KROBAR PRIVACY POLICY
Last updated July 24, 2024
Trikro LLC d/b/a Kromatic ("Krobar". "we", or "us") is dedicated to protecting the privacy of our customers, website visitors, and users of our services. This Privacy Policy applies to your use of the Krobar artificial intelligence platform ("Platform"), along with the features and functionalities available through the Platform, our mobile application ("App"), and website ("Website"). We refer to our mobile application, Website, and Platform together as the "Services".
Please read this Privacy Policy ("Policy") carefully to understand our privacy practices when you use our Services. We may modify this Policy at any time at our discretion. Material changes will be conspicuously posted on the Website or otherwise communicated to you. All changes will be effective immediately upon posting to the Website.
For EU personal data, Krobar acts as 'processor' and the customer is 'controller'—see our Data-Processing Addendum (incorporating 2021 SCCs) for details.
1. WHAT IS PERSONAL INFORMATION?
For purposes of this Privacy Statement, "Personal Information" or "Personal Data" means information that alone or in combination identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
2. CATEGORIES OF PERSONAL INFORMATION WE COLLECT
We collect specific categories of Personal Information. When you access our Website, we may collect certain information to complete your request. The information we collect varies depending on the Services you are using.
We describe how we collect information on our Services below:
| Category of Data | Examples |
|---|---|
| Identifiers | Full name, billing address, Internet Protocol Address ("IP Address"), authentication tokens, email address, account user ID and password. |
| Customer Records* | Name, business email, and digital signature. We do not collect special-category data or payment-card data on this platform. *For clarity, "Customer Records" here excludes any financial or medical data listed in Cal. Civ. Code §1798.140(v)(1)(B). |
| Commercial Information | Records of products or Services you purchased or received, or considered, and other purchasing history or invoices. |
| Internet Activity | Browsing history, search history, information regarding your interactions with the Website, applications, or advertisement, electronic device identifier, hardware information, operating system version, browser type and version, browser language, media access control ("MAC"), screen resolution, cookie information, system type, access times, referring Website URLs. |
| Geolocation Data | City, State, Zip Code, and Country (based on IP Address). |
| Sensory Information | Customer Services calls. |
3. HOW LONG DO WE KEEP YOUR INFORMATION
We retain Personal Information only as long as we have a legitimate business purpose to do so. These purposes may include retaining Personal Information in order to:
complete the transaction for which the Personal Information was collected;
continue our ongoing business relationship with you; and
satisfy any legal, regulatory, tax, accounting or reporting requirements.
Workspace data deleted ≤ 30 days after account closure; encrypted backups retained 7 days; system logs ≤ 90 days, then anonymised.
If your account is deleted, we erase Customer Data within 30 days after account closure; encrypted backups are retained 7 days; system logs ≤ 90 days, then anonymised.
4. SOURCES OF THE INFORMATION WE COLLECT AND THE PURPOSE FOR WHICH WE COLLECT IT
The charts below list the categories of Personal Information we may collect, as well as the sources we collect the information and the purpose(s) for such collection.
Information we collect from you
We collect certain Personal Information from you directly or automatically using technology for the purposes described below:
| Purpose for Collection and Use | Examples | Category of Data |
|---|---|---|
| Business Purposes | To facilitate transactions To process and deliver products and services To provide customer service To create accounts To inform our business strategies To engage in product research and development To monitor and improve our products and Services To administer surveys | Identifiers Customer Records Commercial Information Internet Activity Sensory Information |
| Communication Purposes | To respond to your requests or inquiries To send you newsletters and updates To provide information about our products and Services | Identifiers Customer Records Commercial Information Internet Activity Sensory Information |
| Website Management Purposes | To provide personalized experiences To troubleshoot problems with the Website To help improve the Website To understand how you get to the Website | Identifiers Internet Activity |
| Marketing & Advertising Purposes | To send you promotions To send you email promotions | Identifiers Internet Activity Commercial Information |
| For Compliance and Legal Purposes | To protect our legal rights and the rights of third parties | Identifiers Customer Records Commercial Information |
| Analytics | To perform analytics on your use of the Website To understand the Website demographics and user preferences | Identifiers Internet Activity Geolocation Information |
Information we collect from third party sources
We collect Personal Information from various third-party companies and public sources as described below:
| Purpose for Collection and Use | Examples | Category of Data | Third Party Source |
|---|---|---|---|
| Commercial Purposes | When you make a purchase online, we do not receive your credit card, debit card, or other financial information. Instead, that information is provided directly to a PCI-compliant payment processor to help us facilitate payment. However, we do receive your contact information and purchase information from the payment processor. We receive only an anonymised payment-token reference—no card details We use the third-party Intuit Merchant Services (IMS) and Stripe to manage payments. | Identifiers Customer Records | Payment Processors |
| Marketing & Advertising Purposes | We may receive information from our third-party advertising Service providers. | Identifiers | Services Providers Third Party Marketing and Analytics Companies |
| Analytics | We may also receive Personal Information from our third-party analytics providers. | Identifiers Internet Activity Commercial Information | Website-related Services Providers, including analytics providers |
Disclosing Personal Information
We may disclose your Personal Information as follows:
| With Whom We Disclose Personal Information | Purpose for Disclosing | Category of Information |
|---|---|---|
| Employees, Business Partners, Affiliates, and Subsidiaries | Business Purposes including to process, deliver, and provide Services, communicate with you, provide customer service, and improve our products and Services. Website Management including troubleshooting problems, improving the content and functionality of the Website, and customizing the Website for you and our users. | Identifiers Commercial Information Customer Records Internet Activity Sensory Information |
| Services Providers | Business Purposes including payment processing, customer Services, and performing analytics. Website Management including hosting, troubleshooting problems, improving the content and functionality of the Website, and performing statistical and other analyses of the Website. | Identifiers Internet Activity Customer Records Commercial Information |
| Third-Party Advertising Networks and Social Media Platforms | Marketing & Advertising Purposes including providing targeted advertising and other marketing communications. Business Purposes including performing data analysis and statistical analysis for us. | Identifiers Commercial Information Internet Activity |
| Government and Law Enforcement | Legal Purposes. We will cooperate with law enforcement and other governmental agencies and may disclose Personal Information: (i) if we believe in good faith we are legally required to disclose that Personal Information, (ii) if we are advised to disclose Personal Information by our legal counsel, or (iii) when necessary to identify, contact or bring legal action against someone who may cause or be causing harm to, or interfering with the legal rights of, Krobar or any other person or entity. | Identifiers Commercial Information Internet Activity Customer Records |
| Professional Advisors | Business Purposes. We need to receive advice from our professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to us. | Identifiers Commercial Information Customer Records |
| New Owners or Successors in Interest | Change In Ownership/Business Successors. We may share your Personal Information in connection with a contemplated or completed strategic business transaction such as a merger, acquisition, or sale of all or substantially all of our assets or stock to a subsequent owner or operator, a dissolution, bankruptcy, liquidation, or other similar business transaction where Personal Information may be shared, sold or transferred to that third party, including during the due diligence process. | Identifiers Commercial Information Internet Activity Customer Records |
| Other Users | Digital Millennium Copyright Act Requests. By submitting a copyright infringement notice, counter-notice, or other similar notification, you consent to have that communication forwarded to any person or entity to whom the notice or counter-notice relates in order to facilitate a prompt resolution of the copyright infringement claim. | Identifiers |
5. DE-IDENTIFIED/AGGREGATED DATA
We may aggregate or de-identify Personal Information we collect through our Website and when operating our business. For example, we may aggregate Personal Information to calculate the percentage of users in a particular zip code. Once information or data has been de-identified and/or aggregated, such information is no longer Personal Information.
Krobar may use or share such de-identified or aggregated data for any legal purpose at its sole discretion.
We never attempt to re-identify aggregated data.
6. BLOGS AND FORUMS
Our Website may, from time to time, offer publicly accessible blogs or community forums where you can submit ideas, photographs, writings, music, video, audio recordings, computer graphics, pictures, data, information about your location, questions, comments, suggestions, or other content ("User Content"), including Personal Information. You should be aware that any User Content you provide in these areas may be read, collected, and used by others who access them. Please note that we do not control who will have access to the User Content that you choose to make public and cannot ensure that parties who have access to such publicly available information will respect your privacy or keep it secure.
To request the removal of your Personal Information from our blog or community forum, contact us at [email protected]. In some cases, we may not be able to remove your Personal Information, in which case we will let you know if we are unable to do so and why. We are not responsible for the privacy or security of any User Content that you make publicly available on the Website or what others do with the User Content you share with them on the Website. We are not responsible for the accuracy, use, or misuse of any User Content that you disclose or receive from third parties through the Website.
7. YOUR CONSUMER PRIVACY CHOICES
Update your Personal Information. You can amend your name or business-email inside the app under Profile, by emailing [email protected], or by using the contact form below.
Delete Your Workspace. If you no longer wish to use the Services or access your account or account information, you may request us to delete your account by contacting us at [email protected]. This will result in the full, permanent deletion of your account and associated information. We erase all workspace data ≤ 30 days; encrypted backups purge after 7 days. Deletion is permanent and cannot be reversed.
Opt Out of Marketing Messages. If you sign up to receive marketing communications and materials, you consent to receive such communications at the location or contact information you provide.
Email. If you no longer wish to receive email marketing messages from Krobar, you should use the "unsubscribe" option that can be found in each marketing email we send or contact us using the information provided below. Within 10 days of receipt of your unsubscribe request, we will remove you from our distribution list unless you resubscribe.
Region-specific privacy rights.
| If you are… | You may request… | How to exercise | Statutory response time |
|---|---|---|---|
| EU / UK data subject | • Access a copy of your Personal Data • Rectify inaccurate data • Erase data ("right to be forgotten") • Restrict or object to processing • Data portability (JSON/CSV) • Withdraw consent at any time | Email [email protected] | 30 days (Art 12 GDPR) – may extend 60 days for complex requests. |
| California resident (CPRA) | • Know categories & specific pieces collected • Delete Personal Information • Correct inaccurate Personal Information • Opt-out of "sale"/"sharing" *(Krobar does not sell data)* • Limit use of sensitive Personal Information *(none collected)* | Same channels as above. Identity verification required (two-factor email check). | 45 days (Cal. Civ. Code §1798.130) – one 45-day extension permitted. |
| Other U.S. states with similar laws (CO, CT, UT, VA) | Rights equivalent to CPRA above. | Same channels. | 45 days (state statutes). |
Non-discrimination. We will never deny services, charge different prices, or provide different quality because you exercised a privacy right.
Appeals (U.S. state laws). If you believe your request was wrongly denied, email [email protected] with subject "Appeal" within 30 days. We'll respond within 45 days.
Supervisory authority complaints. (EU / UK) You may lodge a complaint with your local data-protection authority. We prefer you contact us first so we can address your concerns promptly.
8. LEAVING OUR WEBSITE AND/OR LINKING TO THIRD PARTIES
We strive to ensure that any information you send us is safe. When you leave this Website and go to another linked website, we are not responsible for the content or availability of the linked website. Please be advised that we do not represent either the third party or you if you enter into a transaction on the third-party website. Further, the privacy and security policies of the linked website may differ from those practiced by us. The inclusion of any link does not imply our endorsement of any other company, its website(s), or its product(s) and/or services(s). We are not responsible for the privacy practices or content of any other website.
9. CHILDREN'S PRIVACY
Our Website and Services are not intended for or directed to individuals under 18 years of age, and we do not knowingly collect any Personal Information from children under the age of 18. If a parent or legal guardian learns that their child provided us with Personal Information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such Personal Information.
10. ADDITIONAL CALIFORNIA PRIVACY RIGHTS (CPRA & Shine-the-Light)
If you are a California resident, you have the right to:
Know the categories and specific pieces of Personal Information we hold about you
Delete your Personal Information
Correct inaccurate Personal Information
Receive a portable copy of your Personal Information
Opt-out of any "sale" or "sharing" of Personal Information
Limit use of Sensitive Personal Information
Krobar does not sell or share Personal Information and does not collect Sensitive Personal Information as defined by the CPRA.
You can exercise these rights by emailing [email protected]. We verify requests via a one-time email code. Authorised agents must provide a signed permission letter and, if applicable, proof of registration with the California Secretary of State.
We will verify your identity and respond within 45 days (one 45-day extension possible).
We will not discriminate against you for exercising any CPRA right.
11. DATA SECURITY POLICY & USER RESPONSIBILITIES
We take the protection of your information seriously and implement reasonable and appropriate physical, administrative, and technical measures to safeguard the information collected through our Website. While we strive to apply commercially reasonable security measures to protect your privacy, please keep in mind that the Internet is not a 100% secure medium for communication, and we cannot guarantee that the information collected about you will always remain private when using our Website and/or Services. Consequently, while we endeavor to protect your Personal Information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.
12. INTERNATIONAL DATA TRANSFERS
Krobar.ai is operated by Trikro LLC in the United States. When you use the Service, your Personal Information may be transferred to—and processed in—countries outside the one in which you live. Those countries may have data-protection laws that differ from yours.
EU / UK safeguards
We rely on:
EU–US Data Privacy Framework (DPF). Our primary hosting and key sub-processors (Heroku/AWS and OpenAI) are self-certified under the DPF, which the European Commission and UK government recognise as providing adequate protection for personal data transferred to the United States.
2021 Standard Contractual Clauses (SCCs). For transfers that fall outside the DPF, we incorporate the European Commission SCCs (Decision EU 2021/914, Module 2) by reference in our Data-Processing Addendum (DPA).
Governing law: Netherlands, Clause 17 Option 1.
Sub-processor authorisation: general written authorisation with a 30-day objection period (Clause 9(a) Option 2).
You may request a copy of the SCCs by emailing [email protected].
Your rights
If you are an EU, EEA, Swiss or UK resident, you may lodge a complaint with your local supervisory authority, but we encourage you to contact us first so we can address your concerns promptly.
13. HOW WE USE AI AND THIRD PARTY MODELS
Krobar.ai combines our own simulation engine with large-language-model (LLM) services provided by OpenAI OpCo LLC ("OpenAI Enterprise API"). Here is what that means for your data:
| What happens | Safeguard |
|---|---|
| Prompt sent to OpenAI | Transport layer security (TLS 1.2+) in transit |
| Retention at OpenAI | ≤ 30 days for abuse monitoring, then permanent deletion |
| Model training | None. OpenAI does not use Enterprise API data to train or improve its models |
| Access isolation | Prompts/outputs are processed in a "closed loop" accessible only to your workspace; they are never visible to other customers |
| Location | United States data centres (covered by DPF and SCCs) |
| Encryption at rest | AES-256 on OpenAI servers |
We recommend a human review of AI-generated content before use or disclosure.
For more information on OpenAI's enterprise privacy commitments, see https://openai.com/enterprise-privacy
Legal bases: contract performance (to deliver the service) and our legitimate interest in providing AI-powered functionality. You may object to this processing at any time by emailing [email protected]; if you do, certain features may be unavailable.
14. CHANGES TO THIS PRIVACY POLICY
As our organization changes over time, this Privacy Policy may change as well. We reserve the right to amend the Privacy Policy at any time, for any reason, without notice to you, other than the posting of the amended Privacy Policy on our Services. We will provide you with notice of material changes by indicating that the Privacy Policy has been updated on our homepage and will indicate the date we made the update above. Your continued use of any of the Services after the changes have been made will constitute your acceptance of the changes. Therefore, please make sure you read any such notice carefully. If you do not wish to continue using the Services under the new version of the Policy, please cease using the Services.
Contact Us
Kromatic
ATTN: Legal
1 Hawthorne Street, Suite 9A
San Francisco, CA 94105