Kraymus

Kraymus · Waitlist & private preview

Privacy Policy

Version 2.12 · Effective 20 October 2026

This policy covers Kraymus at kraymus.ai, its launch waitlist and the limited private preview. Public app registration and payments remain unavailable. We will update this policy before the full launch and before materially new processing starts.

1. Who we are and whose information this is

Kraymus FZE, Block C-C01-248, SRTIP Free Zone, Sharjah, United Arab Emirates, operates Kraymus at kraymus.ai. Contact privacy@kraymus.ai for privacy requests or legal@kraymus.ai for legal notices.

We decide how information is used to operate our website, waitlist, accounts, security and support. A business using a workspace normally decides how its customer, lead, student and conversation records are used; Kraymus processes those records to provide the features that business requests. If another business holds your information in Kraymus, contact it first. You may also contact us for help routing a request. A business’s own privacy notice applies to its activities.

A client business generally decides why and how its client records are used. An agency acting only on that business’s documented instructions may be a processor; if it determines its own purposes, it may be a controller, alone or jointly where applicable, for that processing. Roles follow actual activities, not agency branding. Kraymus processes workspace data on the applicable controller’s lawful instructions and remains responsible for its own website, account, security and support processing and its applicable processor duties.

2. Public visits and the waitlist

We store a submitted email address, its original signup time, a source label and the signup-notice version. New submissions must include an affirmative confirmation that you are at least 18, recorded with its confirmation time. This is self-attestation, not verified age; we do not request a birth date or identity document on the waitlist. Older entries were collected without this confirmation and are not treated as age verified. Duplicate submissions do not extend the original three-month retention date. Joining does not create an account and does not currently send a confirmation email. We do not verify email ownership at signup.

We use the address for promotional launch updates about Kraymus opening and how to get access, as requested on the form. This is not permission for unrelated newsletters, sale of the list or ongoing promotional campaigns. We will ask separately before extending that purpose. Withdraw at any time by emailing privacy@kraymus.ai. Any launch marketing email must identify the sender, include our valid postal contact address and provide a clear, functioning opt-out. We must honor opt-outs within the applicable deadline and must not send marketing to an opted-out address.

The waitlist uses a hidden form field and rate limits. Its backend stores a daily changing coded IP-derived value and short-lived attempt counts separately from email records. The counter itself does not store the raw IP address. Hosting and backend providers receive technical information such as IP addresses, request times, URLs and browser details to deliver, secure and diagnose the service.

3. Accounts and workspace content

Authorised preview users provide account details, sign-in information, workspace membership and roles. Their content can include business and brand information, logos and reference images, CRM contacts and deals, messages, comments, tasks, appointments, support records, marketing drafts, pages, forms, courses, AI requests, generated material, schedules and automation history. Only features actually enabled in the workspace process those categories.

We use this information to provide the requested tools, save work, support users, enforce permissions and investigate security or misuse. Where applicable law requires a legal basis, we rely on your consent for requested launch marketing and optional access, providing the service you request for account operations, legitimate interests in proportionate security and support where permitted, and legal obligations for required records. Consent can be withdrawn; another lawful basis may still apply to specific necessary records. Business workspace processing follows that business’s authorized instructions and lawful basis.

Do not upload passwords, API secrets, unnecessary sensitive personal information or other people’s information without an appropriate legal basis. Account holders must provide notices and obtain consent where their own activities require it.

Private business workspaces, including agency-managed businesses, have separate permissions. An agency administrator may have access where authorized to manage that business; ordinary membership of one business does not grant access to another. Workspace administrators control their authorized team access. Support access to private content must be limited to what is necessary and authorized or legally required. A separate business data-processing agreement will be needed for broader customer use; the internal draft is not an executed agreement.

When agency-managed access is enabled, each client is shown the agency’s identity and told that its manager can access and work across all businesses authorized to that agency, including each business’s CRM contacts and records, content and enabled integrations, and export workspace data where allowed. A client can access only their assigned businesses and permitted actions; one client’s membership does not grant access to another client’s business. Connected-platform data remains limited by the supported feature, provider approval, granted permissions and provider data-use rules; agency acknowledgment does not expand them.

Exports create copies outside Kraymus. The person or business receiving them is responsible for their lawful purposes, access, security, retention and rights handling; deleting a record in Kraymus may not delete those copies. Agency/client agreements must identify who handles requests and incidents. A workspace acknowledgment records awareness of management access; it is not marketing consent, consent from people listed in CRM, or a substitute for any required lawful basis or processing agreement.

When a business enables a form, survey or quiz, Kraymus records the name and email you submit, any enabled contact fields, visible-question answers, a quiz score where configured, campaign or referral labels and submission time in that business’s workspace. Quiz scores are calculated from its saved answer key, not by AI. Authorized business members can view and export responses. The separate marketing choice is saved with the submission; submitting alone does not enroll you in a marketing list. The business is responsible for its collection notice, lawful purposes and retention instructions. These public intake pages remain unavailable during the temporary waitlist. Confirmation emails and follow-up require a separately configured workflow.

When booking links are enabled, the visitor supplies a name, email and an 18-or-over confirmation to reserve an appointment and create or match a contact in the selected business’s CRM. Marketing agreement is an optional, separate choice and is recorded without automatically enrolling the visitor in a campaign. A private receipt link allows appointment management; anyone holding its complete link can use it. Kraymus stores a coded verification value rather than the receipt token itself. The link expires seven days after the appointment, and its receipt, retry and marketing-choice record is scheduled for daily cleanup after a further 30 days; the appointment and CRM contact remain ordinary business records subject to the business’s retention and deletion instructions. Public bookings remain unavailable during the temporary waitlist. No confirmation email or reminder is sent by this booking feature.

4. Social platforms and Google: authorization first

A connection is optional. The provider’s authorization screen identifies the account and requested permissions; Kraymus receives only the data that the approved API, granted permissions and eligible account allow. A feature being described here does not mean its API or approval is available. You can decline a connection or revoke access. We do not ask for social-platform passwords.

The private preview currently has connections for Instagram professional accounts, Facebook Pages, Threads, TikTok and YouTube. Available actions remain limited by platform approvals, account eligibility and Kraymus’s implementation. Messenger, WhatsApp Business and Meta advertising features require their own supported setup and permissions. A regular WhatsApp or WhatsApp Business phone app alone does not connect its inbox to Kraymus.

LinkedIn and X are planned integrations. Additional possible integrations include Pinterest, Bluesky and Snapchat. They are not available simply because they are listed in this policy. Before enabling one, we will describe the actual data and purposes, request the necessary permissions, and update this notice and consent flow where required.

5. What connected APIs can provide and why

6. TikTok and YouTube in the preview

TikTok imports authorized profile and available public-video metadata and statistics for workspace analytics. The current TikTok connection does not provide direct-message inbox access. The private video test offers Only me posting or delivery to your TikTok inbox for completion there; it does not make a public post. The test transfers the selected file and disclosures and retains a fingerprint, provider reference and processing record rather than storing the original clip as a Kraymus asset. TikTok processes delivered content under its Privacy Policy. Verified TikTok revocation events remove encrypted credentials and imported analytics; connection identifiers and test history may require a separate deletion request.

The YouTube specialist also reads selected public topic/reference videos and available comments to prepare channel research and original drafts. When you ask it to analyze or draft, relevant channel/video data, public reference metadata and selected comment text may be processed by our AI service providers with your request and business Knowledge Hub context. A Public topic field sends only your chosen topic to YouTube search, rather than your private brief or CRM. Optional editing permission enables reviewed video details, thumbnails, banners, timed subtitles and individual comment replies on your own channel. Kraymus requires your explicit confirmation before applying these changes; automatic YouTube comment replies are not enabled. Research snapshots and associated AI run drafts expire after 30 days. Other imported data remains subject to its applicable provider rules and deletion controls.

The YouTube creator workflow transfers a reviewed H.264 MP4 in resumable chunks to YouTube as a private video. Kraymus does not keep a library copy or send the video to an AI processor. A temporary encrypted upload-session address expires after 24 hours; upload receipts expire after 30 days. The current limits are 1440p, 14 minutes and 3 GiB. Explicit review can also create a private playlist from your own videos or hide/restore an individual comment on your channel without banning its author. Generated thumbnail options are original AI artwork that you review separately; native thumbnail testing takes place in YouTube Studio.

Kraymus uses YouTube API Services, including for YouTube videos and Shorts. Read access imports channel identifiers, names, thumbnails, video metadata and available statistics. Separate upload authorization is needed for uploads; the current review-test flow sends approved clips privately. Google handles data under the Google Privacy Policy. You can revoke Kraymus through Google’s account permissions. See data deletion to request removal of stored Google or YouTube data.

Google sign-in provides account identity. A separate Google Workspace connection may request Gmail, Calendar and selected Drive permissions; requesting a scope does not mean every related feature has been implemented. Kraymus’s use and transfer of Google API information is subject to the Google API Services User Data Policy, including its Limited Use requirements. Connecting any Google feature is separate from joining the waitlist.

Google API information must be used only for the disclosed, authorized features and applicable Limited Use purposes. It must not be sold, transferred for advertising or used for unrelated profiling. Human access to protected Google data is restricted by that policy. New permissions or uses require appropriate explanation and authorization before access; a general connection is not consent to unrelated processing. See data deletion for requesting removal. The launch review must verify provider-specific refresh, revocation and deletion deadlines before these features are made generally available.

7. AI processing and automated actions

When you use an AI feature, its service provider may process your prompt and the workspace context needed for that request, such as selected business information, approved brand material and images. AI processors help create drafts, images, plans or responses; output can be inaccurate and must be reviewed. Waitlist records are not sent to AI processors. The private video test does not send your selected clip to an AI processor.

Creating an account does not activate posting, messaging or ad spend. You choose connections, destinations and permissions. A schedule or automation you activate can run within its saved settings without a new prompt each time. Information received from a message or lead may be added to CRM or used for an authorized follow-up rule. Review these settings and disable rules when no longer wanted. Third-party account access does not authorize unrelated AI training or unrelated marketing uses.

A Knowledge Hub supplies relevant context for the selected business, such as its services, tone, offers, logos and approved references. Treat names, messages, lead details and reference uploads as personal or confidential information where applicable; submit only what the feature needs and what you are authorized to process. Do not include payment-card details, authentication secrets or unnecessary sensitive information. This service permission does not grant us a general licence to sell private workspace content or train unrelated models. AI-provider retention and contractual data-use terms still need confirmation before broader launch; no blanket zero-retention or no-provider-training guarantee is made here.

Automation history saves run times, outcomes, the settings used and available task or notification receipts. These records can include rule names, action text and linked business-record identifiers. Relevant saved settings, outcomes and receipts from up to 20 recent runs for the loaded rules may be included in business AI requests to explain or plan work. Viewing or refreshing history does not rerun a workflow. History and saved AI plans follow the applicable business-record retention and deletion controls; they do not share the waitlist’s three-month expiry.

If you link a private Slack or Telegram team account, Kraymus receives the platform account, workspace/chat and event identifiers, your message text and delivery metadata. A short-lived pairing code is stored only as a hash and requires confirmation inside Kraymus before messages are associated with your user and selected business. AI replies are off by default. If you enable them for a confirmed linked account and the required bot setup and provider-policy checks are complete, new messages can use your business AI credits and approved Knowledge Hub context to prepare saved AI-team plans and send one private answer to that account. This sends relevant approved context to our AI processors and the answer to Slack or Telegram. Existing queued requests do not start AI when you enable replies. Otherwise, requests can be opened as an unsent CEO brief. These chats do not automatically publish posts, message customers, delete records or spend advertising budgets. Disable AI replies to stop new planning; a reply already in transit may still arrive. Uncertain delivery is recorded without automatic resend. Daily cleanup removes request records older than 30 days and coded delivery fingerprints older than 60 days. Separately saved AI plans remain under the account or business’s ordinary deletion controls; removing the channel request does not erase those plans. Earlier deletion may be required by a request or the platform’s rules. Revoke the linked account in Team channels to stop new intake. Copies already held by Slack or Telegram follow those providers’ policies. Slack’s data-use restrictions also govern external AI processing; enabling replies does not waive them. These team control chats are separate from customer-facing social inboxes.

8. Service providers, sharing and international processing

Hostinger hosts the website and app server. Supabase provides authentication, database, Storage and backend functions. When you email a kraymus.ai contact address or reply to app@kraymus.ai, Cloudflare Email Routing receives the message and forwards it to our Google Workspace mailbox, where it is stored so we can handle your request. Supabase Auth sends account, invitation and password-recovery emails through Cloudflare Email Sending, which receives each message, including your email address, the subject, content and any sign-in or recovery link, and delivers it from app@kraymus.ai to your email provider. AI service providers process requests when you invoke AI features. Our service-provider directory identifies the current providers without model branding. Connected social platforms and Google receive the content or API requests needed for the features you authorize and apply their own terms and privacy notices.

We are based in the UAE. The current Kraymus Supabase project is in the ap-northeast-1 region in Japan; this does not establish the location of every provider log, backup or support operation. Other providers can process data internationally. Relevant contractual and transfer safeguards must be assessed for a business’s use and jurisdiction before broader launch.

We may disclose information where necessary to comply with applicable law, respond to a valid request, protect people or systems, or investigate misuse. A future change of operator must respect the existing purposes and applicable notice requirements. We do not use waitlist signup as consent to sell its email address or share it for unrelated advertising.

9. Retention and deletion

Each active waitlist record is scheduled for deletion three calendar months after its original signup by an hourly cleanup. You may request earlier removal. Separate coded rate-limit records older than two hours are cleared during later submissions.

Preview accounts and workspace records remain while needed to provide the account or until removed through the app or a verified request. Imported API data is also subject to the provider’s retention, refresh and revocation rules, which may require earlier deletion. It must not be kept indefinitely merely because an account once connected. Do not assume revoking a provider token automatically erases every stored record in Kraymus. Google and YouTube data-removal requests can be made using the instructions below.

Account settings provides confirmation-based account or owned-business deletion and reports cleanup progress. Cancellation alone does not delete data. Copies in provider backups, logs, already-delivered messages or already-published posts are separate. Limited request or cleanup records may be retained to finish the request or meet legal obligations. Provider log and backup periods depend on their configured service; we do not promise instant erasure of all such copies.

Any necessary retention after a request must have a specific purpose, such as completing cleanup, preventing repeated abuse or meeting a legal obligation, and be limited accordingly. Information retained for such a purpose must not be reused for marketing. The launch review must establish the actual support, security-log and backup schedules; this notice does not claim that every provider copy has already been erased or that an unverified backup-expiry period is guaranteed.

10. Your rights and choices

Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection, withdraw consent, or complain to the relevant data-protection authority. Contact privacy@kraymus.ai or use the relevant account controls. We may ask for information proportionate to verifying identity and workspace authority; do not send passwords, access tokens or identity documents unless a necessary, secure process has been agreed. We will explain any legal reason for a refusal or limitation. Where the GDPR applies, the normal response period is one month; a permitted extension requires an explanation and timely notice. Other applicable deadlines, including shorter platform-data deletion deadlines, still apply. This notice does not replace rights you have under local law.

You can manage connected permissions at the provider, stop schedules or automations in Kraymus, and ask to leave the waitlist. Kraymus is initially for users aged 18 or over; do not join or provide information if you are under 18. The waitlist requires a confirmation of this age rule, but it is not identity or age verification. If we learn that an underage person has supplied information, we will investigate and remove or restrict it as appropriate and as required by law. A parent or guardian may contact privacy@kraymus.ai about a child’s information. Public app registration remains closed, and no parental-consent programme or children’s service is offered.

11. Cookies, security and changes

Our own public waitlist code includes no advertising pixels or third-party analytics tools. Sign-in and preferences use browser storage. Read the Cookie Policy for the current inventory and controls.

We use access controls and upload restrictions, but no online service can guarantee complete security. Report a suspected security or privacy incident to security@kraymus.ai without sending credentials or exposing other people’s information. We will investigate and provide notices to affected people or authorities when applicable law requires them. This policy is not a security certification or a claim that every integration has passed a complete audit.

We will publish versioned updates before full launch or materially new data uses, notify affected users where required and seek new consent where required. A future policy update does not retroactively authorize a new use of previously collected data. Planned features are not described as already operational.