkout operated by our payment partner, not on our domain. We never see or store your card number.
• From the payment webhook we receive: order ID, billing email, billing city/country, payment status, and any refund status.
• The charge on your card statement may appear under our payment partner’s merchant name rather than “Kruq”.

When matching activates (around July–August 2026 onward):

• Which candidates have been shown to you and your interest decisions
• Follow-up questions you ask your AI agent about candidates
• Internal dialogue logs from the two AI agents discussing your compatibility with each candidate, plus the AI Judge’s written explanation
• When mutual interest is unlocked, both users’ identities are revealed to each other

When you browse the site:

• Standard server logs (IP, user agent, requested URL, timestamp)
• Mixpanel analytics cookie set on .kruq.ai cross-subdomain, tracking page views, button clicks, scroll depth, funnel-progression events, time spent per onboarding question, drop-off points, and UTM parameters

We do not collect: government identifiers (passport, SSN, driver’s license); card numbers or full bank details; exact GPS coordinates (only the H3 hex cell); or special-category data beyond what you voluntarily share in onboarding (e.g., therapy history). When you do share it, the GDPR lawful basis is set out in section 13.

We use what we collect for these specific purposes:

• Running the founding-cohort application and matching service
• Generating, ranking, and explaining introductions via our matching system
• Sending you product email (cohort updates, match notifications, refund confirmations)
• Processing the $50 access fee and any pay-per-match charges
• Detecting fraud and platform abuse (fake profiles, scraping, payment fraud)
• Diagnosing bugs and improving the product
• Complying with US tax law and law-enforcement orders we are legally bound to honor

We do not: sell your personal data to anyone; share your application content with advertisers; train, fine-tune, or distill any AI model on your identifiable data; or use your data for purposes you have not been told about.

Kruq is an AI matchmaker. Several things follow from that:

• Your onboarding answers are parsed by large language models (LLMs) into a structured profile (intent, deal-breakers, values, etc.) stored in our database.
• When matching activates, two LLM-driven agents — one trained on your profile, one on each candidate’s — hold a private text dialogue evaluating compatibility. A third “Judge” model reads that dialogue and produces the ranking and written explanation you see.
• This is automated decision-making within the meaning of GDPR Article 22. The match rankings you see are produced by software without a human in the loop.

The LLM providers we currently use are Perplexity (for the public Ask Kruq chat on kruq.ai), OpenAI, and Anthropic (for the matching pipeline). We may add or substitute providers; we will update this policy when we do.

LLM providers may temporarily retain inputs per their own data-processing terms (typically 30 days or fewer). We do not opt in to any provider’s training program, and we send inputs with abuse-monitoring opt-outs where the provider supports them.

Your rights regarding AI-driven decisions:

• Human review — request that Vlad personally re-rank or re-explain any match. Email contact@kruq.ai with the match ID.
• Correct the AI’s understanding — open the chat with your AI agent and update any field. Changes propagate to future matching calls.
• Opt out of automated matching — withdraw from the cohort at any time. Result: a refund per our Terms.

We rely on a small number of vendors. Each acts as a data processor under our instructions; their own privacy policies also apply to data we send them.

• Stripe, via our payment partner — payment processing, refund processing.

• Google — OAuth login, geolocation lookup, font delivery (Google Fonts may receive your IP as part of standard browser requests)
• Mixpanel — product analytics
• Perplexity, OpenAI, Anthropic — LLM inference for AI agents, AI Judge, and the public Ask Kruq chat
• Email-delivery vendor (e.g., Resend or Postmark) — transactional and notification email (the specific provider will be named here once finalized)

We do not sell or share your data with advertising networks, data brokers, or any party not listed above.

Our servers and the vendors listed above process data in the United States. If you access Kruq from outside the US, your information is transferred to and processed in the US.

When we transfer personal data of EEA/UK residents to the US, we rely on the EU–US Data Privacy Framework where the receiving vendor is certified, and on Standard Contractual Clauses (SCCs) with vendors otherwise. You may request a copy of any SCCs we rely on by emailing contact@kruq.ai.

We use the following cookies:

• Strictly necessary — session identifiers for OAuth login, a small kruq_consent flag recording your cookie preference, and a CSRF token. Disabling these breaks core functionality.
• Functional — your language preference
• Analytics (Mixpanel) — an mp_* identifier cookie set on .kruq.ai for cross-subdomain tracking. Expires 365 days after your last visit. Used to understand which sections of the funnel work and where applicants drop off.

EEA/UK visitors see a consent banner on first visit and can decline analytics. California visitors can opt out via the “Do Not Sell or Share My Personal Information” link in the footer — though to be clear, we do not sell personal information.

You can clear cookies any time through your browser. We do not track you across third-party websites.

When you delete your account, we delete the data above within 30 days, except for payment records (legal obligation) and backups on the 30-day rolling cycle (overwritten naturally).

Some realistic detail rather than security theater:

• TLS 1.2+ for every request between your browser and our servers
• At-rest encryption for our primary database and photo storage
• Hashed and salted passwords for the email-and-password login option; we never see plaintext passwords
• Least-privilege access — only Vlad and one engineering co-founder have production-database access; both use hardware-key two-factor authentication
• Stripe handles all card details on its PCI-DSS Level 1 infrastructure through our payment partner’s checkout; nothing card-related touches our servers
• No exact-coordinate location is ever written to our database (the H3 conversion happens before persistence)

No system is unbreakable. If a breach happens that affects you, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, as required by GDPR Articles 33–34 and equivalent US state laws.

Wherever you live, you may:

• Access the data we hold about you, in a portable format
• Correct anything that’s wrong
• Delete your account and your data (subject to the retention exceptions above)
• Restrict how we process your data
• Object to specific processing activities (analytics, profiling)
• Withdraw consent for anything based on consent (most analytics and marketing email)
• Lodge a complaint with your local data-protection authority

Email contact@kruq.ai with any of the above. We respond within 30 days, usually within 48 hours. There is no fee unless a request is manifestly excessive (e.g., the tenth identical request in a month), in which case we’ll explain.

If you live in California, you have additional rights under the California Consumer Privacy Act as amended by the CPRA:

• Know what personal information we collect and how we use it (sections 03 and 04)
• Delete personal information we hold about you
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information — we do neither, but you can confirm by emailing contact@kruq.ai
• Limit use of “sensitive personal information” — we collect only what onboarding requires (described in section 03)
• Non-discrimination for exercising any of these rights

We do not sell personal information for money. We do not “share” personal information for cross-context behavioral advertising as defined by the CPRA. Mixpanel runs as a “service provider” under our contract; data goes there only for our analytics, never for resale.

To exercise these rights, email contact@kruq.ai. We verify your identity (typically by confirming the email used during signup) and respond within 45 days.

If you live in the European Economic Area or the United Kingdom, the General Data Protection Regulation and the UK GDPR apply.

Data controller:

Contactable at contact@kruq.ai. Given our size and the nature of our processing, we are not required to appoint a Data Protection Officer.

Lawful basis for each processing activity:

Special-category data — anything you tell us about your therapy history, religion, or sexual orientation in onboarding — is processed only with your explicit consent under Art. 9(2)(a), and only for matching purposes.

Automated decision-making — see section 05. You have the right to obtain human intervention, express your view, and contest any decision under Art. 22.

Right to lodge a complaint — contact your local supervisory authority, or in the UK the Information Commissioner’s Office at ico.org.uk.

Kruq is for adults only. Our minimum age is 18 in all jurisdictions, irrespective of local age of majority. If we discover an account belongs to someone under 18, we close it and delete the data. This satisfies the US Children’s Online Privacy Protection Act (COPPA) and equivalent EU requirements.

If you believe a minor has created an account, please email contact@kruq.ai.

We update this Privacy Policy as our product evolves, our vendor stack changes, or law requires. Material changes — new categories of data, new sharing partners, automated-decision changes — are announced by:

• Updating the “Last updated” date at the top
• Emailing all active account holders at least 14 days before changes take effect
• Posting a banner on kruq.ai for at least 30 days

Continued use after the effective date confirms acceptance. If you disagree, you can delete your account.

For privacy questions, data-rights requests, or deletion requests:

contact@kruq.ai

Founder contact:

• Telegram @verviico (Vlad)
• Kruq channel @kruqai

We respond to all privacy inquiries within 30 days.