Privacy policy

Account data (about you and your team, for running your account): Edureify Inc. is the controller.

Visitor and customer data (collected by the Kratly script on your websites and from your payment and ad accounts): you are the controller and we are your processor, acting only on your instructions under our data processing agreement. If you are a visitor to one of our customers’ websites, please contact that website about your data; we will help them respond.

Name, email address and a password hash; team membership and roles; billing status and the Stripe customer reference (we never see or store card numbers); security logs of sign-ins and sensitive changes, with IP addresses stored only as one-way hashes; questions you ask the AI assistant and its answers; and support messages.

If you add Kratly to Slack or Microsoft Teams: the workspace’s name and ID, Kratly’s bot token (encrypted), the channel you choose, and the messages that mention Kratly or are sent to it directly, with its answers. Kratly does not read other messages or files. The asker’s email address is looked up to check their access in Kratly. Slack and Teams data is not used to train AI models. See Kratly for Slack.

If you use a free tool on our website (the free video, the growth plan, the AI search audit or the app audit): the website or app address you enter, the result, and a one-way hash of your IP address (to limit how often each tool can be used). If you ask us to email you the result, we keep the email address you give with that website’s address, use it to send the link and may contact you about your result and Kratly. The free video’s link is only sent to an address at the website’s own domain. We remove these email addresses after 12 months, or sooner if you ask. These pages may use Cloudflare Turnstile to check that a person, not a bot, is starting the tool: Cloudflare receives your IP address and information about your browser for that check, under its own privacy policy. Legal basis: our legitimate interest in offering the tools and preventing their abuse.

We use this to provide and secure the Service, bill you, send service emails (verification, invitations, billing notices) and improve the product. Legal bases: performing our contract with you, and our legitimate interest in security and product improvement. We don’t send marketing email without your consent.

Page address and title, referrer, campaign parameters (such as utm_source and ad click identifiers), screen size, browser, operating system and device type, the browser’s time zone (used only to correct the approximate country when a VPN or proxy makes the IP address look foreign), the email address and name a visitor enters in a form on the customer’s site (when the customer has not turned this off; password, payment and other sensitive fields are never read), events the customer’s site already sends to Google or Meta (for example “checkout started” or “purchase”, with their value), approximate location (country, region, city), clicks on links and buttons with their visible label, form submissions (of the values typed, only an email address and name are read, and only to identify the visitor; everything else is never read), scroll depth, time on page, page-speed measurements and JavaScript error messages, plus any custom events and email addresses the website owner chooses to send.

IP addresses are used only in memory to look up approximate location from a local database and to compute a hash that rotates daily. The raw IP address is never stored and, in production, never sent to a third party.

Payment information comes from the website owner’s Stripe or LemonSqueezy account through signed webhooks: amounts, currency, refunds, subscription status and the paying customer’s email. Card numbers are never received.

Website owners can run the script in consent mode (nothing is sent until the visitor agrees) or cookieless mode (no cookies at all), and can make it respect Do Not Track and Global Privacy Control signals. The Kratly dashboard itself uses local storage only for your sign-in token and display preferences, and no advertising cookies.

Only the service providers needed to run Kratly, listed with their purpose in our subprocessor list: hosting ([Hosting provider and region]), AI answers (Anthropic), our own billing (Stripe), and email delivery ([email protected]). Ad platforms and CRMs receive requests only when you connect your own accounts. We may disclose data if the law requires it, and will tell you unless prohibited. We do not sell personal data.

Where providers process data outside your country, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or the UK addendum. [Confirm the hosting region and each provider’s transfer mechanism.]

Encryption in transit (TLS) everywhere; connector and payment-provider credentials encrypted at rest with AES-256-GCM; passwords hashed with bcrypt; tokens for email verification, password reset and invitations stored only as hashes; role-based access for team members; an audit log of sensitive actions; and least-privilege database access. We will notify affected customers without undue delay if a personal data breach occurs.

Depending on where you live, you can ask to access, correct, delete, restrict or export your personal data, or object to processing. Email [email protected]. For visitor data, contact the website you visited; we support our customers in responding. You can also complain to your data protection authority.

Edureify Inc., 447 Boradway Road New York USA. [email protected]. [Add EU/UK representative and DPO details if required.] We will post changes here and notify customers of material changes by email.