PRIVACY POLICY

Last Updated: October 29, 2026
Effective Date: October 29, 2026

1. SCOPE

This Privacy Policy explains how Cruality LLC (“Cruality,” “Crualitics,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use the Crualitics website, applications, software, artificial-intelligence features, subscriptions, communications, and related services (the “Service”).

This Policy applies to information processed by Cruality LLC as operator of the Service. It does not replace the privacy notices of third-party services you choose to use.

2. INFORMATION WE COLLECT

Depending on how you use the Service, we may collect the following categories.

A. Account and identity information

• name, display name, or username;
• email address;
• mobile telephone number;
• date of birth, age, or age-certification information;
• parental or legal-guardian consent information when applicable;
• account identifiers, role, membership, subscription, or eligibility status;
• password hash and authentication records; and
• profile settings and preferences.

We do not store your password in readable form.

B. Wellness and User Content

• journal entries and reflection exercises;
• conversations and messages with CRUAL;
• assessments, responses, scores, goals, plans, and progress;
• meditation, activity, achievement, and feature-use records;
• uploaded material and information you choose to provide; and
• account-specific memory or personalization information.

This content may contain sensitive personal information because users may voluntarily discuss health, emotions, relationships, trauma, substance use, or other private matters.

C. Communications information

• emails, support requests, feedback, and correspondence;
• voicemail recordings, transcripts, caller numbers, extension routing, call timestamps, and recording or delivery status when you leave a voicemail;
• SMS consent status, consent timestamp, source, disclosure version, and mobile number;
• SMS delivery, opt-out, HELP, START, and error records;
• transactional email and text-message records; and
• legal-acceptance records, including version, date, IP address, and user agent where collected.

D. Subscription and transaction information

• selected plan, billing interval, subscription status, renewal and cancellation status;
• transaction identifiers, payment status, limited billing metadata, and tax-related records; and
• information received from the payment processor.

Cruality LLC does not intentionally store full payment-card numbers or card security codes when payment is handled by a third-party payment processor.

E. Device, network, and usage information

• IP address;
• browser, operating system, device type, and language;
• pages, screens, features, clicks, timestamps, and referring information;
• session, cookie, token, and authentication information;
• crash, diagnostic, performance, and security logs; and
• approximate location inferred from IP address.

F. Information from connected services

If you intentionally connect a third-party account, device, wearable, or integration, we may receive information authorized through that integration. The consent screen or feature notice should identify the categories before connection.

3. HOW WE COLLECT INFORMATION

We collect information:

(a) directly from you;
(b) automatically when you use the Service;
(c) from service providers that support payments, hosting, communications, security, analytics, or AI processing;
(d) from connected services you authorize; and
(e) from lawful public or business sources where appropriate.

4. HOW WE USE INFORMATION

We may use personal information to:

(a) create, authenticate, maintain, and secure accounts;
(b) provide journals, assessments, meditations, goals, AI conversations, personalization, and account memory;
(c) process subscriptions, payments, cancellations, eligibility, and benefits;
(d) provide requested password-reset, verification, and account-security communications;
(e) send optional wellness reminders only after the required consent;
(f) respond to support, legal, privacy, and security requests;
(g) detect, investigate, and prevent fraud, abuse, security incidents, and policy violations;
(h) maintain, debug, measure, and improve the Service;
(i) create aggregated or de-identified analytics;
(j) comply with law, legal process, and regulatory obligations;
(k) establish, exercise, or defend legal claims; and
(l) communicate material policy, account, or Service changes.

We do not use SMS consent or mobile-number information to authorize unrelated marketing.

5. ARTIFICIAL-INTELLIGENCE PROCESSING

When you interact with CRUAL, relevant prompts, conversation content, account context, safety instructions, and technical metadata may be transmitted to an artificial-intelligence service provider to generate a response or operate requested features.

AI providers process information on our behalf or under their applicable service terms. AI output may be inaccurate or inappropriate, as explained in the Terms and Legal Waiver.

Cruality LLC does not authorize a third-party AI provider to use identifiable Crualitics User Content for that provider’s general-purpose model training unless Cruality LLC provides a legally sufficient notice and obtains any consent required by law.

6. HOW WE DISCLOSE INFORMATION

We may disclose personal information to:

A. Service providers

Companies that provide hosting, databases, cloud infrastructure, artificial intelligence, email, SMS, payments, analytics, customer support, security, or technical services. They receive information reasonably necessary to perform their services.

Current providers include OpenAI for CRUAL inference and voicemail transcription, Stripe for payments, Twilio for telephone and SMS services, SendGrid for email, and Replit and database service providers for hosting and data storage. Relevant conversation content and context are sent for AI processing; voicemail audio is sent for transcription. Provider changes do not erase historical processing records.

B. Legal and safety recipients

Government authorities, courts, regulators, law enforcement, legal counsel, or other parties when reasonably necessary to comply with law or valid legal process; protect rights, safety, or security; investigate fraud or abuse; or establish or defend legal claims.

Crualitics is not an emergency-monitoring service and does not promise that content will be reviewed or disclosed in time to prevent harm.

C. Business transactions

A buyer, investor, lender, advisor, insurer, or successor in connection with a merger, financing, acquisition, reorganization, bankruptcy, due diligence process, or sale of all or part of the business, subject to appropriate safeguards.

Voicemail records are used to receive, route, transcribe, and respond to calls and support requests. Access is restricted to authorized staff according to mailbox assignment and application permissions. Recordings and transcripts are not public. Automated transcripts may be inaccurate; contact us to clarify a message. This disclosure does not replace any notice or consent required when a call is recorded.

D. With your direction or consent

A third party when you direct us to share information or intentionally connect a service.

E. Aggregated or de-identified information

Information that does not reasonably identify you may be used or disclosed for lawful analytics, research, business, or Service-improvement purposes.

7. WHAT WE DO NOT DO

Cruality LLC does not sell personal information for money.

Cruality LLC does not sell or share mobile numbers, SMS consent records, or SMS opt-in data with third parties for their own marketing or promotional purposes.

Cruality LLC does not authorize targeted advertising based on private journal or CRUAL conversation content.

No public statement may claim that information is “completely confidential,” “never shared,” “100% secure,” or “anonymous” unless the statement is technically and legally accurate.

8. SMS PRIVACY

When you provide a mobile number and request or consent to text-message features, we may process:

• the number;
• the consent language displayed;
• date, time, source, IP address, user agent, and legal version;
• message type and delivery status;
• STOP, START, HELP, and other replies; and
• suppression and opt-out status.

We use this information to provide requested security messages, optional wellness reminders, maintain consent and suppression records, troubleshoot delivery, and comply with messaging laws and carrier rules.

Mobile information will not be sold or shared with third parties for their own marketing. Mobile information may be disclosed to messaging providers and carriers as necessary to deliver and administer the SMS Program, or as required by law.

The SMS Terms and Conditions provide additional details.

9. COOKIES AND SIMILAR TECHNOLOGIES

The Service may use essential cookies, local storage, session identifiers, and similar technologies for authentication, security, preferences, load management, and Service functionality.

The Service may also use analytics technologies to understand use and performance. Where applicable law requires consent for non-essential technologies, the Service must obtain that consent before activation.

Browser “Do Not Track” signals are not a substitute for legally required opt-out mechanisms. The Service will respond to legally recognized universal opt-out signals when required and technically applicable.

10. LEGAL BASES FOR PROCESSING

Where a law requires identification of a legal basis, we process information as necessary to:

(a) perform a contract with you;
(b) take steps at your request before entering a contract;
(c) comply with legal obligations;
(d) pursue legitimate interests such as security, support, improvement, and fraud prevention, balanced against your rights;
(e) protect vital interests in limited circumstances; or
(f) act with your consent, which you may withdraw where applicable.

11. DATA RETENTION

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including account operation, legal compliance, payment and tax records, security, fraud prevention, dispute resolution, enforcement, and backup integrity.

Retention periods vary by category. For example:

• active account information is ordinarily retained while the account remains active;
• transaction, tax, and accounting records may be retained for legally required periods;
• security and audit logs may be retained for a limited risk-management period;
• consent and opt-out records may be retained to demonstrate compliance and honor suppression requests;
• deleted information may remain temporarily in backups until normal backup rotation; and
• information may be preserved when required by law, litigation hold, investigation, or dispute.

A verified deletion request will be completed within the period required by applicable law. Deletion does not require removal of lawfully retained records or data that has been irreversibly de-identified.

12. SECURITY

We use administrative, technical, and organizational measures designed to protect personal information. Measures may include access controls, password hashing, encryption in transit, provider-managed encryption at rest, logging, rate limiting, backups, and security monitoring.

No system is completely secure. We cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur.

The Security and Responsible Disclosure Notice provides additional information.

13. YOUR CHOICES AND RIGHTS

Depending on where you live, you may have rights to:

(a) request access to personal information;
(b) request correction;
(c) request deletion;
(d) receive a portable copy;
(e) withdraw consent;
(f) object to or restrict certain processing;
(g) opt out of certain sale, sharing, profiling, or targeted advertising;
(h) appeal a denied privacy request; and
(i) receive equal service and pricing without unlawful discrimination for exercising privacy rights.

You may update some information through account settings. To submit a request, email support@crualitics.com.

We may verify identity before completing a request. An authorized agent may be required to provide proof of authority. We will respond within the time required by applicable law.

14. CALIFORNIA AND OTHER U.S. STATE PRIVACY RIGHTS

Residents of jurisdictions with comprehensive privacy laws may exercise rights provided by those laws.

Based on the practices stated in this Policy, Cruality LLC does not sell personal information for money and does not sell or share mobile opt-in information for third-party marketing. If practices change in a way that triggers additional notice or opt-out duties, this Policy and the Service must be updated before the change.

Cruality LLC may provide additional jurisdiction-specific notices when legally required.

15. AGE ELIGIBILITY

Registration and use are restricted to people at least 18 years old who have contractual capacity. The Service is not directed to children. If you believe a person under 18 submitted personal information, contact support@crualitics.com. We will assess the report and take steps required by applicable law.

16. INTERNATIONAL USE

Cruality LLC operates from the United States. Information may be processed in the United States and other locations where service providers operate.

If you access the Service from another country, your information may be transferred to a jurisdiction with different privacy laws. Where required, appropriate transfer safeguards will be used.

17. THIRD-PARTY LINKS AND SERVICES

The Service may link to third-party websites or services. Their privacy practices are controlled by them, not Cruality LLC. Review their notices before providing information.

18. HIPAA NOTICE

Cruality LLC is not representing that Crualitics is a HIPAA-covered healthcare service. Unless Cruality LLC has expressly entered into a written agreement that says otherwise, do not submit protected health information on behalf of a covered entity or business associate.

19. CHANGES TO THIS POLICY

We may update this Policy prospectively. The “Last Updated” date identifies the current version.

We will provide notice and obtain consent when required by applicable law. Material changes will not be applied retroactively in a manner prohibited by law.

20. CONTACT

Cruality LLC
Platform: Crualitics
Email: support@crualitics.com