Privacy Policy

Welcome to Kruti.io (“we,” “us,” or “our”), an AI-powered LinkedIn content generation platform. We are the Data Fiduciary for the purposes of India’s Digital Personal Data Protection Act, 2023.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our platform at kruti.io (the “Service”). By accessing or using Kruti.io, you acknowledge that you have read and understood this Privacy Policy.

We are committed to protecting your privacy and handling your data transparently. This policy applies to all users of the Service, including those on free trials and paid subscriptions.

We collect the following categories of information:

a) Account Information via LinkedIn OAuth

When you sign in using LinkedIn, we receive and store the following through LinkedIn’s OAuth 2.0 / OpenID Connect protocol (scopes: openid, profile, email, w_member_social):

• Full name
• Email address
• Profile picture URL
• LinkedIn profile identifier (an opaque member ID, not your public profile URL)

We do not receive your About section, work experience, activity, connections or any other profile content from LinkedIn. Your professional headline is not taken from LinkedIn either — you enter it yourself during onboarding, and you can change it at any time in Settings.

b) Profile Data You Provide

During onboarding and in your Settings, you may provide additional information to personalize your content generation experience:

• Professional summary and industry
• Skills and expertise topics
• Content positioning and tone preferences
• Content goals and styles
• Target audience description
• Posting schedule preferences
• Post signature / sign-off text
• Human Mode preference (writing style setting)

c) Content Data

We store the content you create and generate using our platform:

• AI-generated content plans (weekly strategies, pillars, themes)
• Posts (titles, body text, hashtags, AI image prompts, generated images)
• Newsletter drafts (titles, subjects, bodies)
• Content repurposing outputs (Twitter threads, blog posts, emails)

d) Payment Information

Subscription payments are processed by Razorpay. We store only:

• Razorpay customer identifier
• Razorpay subscription identifier
• Selected plan and currency preference (INR or USD)
• Subscription status and billing period dates

We do NOT store your credit card numbers, bank account details, UPI IDs, or any payment instrument information. All sensitive payment data is handled exclusively by Razorpay.

e) Technical Data

• Session tokens (JWT-based authentication)
• Server access logs (IP addresses, timestamps, user agent strings)
• Error logs for debugging and service improvement

We use your information for the following purposes:

• AI Content Generation: Your profile data, preferences, and content history are used to generate personalized LinkedIn posts, content strategies, images, and newsletters via Google’s Generative AI services.
• Personalization: To tailor content recommendations, tone, and strategy to your professional profile and goals.
• LinkedIn Posting: To post content to your LinkedIn profile on your behalf using the w_member_social scope authorization.
• Payment Processing: To manage your subscription, process payments via Razorpay, and handle billing-related communications.
• Transactional Emails: To send account-related notifications and newsletter deliveries.
• Service Improvement: To monitor platform performance, fix issues, and improve features.
• Legal Compliance: To comply with applicable laws and respond to legal requests.

Kruti.io uses Google’s Gemini API. Post, strategy and newsletter text is generated with Gemini 2.5 Flash; Gemini 2.5 Pro is used for carousel planning and image briefs. Images are generated with Gemini 3.1 Flash Image. When generating content, we send the following to Google’s AI APIs:

• Your full name
• Your professional headline, industry and skills
• Your About / summary text, as you entered it during onboarding
• Your tone preferences, content goals and positioning
• Your target audience description
• Content context for continuity — previous post titles, and prior weeks’ themes and focuses when building a content plan
• Image generation prompts, which include your headline, industry and post text

We do not send Google your email address, your LinkedIn identifier, your LinkedIn profile URL, your post signature or your timezone. No file you upload — no image, document or screenshot — is ever sent to Google; every request we make is text only.

When building a content plan we additionally enable Google Search grounding, which means Gemini issues live Google searches derived from your industry, target audience and content themes so posts can reflect current context. If that step fails, your posts are generated without it.

This data is transmitted securely to Google’s servers for processing. Google’s Generative AI Terms of Service and Privacy Policy govern how Google handles this data.

Kruti.io does not use your data to train AI models. We use Google’s API services solely for generating content on your behalf.

We integrate with the following third-party services, each governed by their own privacy policies:

• LinkedIn Corporation: Authentication (OAuth 2.0) and content posting. Subject to LinkedIn’s Privacy Policy.
• Google LLC (Gemini API): AI content and image generation, and Google Search grounding when building a content plan. Subject to Google’s Privacy Policy.
• Razorpay: Payment processing for subscriptions. Subject to Razorpay’s Privacy Policy.
• Resend: Transactional email delivery. Receives your email address and the contents of the message we send you.
• Vercel Inc.: Hosting and file storage. Every generated image, uploaded document and support screenshot is stored with Vercel, and our application and server logs run on their platform.
• Supabase: Managed PostgreSQL hosting for our database, which holds your account, profile, content and subscription records.

Google, Resend and Vercel process data on servers outside India. Razorpay processes payments in India. Where we transfer your data abroad we do so to provide the Service you have asked for.

We use essential cookies for authentication and session management. We do not use third-party advertising or analytics cookies.

For a detailed breakdown of cookies and similar technologies we use, please refer to our Cookie Policy.

We implement appropriate technical and organizational measures to protect your data:

• All data is transmitted over HTTPS (TLS encryption in transit)
• Authentication managed via a signed JWT (JSON Web Token) session strategy
• Database access is restricted to the application, and every query is scoped to the signed-in account
• Payment data handled exclusively by PCI-DSS compliant Razorpay
• LinkedIn OAuth tokens are used only for actions you have authorised — publishing a post you marked ready, uploading its image, and reading your profile at sign-in

Two limitations we would rather state than imply. Your LinkedIn access and refresh tokens are stored in our database without an additional layer of application-level encryption, protected by the database’s own access controls and encryption at rest. And files we store for you — generated images, uploaded documents and support screenshots — are held at unlisted public URLs: they are not indexed or linked anywhere, but anyone who obtains the exact URL can open the file without signing in. Do not attach anything to a support ticket that you would not want read by someone holding that link.

We do not sell, rent, or trade your personal data to third parties for marketing or any other purpose.

• Account data is retained for as long as your account is active.
• Content data (posts, plans, newsletters) is retained for as long as your account is active, with one exception: generated images are deleted seven days after the post they belong to is published, and unused generated images are swept on the same schedule. Download anything you want to keep.
• Support tickets: replies from our team are deleted three days after they are sent, whether or not you have read them.
• Upon account deletion: your account, profile, content plans, posts, newsletters, subscription record and support history are deleted from our database, and the deletion cascades through all related records — including the LinkedIn tokens held against your account. We also delete the files themselves: generated images, carousel frames, uploaded documents and support screenshots are removed from our file storage as part of the same operation.
• Payment records: Razorpay may retain transaction records in accordance with their data retention policies and applicable financial regulations.
• Server logs: our hosting provider retains runtime logs according to its own retention schedule. These logs can contain your account identifier and, where we send you email, your email address.

You can delete your account yourself. Go to Settings, scroll to “Delete your account”, and confirm. It takes effect immediately and we cannot reverse it, so export anything you want to keep first. You do not need an active subscription to do this. If you would rather we handled it, email support@kruti.io.

Posts already published to LinkedIn remain on LinkedIn — they live on your profile, not on ours. Delete those from LinkedIn itself.

Under Indian Law (IT Act, 2000 & SPDI Rules, 2011)

As a user based in India, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate personal data
• Withdraw consent for processing your sensitive personal data

Under GDPR (for users in the European Union)

If you are located in the EU/EEA, you additionally have the right to:

• Data portability - receive your data in a structured, machine-readable format. Today you can export your posts as a CSV from the dashboard; for anything beyond that (profile, content plans, newsletters, support history) email us and we will compile it
• Erasure (“right to be forgotten”) - request deletion of your data
• Restriction of processing
• Object to processing based on legitimate interests
• Lodge a complaint with a supervisory authority

How to Exercise Your Rights

• Delete your account: Contact us at support@kruti.io to request complete account and data deletion.
• Export your data: Request a copy of your data by emailing support@kruti.io.
• Revoke LinkedIn access: You can disconnect Kruti.io from your LinkedIn account at any time via LinkedIn’s Settings > Data Privacy > Permitted Services.

Kruti.io is not intended for individuals under the age of 18, and our Terms require you to be 18 or older to hold an account. We should be straightforward about how that is enforced: we do not ask your date of birth and LinkedIn does not tell us your age, so we have no technical age check — we rely on LinkedIn’s own minimum age for an account and on the undertaking in our Terms. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us at support@kruti.io, and we will promptly delete such information.

Your data may be processed in jurisdictions outside your country of residence:

• Google (United States): AI content generation via Google Gemini and Gemini APIs
• Razorpay (India): Payment processing
• Infrastructure providers: Hosting and CDN services

Where data is transferred internationally, we ensure appropriate safeguards are in place, including compliance with applicable data protection regulations.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Notify you via email or an in-app notification for significant changes

Your continued use of Kruti.io after changes are posted constitutes your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Escalating beyond us. If you are not satisfied with how we have handled your grievance, you may complain to the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023. You are not required to come to us first, but it is usually faster.

Section 14 of the Digital Personal Data Protection Act, 2023 gives you the right to nominate another individual to exercise your rights under the Act on your behalf in the event of your death or incapacity.

We do not yet offer a form for this in the product. To make a nomination, email us at support@kruti.io with the subject “Nomination”, naming the person and giving their contact details. We will record it against your account and confirm it to you in writing. You can change or withdraw a nomination at any time the same way.