PRIVACY POLICY

Last Updated: July 11, 2026
Effective Date: July 11, 2026

1. SCOPE

This Privacy Policy explains how Cruality LLC (“Cruality,” “Crualitics,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use the Crualitics website, applications, software, artificial-intelligence features, subscriptions, communications, and related services (the “Service”).

This Policy applies to information processed by Cruality LLC as operator of the Service. It does not replace the privacy notices of third-party services you choose to use.

2. INFORMATION WE COLLECT

Depending on how you use the Service, we may collect the following categories.

A. Account and identity information

• name, display name, or username;
• email address;
• mobile telephone number;
• date of birth, age, or age-certification information;
• parental or legal-guardian consent information when applicable;
• account identifiers, role, membership, subscription, or eligibility status;
• password hash and authentication records; and
• profile settings and preferences.

We do not store your password in readable form.

B. Wellness and User Content

• journal entries and reflection exercises;
• conversations and messages with CRUAL;
• assessments, responses, scores, goals, plans, and progress;
• meditation, activity, achievement, and feature-use records;
• uploaded material and information you choose to provide; and
• account-specific memory or personalization information.

This content may contain sensitive personal information because users may voluntarily discuss health, emotions, relationships, trauma, substance use, or other private matters.

C. Communications information

• emails, support requests, feedback, and correspondence;
• SMS consent status, consent timestamp, source, disclosure version, and mobile number;
• SMS delivery, opt-out, HELP, START, and error records;
• transactional email and text-message records; and
• legal-acceptance records, including version, date, IP address, and user agent where collected.

D. Subscription and transaction information

• selected plan, billing interval, subscription status, renewal and cancellation status;
• transaction identifiers, payment status, limited billing metadata, and tax-related records; and
• information received from the payment processor.

Cruality LLC does not intentionally store full payment-card numbers or card security codes when payment is handled by a third-party payment processor.

E. Device, network, and usage information

• IP address;
• browser, operating system, device type, and language;
• pages, screens, features, clicks, timestamps, and referring information;
• session, cookie, token, and authentication information;
• crash, diagnostic, performance, and security logs; and
• approximate location inferred from IP address.

F. Information from connected services

If you intentionally connect a third-party account, device, wearable, or integration, we may receive information authorized through that integration. The consent screen or feature notice should identify the categories before connection.

3. HOW WE COLLECT INFORMATION

We collect information:

(a) directly from you;
(b) automatically when you use the Service;
(c) from service providers that support payments, hosting, communications, security, analytics, or AI processing;
(d) from connected services you authorize; and
(e) from lawful public or business sources where appropriate.

4. HOW WE USE INFORMATION

We may use personal information to:

(a) create, authenticate, maintain, and secure accounts;
(b) provide journals, assessments, meditations, goals, AI conversations, personalization, and account memory;
(c) process subscriptions, payments, cancellations, eligibility, and benefits;
(d) provide requested password-reset, verification, and account-security communications;
(e) send optional wellness reminders only after the required consent;
(f) respond to support, legal, privacy, and security requests;
(g) detect, investigate, and prevent fraud, abuse, security incidents, and policy violations;
(h) maintain, debug, measure, and improve the Service;
(i) create aggregated or de-identified analytics;
(j) comply with law, legal process, and regulatory obligations;
(k) establish, exercise, or defend legal claims; and
(l) communicate material policy, account, or Service changes.

We do not use SMS consent or mobile-number information to authorize unrelated marketing.

5. ARTIFICIAL-INTELLIGENCE PROCESSING

When you interact with CRUAL, relevant prompts, conversation content, account context, safety instructions, and technical metadata may be transmitted to an artificial-intelligence service provider to generate a response or operate requested features.

AI providers process information on our behalf or under their applicable service terms. AI output may be inaccurate or inappropriate, as explained in the Terms and Legal Waiver.

Cruality LLC does not authorize a third-party AI provider to use identifiable Crualitics User Content for that provider’s general-purpose model training unless Cruality LLC provides a legally sufficient notice and obtains any consent required by law.

6. HOW WE DISCLOSE INFORMATION

We may disclose personal information to:

A. Service providers

Companies that provide hosting, databases, cloud infrastructure, artificial intelligence, email, SMS, payments, analytics, customer support, security, or technical services. They receive information reasonably necessary to perform their services.

Current categories may include providers such as Anthropic for AI processing, Stripe for payment processing, Twilio for SMS, SendGrid or another email provider, Neon or another database provider, and Replit or another hosting or deployment provider.

B. Legal and safety recipients

Government authorities, courts, regulators, law enforcement, legal counsel, or other parties when reasonably necessary to comply with law or valid legal process; protect rights, safety, or security; investigate fraud or abuse; or establish or defend legal claims.

Crualitics is not an emergency-monitoring service and does not promise that content will be reviewed or disclosed in time to prevent harm.

C. Business transactions

A buyer, investor, lender, advisor, insurer, or successor in connection with a merger, financing, acquisition, reorganization, bankruptcy, due diligence process, or sale of all or part of the business, subject to appropriate safeguards.

D. With your direction or consent

A third party when you direct us to share information or intentionally connect a service.

E. Aggregated or de-identified information

Information that does not reasonably identify you may be used or disclosed for lawful analytics, research, business, or Service-improvement purposes.

7. WHAT WE DO NOT DO

Cruality LLC does not sell personal information for money.

Cruality LLC does not sell or share mobile numbers, SMS consent records, or SMS opt-in data with third parties for their own marketing or promotional purposes.

Cruality LLC does not authorize targeted advertising based on private journal or CRUAL conversation content.

No public statement may claim that information is “completely confidential,” “never shared,” “100% secure,” or “anonymous” unless the statement is technically and legally accurate.

8. SMS PRIVACY

When you provide a mobile number and request or consent to text-message features, we may process:

• the number;
• the consent language displayed;
• date, time, source, IP address, user agent, and legal version;
• message type and delivery status;
• STOP, START, HELP, and other replies; and
• suppression and opt-out status.

We use this information to provide requested security messages, optional wellness reminders, maintain consent and suppression records, troubleshoot delivery, and comply with messaging laws and carrier rules.

Mobile information will not be sold or shared with third parties for their own marketing. Mobile information may be disclosed to messaging providers and carriers as necessary to deliver and administer the SMS Program, or as required by law.

The SMS Terms and Conditions provide additional details.

9. COOKIES AND SIMILAR TECHNOLOGIES

The Service may use essential cookies, local storage, session identifiers, and similar technologies for authentication, security, preferences, load management, and Service functionality.

The Service may also use analytics technologies to understand use and performance. Where applicable law requires consent for non-essential technologies, the Service must obtain that consent before activation.

Browser “Do Not Track” signals are not a substitute for legally required opt-out mechanisms. The Service will respond to legally recognized universal opt-out signals when required and technically applicable.

10. LEGAL BASES FOR PROCESSING

Where a law requires identification of a legal basis, we process information as necessary to:

(a) perform a contract with you;
(b) take steps at your request before entering a contract;
(c) comply with legal obligations;
(d) pursue legitimate interests such as security, support, improvement, and fraud prevention, balanced against your rights;
(e) protect vital interests in limited circumstances; or
(f) act with your consent, which you may withdraw where applicable.

11. DATA RETENTION

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including account operation, legal compliance, payment and tax records, security, fraud prevention, dispute resolution, enforcement, and backup integrity.

Retention periods vary by category. For example:

• active account information is ordinarily retained while the account remains active;
• transaction, tax, and accounting records may be retained for legally required periods;
• security and audit logs may be retained for a limited risk-management period;
• consent and opt-out records may be retained to demonstrate compliance and honor suppression requests;
• deleted information may remain temporarily in backups until normal backup rotation; and
• information may be preserved when required by law, litigation hold, investigation, or dispute.

A verified deletion request will be completed within the period required by applicable law. Deletion does not require removal of lawfully retained records or data that has been irreversibly de-identified.

12. SECURITY

We use administrative, technical, and organizational measures designed to protect personal information. Measures may include access controls, password hashing, encryption in transit, provider-managed encryption at rest, logging, rate limiting, backups, and security monitoring.

No system is completely secure. We cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur.

The Security and Responsible Disclosure Notice provides additional information.

13. YOUR CHOICES AND RIGHTS

Depending on where you live, you may have rights to:

(a) request access to personal information;
(b) request correction;
(c) request deletion;
(d) receive a portable copy;
(e) withdraw consent;
(f) object to or restrict certain processing;
(g) opt out of certain sale, sharing, profiling, or targeted advertising;
(h) appeal a denied privacy request; and
(i) receive equal service and pricing without unlawful discrimination for exercising privacy rights.

You may update some information through account settings. To submit a request, email support@crualitics.com.

We may verify identity before completing a request. An authorized agent may be required to provide proof of authority. We will respond within the time required by applicable law.

14. CALIFORNIA AND OTHER U.S. STATE PRIVACY RIGHTS

Residents of jurisdictions with comprehensive privacy laws may exercise rights provided by those laws.

Based on the practices stated in this Policy, Cruality LLC does not sell personal information for money and does not sell or share mobile opt-in information for third-party marketing. If practices change in a way that triggers additional notice or opt-out duties, this Policy and the Service must be updated before the change.

Cruality LLC may provide additional jurisdiction-specific notices when legally required.

15. CHILDREN AND MINORS

The Service is not directed to children under 13, and children under 13 may not create accounts or provide personal information.

If we learn that we collected personal information from a child under 13, we will take reasonable steps required by law, which may include suspension, parental notice, verification, or deletion.

Users 13 through 17 may use the Service only under the eligibility requirements in the Terms. If a functioning parental-consent process does not exist, registration must remain restricted to users 18 and older.

A parent or guardian who believes a minor submitted information without authorization should contact support@crualitics.com.

16. INTERNATIONAL USE

Cruality LLC operates from the United States. Information may be processed in the United States and other locations where service providers operate.

If you access the Service from another country, your information may be transferred to a jurisdiction with different privacy laws. Where required, appropriate transfer safeguards will be used.

17. THIRD-PARTY LINKS AND SERVICES

The Service may link to third-party websites or services. Their privacy practices are controlled by them, not Cruality LLC. Review their notices before providing information.

18. HIPAA NOTICE

Cruality LLC is not representing that Crualitics is a HIPAA-covered healthcare service. Unless Cruality LLC has expressly entered into a written agreement that says otherwise, do not submit protected health information on behalf of a covered entity or business associate.

19. CHANGES TO THIS POLICY

We may update this Policy prospectively. The “Last Updated” date identifies the current version.

We will provide notice and obtain consent when required by applicable law. Material changes will not be applied retroactively in a manner prohibited by law.

20. CONTACT

Cruality LLC
Platform: Crualitics
Email: support@crualitics.com