Privacy Policy

• Account and identity data, such as name, email address, profile image, language, country, authentication method, and security settings.
• Card and profile content you choose to provide, such as job title, organization, biography, contact details, links, social profiles, images, files, branding, and custom fields.
• Contact and lead data, including information imported, scanned, entered, exchanged, or submitted through a lead form.
• Organization data, such as membership, role, team, invitations, permissions, templates, and administrator actions.
• Subscription and transaction data received from Paddle, such as Paddle customer and subscription identifiers, plan, status, billing period, transaction identifiers, currency, totals, invoice links, and a limited payment-method summary. Krutna does not receive or store full payment-card numbers.
• Usage and device data, such as IP address, browser and device information, language, referring page, public-card views, link clicks, saves, lead events, approximate country or region, timestamps, and diagnostic logs.
• Support and communications data, including messages and information you provide when contacting us.
• AI feature inputs and outputs when you ask Krutna to scan, translate, or generate content.

• Provide, personalize, maintain, and secure the Service; authenticate users; and operate cards, contacts, teams, wallet passes, analytics, and billing features.
• Process your requests, provide support, send transactional messages, and communicate important service, security, or policy changes.
• Measure performance, diagnose errors, prevent fraud and abuse, enforce our terms, and improve the Service.
• Comply with law, respond to valid legal requests, and establish or defend legal claims.

Where applicable law requires a legal basis, we rely on performing our contract with you, our legitimate interests in operating and securing Krutna, compliance with legal obligations, and consent where requested. You may withdraw consent at any time, without affecting earlier lawful processing.

Information you place on a public card is intended to be shared. Anyone with the card URL, QR code, NFC link, or wallet pass may be able to access it. Search engines or other services may also discover a public page depending on your settings and how it is shared.

Recipients may save or copy shared information outside Krutna. Changes or deletion within Krutna cannot remove copies already held by recipients or third parties.

We disclose information only as needed to operate the Service, follow your instructions, complete a transaction, protect rights and safety, or comply with law. Recipients may include:

• Infrastructure and hosting providers, including Vercel, Neon, and Cloudflare.
• Email and support delivery providers, including Resend.
• Error monitoring and security providers, including Sentry.
• Payment and subscription providers, including Paddle, which acts as authorized reseller and Merchant of Record and processes payment information under its own privacy notice.
• Authentication or connected-service providers you choose, such as Google, Apple, or wallet providers.
• AI service providers, including OpenAI, when you invoke an AI-assisted feature.
• Professional advisers, authorities, courts, or a buyer/successor in a business transaction where legally permitted.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Krutna uses first-party cookies and local storage for authentication, security, language and interface preferences, referral attribution, and public-card analytics. The k_vid cookie uses a random identifier to distinguish public-card visits and can remain for up to 395 days. The k_ref referral cookie can remain for up to 60 days. Authentication cookies last for the session or the period shown by your browser.

Krutna does not currently use third-party advertising cookies. See the Cookie Policy at /legals/cookie-policy for more information and browser controls.

We keep account and Service data while your account is active and for as long as reasonably needed to provide the Service. When you complete account deletion, Krutna deletes or de-identifies data under its control, subject to data belonging to an organization, short-lived backups, security logs, fraud prevention, unresolved disputes, and records we must retain by law.

Retention periods vary by data type and purpose. Billing identifiers, webhook records, audit logs, and support records may be retained as needed for accounting, fraud prevention, dispute resolution, security, and legal compliance. Paddle retains transaction and payment data under its own policies.

We use technical and organizational safeguards designed to protect personal information, including encryption in transit, access controls, credential hashing, restricted production access, monitoring, and backups. No system is completely secure. You are responsible for using a strong, unique password and protecting your account and devices.

Krutna and its service providers may process information in countries other than yours. Those countries may have different data-protection laws. Where required, we use an available lawful transfer mechanism and safeguards provided by our vendors, such as adequacy decisions or approved contractual clauses.

You can access and update much of your account and card information in Krutna, control what appears on a public card, export supported data, and initiate account deletion through account settings. You can unsubscribe from promotional email using the link in the message; essential account and service messages may continue while your account is active.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to complain to a regulator. Send requests to [email protected]. We may need to verify your identity and may retain information where an exception applies.

Krutna is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided information, contact [email protected].

We may update this policy as Krutna, our providers, or applicable law changes. We will post the revised policy and update the date above. We will provide additional notice when required for a material change.

The controller is Mohamed Amjad Sharif, a sole proprietor trading as Krutna. For privacy questions or requests, email [email protected]. For security reports, email [email protected]. General support is available at [email protected].