Who We Are and What This Policy Covers

Krumzi is operated by ACT Software Solutions S.R.L., Street Penes Curcanul, 14, Romania. We are responsible for the personal data described in this policy. You can contact us at hello@krumzi.com.

This policy covers the Krumzi website, design editors, AI features, account services, and integrations, including the ChatGPT plugin and connections using the Model Context Protocol (MCP). Personal data means information that identifies you or can be linked to you. Our Terms & Conditions explain who can use the service and the rules for doing so.

Data We Collect

Account and profile details. Your email address, name, sign-in information, account preferences, and onboarding answers. If you sign in with Google or X, we receive the account identifiers and profile details made available for sign-in, such as your name, email address, and profile image.
Designs and content. Your prompts, editing instructions, AI conversation history, uploaded media, supplied URLs, design layers, generated assets, previews, and exports. Brand information can include logos, colors, fonts, website content, and the preferences and instructions saved in Brand Mind.
Billing and usage. Your plan, subscription status, payment references, transaction history, credit balance, and feature usage. Our payment processors collect payment details through their checkout services.
Connected accounts. Connection identifiers, permissions, authorization records, and credentials needed to maintain connections you authorize. The ChatGPT/MCP and Meta sections below explain these separately.
Support and feedback. Messages, attachments, and account details you provide when you contact us, report a problem, or submit feedback.
Technical and activity data. IP addresses, browser and device information, visited pages, interaction events, timestamps, request and error details, performance measurements, and session recordings where enabled.

How We Use Data

We use this information to create and secure your account, generate and edit designs, save your work, render and deliver files, run connections you authorize, manage subscriptions and credits, and respond to support requests. AI processing can include your current instructions, relevant design and conversation history, brand context, and images or other content needed for the task.

We also use account and technical information to diagnose failures, prevent abuse, understand product usage, improve the service, measure marketing campaigns, and send service notices or marketing communications where permitted. You can ask us to stop marketing emails by contacting hello@krumzi.com.

Where data protection law requires a legal basis, we rely on performing our agreement with you to deliver the service, legal obligations for required records and disclosures, and legitimate interests in security, support, and improving our business where those interests do not override your rights. Where consent is required, it must be obtained separately; this policy is not a substitute for that consent. You can withdraw consent without affecting earlier lawful processing.

Who Receives Data

We use external providers to operate Krumzi. The data involved depends on the feature you use; a request is not necessarily sent to every provider listed here.

AI processing. Vercel AI Gateway routes model requests to providers such as Anthropic, OpenAI, Google, and Moonshot AI, depending on the model and feature. These requests can include prompts, relevant conversation and brand context, design content, and media. Some features also call AI providers directly. OpenAI supports audio transcription. Image generation includes Google models; background removal uses Replicate with Bria models.
Hosting, authentication, storage, and delivery. Vercel, Supabase, Amazon Web Services, and Bunny CDN process the account data, application records, files, and network requests needed to run the service.
Payments. Polar processes current subscriptions. LemonSqueezy continues to support legacy subscriptions and related billing records.
Diagnostics and analytics. Sentry, PostHog, Plausible, and Ahrefs help us investigate errors, measure performance, and understand usage. This can involve account identifiers, device and request details, interaction events, and browser session recordings. Error context can include URLs or content involved in a failed operation.
Advertising and support. Meta advertising tools, including Meta Pixel, and Google Ads help measure website advertising and conversions. Featurebase supports customer chat, feedback, and product updates, using account identity, plan details, and information you submit when relevant. Plunk delivers service and lifecycle emails, processing recipient addresses, message content, and relevant account events such as plan or billing updates.
Services you connect. ChatGPT and other MCP clients receive tool results when you use the connection. Meta receives content you instruct Krumzi to publish. See the connection-specific sections below.

Brand members can access shared brand information according to their permissions. Files delivered through public asset URLs can be accessed by people who have those URLs. We may also disclose information when required by law, to protect rights and safety, or as part of a business transfer, subject to applicable law. Other disclosures require an appropriate legal basis, including your consent where required.

AI services and connected applications have their own data handling terms and controls. We do not promise that every provider uses the same retention or model training settings. Contact us if you need information about the processing of a particular request before supplying confidential content.

Cookies, Browser Storage, and Analytics

Krumzi uses cookies and browser storage to maintain sign-in sessions, remember preferences, and support analytics and advertising. PostHog can associate usage with a signed-in account. Session recording is enabled on selected application routes, and Sentry can capture browser sessions for troubleshooting. These recordings concern activity on Krumzi, not unrelated ChatGPT conversations.

You can block or clear cookies and local storage in your browser and use the advertising controls offered by Google and Meta. Blocking essential storage can prevent sign-in or other features from working. Contact us to exercise your privacy rights or ask about analytics processing; clearing browser storage does not itself delete records already held by us or our providers.

ChatGPT Plugin and Other MCP Connections

When you connect Krumzi to ChatGPT or another compatible AI application, that application can use Krumzi tools through your authorized account. This section applies to the information exchanged through that connection.

Connecting Your Account

You sign in on Krumzi and authorize the connection through OAuth. We store the client identifier and registration details, the association with your Krumzi account, the permissions granted, authorization records, and token-related records needed to operate and revoke access. The connected application receives access credentials for the connection, not your Krumzi password. Do not put passwords, API keys, verification codes, payment card details, government identifiers, or sensitive health information in design prompts or files.

What Krumzi Receives and Uses

We receive the arguments the connected application sends to a Krumzi tool. These can include design briefs, text to place on a design, editing instructions, brand and design identifiers, sizes, export options, and supplied asset URLs or content. The application may select relevant information from your conversation to construct that request. Connecting Krumzi does not give it general access to your entire ChatGPT history or unrelated conversations.

We check your account permissions and use relevant saved brand information, including Brand Kit and Brand Mind, and existing design context to carry out the task. Generation and editing instructions and the resulting Krumzi AI conversation can be saved with your work. Processing can involve the AI, hosting, rendering, and storage providers described above, including retrieving web content or importing media for your request. Connection requests also produce technical, security, error, and usage records needed to operate the service and account for credits.

What Goes Back to the Connected Application

Depending on the tool, we return brand names, identifiers and membership roles, saved colors, fonts and logo links, design names and identifiers, dimensions, status, previews, generated asset and export URLs, and editor links. These results are supplied to the connected application, which may include them in your conversation. Only connect an account whose accessible brands and designs you are authorized to use through that application.

Preview, generated-image, and export URLs can be public. Anyone with such a URL may be able to view or download the file without signing in. Editor links require appropriate Krumzi account access. Treat public file URLs as shareable links and avoid using this workflow for content that must remain accessible only to authenticated viewers.

OpenAI handles information it receives through ChatGPT under its own Privacy Policy and your applicable account settings and terms. Other connected applications have their own policies. Krumzi cannot delete copies of tool results or files already held by those applications or downloaded by others.

Disconnecting and Deleting Data

In Krumzi, open Settings → Connected apps and disconnect the application to revoke its Krumzi authorization. This blocks subsequent requests using that authorization, including token refreshes. Work authorized before disconnection may still finish. You can also remove the connection in the other application using its controls.

Disconnecting removes the associated authorization grants, pending authorization codes, and stored refresh-token records. It does not delete your account, saved designs, AI history, generated files, exports, or copies held by the connected application. For deletion of Krumzi-held data, contact hello@krumzi.com and identify the account and content concerned. The retention and deletion section below applies.

Instagram and Facebook (Meta Platforms) Data

If you connect an Instagram professional account or Facebook Page, Krumzi uses Meta's APIs to schedule and publish content you instruct it to publish. These website features are separate from the ChatGPT/MCP tools, which do not publish or schedule social posts.

Connection Data and Its Use

We receive and store the external account identifier, username or Page name, avatar, follower count, and an access token for the connection. Connections belong to a brand in your Krumzi account. We use this data to show connection details and status and to publish the content you schedule or otherwise instruct us to publish. We do not use these connections to read direct messages or contacts.

Security and Disconnection

Stored Meta access tokens are encrypted and used by our server-side systems to call Meta's APIs. Disconnecting a social account deletes its connection record and stored token. Meta deauthorization and data deletion callbacks also remove the associated connection data. You can request deletion by emailing hello@krumzi.com.

Removing a connection does not itself remove posts already published to Meta or delete the original designs and exports stored in Krumzi. Content published on Instagram or Facebook is also handled under Meta's own terms and privacy policy. Manage published posts using the relevant platform's controls.

Retention and Deletion

Accounts and saved work. Account details, brands, designs, AI conversation history, and related files are retained to provide your account and saved-work features until removed or a deletion request is processed, subject to legal and security needs. Disconnecting an integration or cancelling a subscription is not an account deletion request.
MCP authorization. Authorization codes expire after 10 minutes; access tokens expire after one hour. Refresh tokens expire after 90 days, with a new validity period when refreshed. Expiry stops use of a credential but does not necessarily delete its database record. Authorization grants remain until revoked. Disconnecting in Krumzi deletes the connection's grants and associated code and refresh-token records.
Files, logs, backups, and required records. Deleting a design or upload entry does not necessarily remove its AI history, stored source files, rendered exports, or CDN copies. Technical logs and provider backups follow their applicable retention settings; billing, dispute, and security records may need to be kept longer for their stated purposes or legal obligations. Contact us for the retention details applicable to a request.

Email hello@krumzi.com to request deletion of your account or specific content, including associated AI history and files. We may need to verify account ownership before acting. We will explain any information that must be retained and any limits on removing provider backups, cached files, or copies already shared with other services. We do not promise that disconnecting or deleting a library entry instantly purges every copy.

Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, or receive a portable copy of your personal data, restrict processing, object to processing based on legitimate interests or direct marketing, and withdraw consent. Contact hello@krumzi.com to make a request. We will respond within the time required by applicable law.

You can also complain to the data protection authority where you live or work, or to Romania's ANSPDCP. These rights can be subject to legal exceptions, including requirements to retain certain records and protect the rights of others.

Security and International Transfers

We use authentication, access controls, and other technical and organizational measures to protect personal data. No internet service or storage system is completely secure. Public file links described above are not protected in the same way as signed-in access to your account.

Krumzi and its providers may process information in countries outside your country of residence, including outside the European Economic Area. Applicable data protection law may require safeguards such as an adequacy decision or contractual protections for these transfers. Contact us for information about the providers and safeguards applicable to your data. Using Krumzi is not a blanket consent to waive your data protection rights.

Age Eligibility and Children's Privacy

Krumzi accounts and services are for adults aged 18 and over, including access through ChatGPT or another connected AI application. We do not offer accounts to children or knowingly collect personal data directly from people under 18 as account holders. If you believe a person under 18 has created an account or supplied personal data directly to us, contact hello@krumzi.com so we can investigate and take appropriate action, including restricting access and removing data where required. Do not upload information about children unless you have the necessary rights and a lawful basis to do so.

External Websites and Applications

Other websites and applications linked from Krumzi operate under their own privacy policies. Review those policies before giving them personal data. Our policy describes Krumzi's processing and does not replace theirs.

Changes to This Policy

We will post updates on this page and change the date above. Where required, we will provide notice of material changes or obtain consent before a new use of your data begins.

Contact Us

For privacy questions, access requests, or deletion assistance, email hello@krumzi.com. Include enough information to identify your account and request, but do not send your password or authentication codes.