Privacy Policy

01Who we are (Controller)

Kronical AI Ltd is the controller of personal data collected through the Service.

Registered address: 9 Grosvenor Hill Court, 15 Bourdon Street, London, England, W1K 3PX

Company number: 16745932

Contact: [email protected]

01AIllustrative lists and evolving features

Any list of features, integrations, data categories, recipients, or examples in this Privacy Policy introduced by words such as "including", "such as", "for example", or similar wording is illustrative and not exhaustive. The clause containing the list applies to anything of the same kind as the items named, whether or not specifically listed. Where the Service adds new features or integrations that are not specifically named here, the principles in this Privacy Policy apply to those new features by analogy with the most similar named feature. This is an interpretation rule only; it does not expand the categories of personal data we collect, the purposes for which we process it, or the legal bases on which we rely, beyond what is described in the relevant sections of this Privacy Policy. Material changes to our processing or to this Privacy Policy are governed by Section 14 (Changes to this Privacy Policy).

02What personal data we collect

We collect personal data in the following categories:

2.1 Information you provide to us

• Account information: your email address (and your name if you sign up with Google or add it at billing).
• Billing information: when you subscribe to a paid plan or buy a one-off credit pack, we collect billing information including your billing address, country, postal code, tax information where applicable, and card details. The collection happens through our current payment processor's checkout, which presents the payment form on our behalf. We do not store your full card details. After purchase, we hold limited transaction information such as subscription status, plan type, billing period, last four digits of the card, and transaction identifiers, which we use to manage your account and meet our accounting obligations. See Section 5 for more on how the payment processor handles this data.
• User Content: information you submit when configuring or using the agents - including the tickers, sectors and themes covered by your team of agents, plain-English Radar rules, plain-English Conviction reasons, plain-English custom agent descriptions, and any notes, queries or saved searches. This may include indirect information about your trading views or positions.
• Communications: messages you send to us (e.g., support requests, feedback) and any information you include in them.

2.2 Information we collect automatically

• Device and usage data: IP address, browser type, device identifiers, operating system, pages/screens viewed, actions taken, timestamps, referral URLs.
• Log and security data: login events, authentication events and other activity logs that help us keep the Service secure.
• Cookies and similar technologies: as described in Section 7.

2.3 Information created when you use the Service

• User preferences and settings: topics, saved searches, filters, alert preferences, configured integrations, and custom agents you build.
• Interaction data: how you engage with content and features (e.g., viewed items, dismissed alerts, saved items, integrations triggered).

2.4 Sensitive data

We do not intend to collect "special category" data (as defined under UK/EU GDPR) or other sensitive personal information. Please do not submit such information to the Service.

2.5 Account registration

When you create a kronical account, we collect the information you provide directly, including:

• Contact details: your email address (and, if you sign up with Google or add it later at billing, your name).
• Credentials: a password you choose, or, if you sign up with Google, an authentication token from Google (we do not receive or store your Google password).
• Agreements: a record that you confirmed you are 18 or over and agreed to our Terms, this Privacy Policy and our Disclaimer at sign-up, together with the date and time of that agreement.

We use this information to create and secure your account, authenticate you, provide the Service (including any free trial), and communicate with you about it. The legal basis for this processing is the performance of our contract with you and our legitimate interests in operating and securing the Service.

We retain account information for as long as your account is active and for a reasonable period afterwards to meet our legal, accounting and security obligations. You can ask us to delete your account at any time by emailing [email protected].

03How we use personal data

We use personal data to:

• Provide and operate the Service (account creation, authentication, user support).
• Personalise the Service for relevance (for example, using the tickers, Radar rules, Conviction reasons and other preferences you configure to tailor what you see).
• Manage subscriptions and confirm payment status with our payment processor.
• Communicate with you about the Service (including onboarding, service messages and support).
• Maintain security, prevent fraud and abuse, and enforce our Terms of Service.
• Monitor performance, debug issues and improve features and user experience.
• Comply with legal obligations and respond to lawful requests.

04Legal bases for processing (UK/EU GDPR)

Where UK/EU GDPR applies, we process personal data under the following legal bases:

• Contract: to provide the Service and perform our contract with you (e.g., account access, subscription management).
• Legitimate interests: to secure and improve the Service, prevent abuse and understand usage (balanced against your rights).
• Consent: where required (for example, certain cookies or analytics depending on your settings and local laws).
• Legal obligation: to comply with applicable laws, accounting rules and lawful requests.

05How we share personal data

We share personal data only as needed to run the Service, including with:

5.1 Payment processing

Our current payment processor is Stripe, which handles the secure collection of payment details at checkout and processes payments on our behalf. When you make a purchase, Stripe collects and processes the billing information described in Section 2.1 on our instructions, as a processor acting for us.

Separately, Stripe also processes some of that information as an independent controller for its own purposes, including fraud prevention, identity verification, regulatory compliance, and improving its payment services. Where Stripe acts as an independent controller, its processing of your data is governed by Stripe's Privacy Policy.

Kronical AI Ltd is the Merchant of Record for the sale. We are the controller of the billing information we receive and we are responsible for refunds, chargebacks, and customer support relating to your purchase.

5.2 Service providers (processors)

We use trusted third parties to help us deliver the Service. These may include providers for:

• Cloud hosting and infrastructure (for example, AWS).
• Email delivery and customer communications.
• Analytics and product performance measurement.
• Error monitoring and security tooling.
• Customer support tools.
• AI model providers used to generate summaries, briefings and other agent outputs.

We share only what is necessary and require appropriate contractual protections.

5.3 Integrations you connect

The Service allows you to connect third-party services as integrations (for example, Telegram, Discord, Slack, Notion, Google Sheets, or Polymarket). Depending on the integration and the workflow or custom agent you set up, kronical may transmit data to the third-party service, retrieve data from it, or both. When you connect an integration, you authorise kronical to exchange data with that service on your behalf. Data exchanged with a connected third-party service may pass through or be stored by that service, and the third party's own privacy policy and terms will apply to that data independently of this Privacy Policy. You can remove an integration at any time in your account settings.

5.4 AI assistants you connect via MCP

Separately from integrations, the Service offers a Model Context Protocol (MCP) server. You take a kronical API key and connect it to your own AI assistant (for example, Claude, ChatGPT, Gemini, or any other AI system you authenticate). Your AI assistant then queries kronical on your behalf. Queries made by your AI assistant and the responses returned are processed as part of your use of the Service. Once data is returned to your AI assistant, its handling of that data is governed by the terms and privacy policy of the provider of that assistant, and is outside our control.

5.5 Legal and safety

We may disclose personal data where required by law, regulation, legal process, or a lawful request, or where we reasonably believe disclosure is necessary to protect rights, safety and security, investigate fraud, or enforce our Terms.

5.6 Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

06Automated and AI-generated outputs

The Service uses automated systems, including artificial intelligence models, to read and summarise third-party content, monitor for changes and generate briefings and alerts. These outputs may be processed by AI model providers acting as our processors. We do not use automated decision-making that produces legal or similarly significant effects about you.

Where you connect your own AI assistant to the Service via our MCP server (see Section 5.4), that assistant operates under your control and its outputs are not automated decisions made by kronical.

07Cookies and analytics

We use cookies and similar technologies to operate the Service and understand how it is used.

7.1 Types of cookies

• Strictly necessary: required for the Service to function (e.g., login, security).
• Functional: remember preferences and settings.
• Analytics: help us understand usage and improve the Service.

7.2 Managing cookies

You can control cookies through your browser settings. Depending on your location and the technologies we use, we may provide cookie controls or a consent banner for non-essential cookies. Disabling cookies may affect parts of the Service.

08International data transfers

We operate globally and may process and store personal data in multiple regions, including the United Kingdom, the European Economic Area, the United States and other countries where we or our service providers operate (for example, where AWS data centres or our payment processor's systems are located).

Where UK/EU GDPR applies and personal data is transferred outside the UK/EEA, we use appropriate safeguards such as:

• UK International Data Transfer Agreement (IDTA) and/or Addendum.
• EU Standard Contractual Clauses (SCCs).
• Other lawful transfer mechanisms recognised by applicable law.

09Data retention and deletion

We retain personal data only as long as necessary for the purposes described in this Privacy Policy, including to:

• Provide the Service (while your account is active).
• Meet legal, accounting and compliance obligations.
• Resolve disputes and enforce agreements.

Account deletion. You may request deletion of your account by contacting [email protected]. We typically delete or anonymise personal data within a reasonable period after account deletion, subject to legal or operational requirements (for example, security logs, fraud prevention, dispute resolution, or records we must keep for compliance).

10Security

We implement reasonable administrative, technical and organisational measures designed to protect personal data. However, no system is completely secure and we cannot guarantee absolute security.

11Your rights (UK/EU GDPR and similar laws)

Depending on your location and applicable law, you may have rights including:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data (subject to legal and operational limits).
• Restriction: request we limit processing.
• Portability: receive certain data in a portable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent.

To exercise your rights, email [email protected]. We may need to verify your identity before responding. Where UK/EU GDPR applies, we typically respond within one month, although this may be extended where permitted by law.

If you are in the UK, you can complain to the Information Commissioner's Office (ICO). If you are in the EU, you can complain to your local supervisory authority.

12US privacy rights (where applicable)

If you are a resident of certain US states (including California), you may have rights similar to those above, such as the right to access, delete, or correct personal information and to opt out of certain data uses.

We do not sell personal information in exchange for money. If we use third-party analytics that could be considered "sharing" under certain US laws (for example, for cross-context behavioural advertising), we will provide appropriate controls where required.

To make a request, contact [email protected].

13Children

The Service is not intended for children and we do not knowingly collect personal data from individuals under 18. If you believe a child has provided personal data, please contact us and we will take appropriate steps to delete it.

14Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice (for example, via the Service or by email). The "Last updated" date at the top of this page shows when this Privacy Policy was last revised.