Effective date: July 12, 2026 Last updated: July 13, 2026
This Privacy Policy explains how Acru Technologies, Inc., or Acru, we, us, collects, uses, and shares information when you use the website at acru.tech and related services, or the Service. By using the Service you agree to this Policy. If you have questions or requests, contact us at privacy@acru.tech.
Acru is a travel rewards and credit card optimization service. We help you choose credit cards, plan trips, and find award flight availability using your travel profile and AI assisted tools.
The data controller for purposes of European and United Kingdom law is Acru Technologies, Inc. Contact: privacy@acru.tech. Mailing address: 3997 W 1180 N, Lehi, UT 84048, USA.
A. Information you provide directly. Account information: email address, name, and phone number used only for two factor authentication codes via SMS, managed through our authentication provider. Providing a phone number is never a condition of purchase and we do not use it for marketing. Travel profile: information you enter to personalize recommendations, such as home city and airport, how often and why you travel, frequent and dream destinations, airline and hotel preferences, spending categories, and the credit cards you tell us you hold. Card entries are self reported names only. We do not ask for, collect, or store full card numbers, expiration dates, CVVs, or loyalty program passwords. Do not submit passwords, security codes, or authentication credentials for any airline, hotel, bank, or loyalty program. Content you create: chat messages with the Acru agent, saved trips, saved searches, card progress tracker entries, and referral codes you generate or use. Communications: messages you send to support, feedback, survey responses, and email and notification preferences.
B. Information collected automatically. Usage and device data: IP address, browser type, operating system, pages viewed, features used, approximate request metadata, timestamps, and referral URLs. Diagnostics and security: error logs, performance logs, and security events collected through our error monitoring provider to operate and secure the Service. Storage technologies: first party cookies and browser local storage for authentication, preferences, and session continuity, for example your saved cards list and recent chats. We do not use advertising cookies, ad networks, or cross site tracking pixels.
C. Information from third parties. Payment information: processed by Stripe. Stripe collects and stores payment card details directly. We do not store full card numbers. We retain limited billing identifiers such as Stripe customer ID, subscription ID, subscription status, and payment history for accounting. Service providers: authentication provider, hosting and database infrastructure, AI processing providers, transactional email provider, and cloud browser service that performs award searches.
We do not intentionally collect sensitive personal data as defined by applicable law, such as government IDs, precise location, health, political beliefs, or biometric data, and we ask that you not submit it.
We use personal information only for the purposes described below. We provide and personalize the Service, including card recommendations, AI concierge responses, Trip Optimizer results, and alerts (lawful basis: performance of contract, legitimate interests in operating the Service). We authenticate you and secure your account, including two factor authentication (lawful basis: performance of contract, legitimate interests in security). We process payments, manage subscriptions, handle renewals and cancellations, and operate referrals (lawful basis: performance of contract, legitimate interests, legal obligation for tax and accounting). We communicate with you, send transactional messages, security notices, and where permitted, the Acru newsletter and product updates (lawful basis: performance of contract, consent where required, legitimate interests). We monitor, debug, prevent abuse, and enforce our Terms (lawful basis: legitimate interests, legal obligation). We comply with law and protect rights and safety (lawful basis: legal obligation, legitimate interests).
Where we rely on legitimate interests, we have balanced those interests against your rights. Where we rely on consent, you may withdraw consent at any time without affecting prior processing.
To generate recommendations and power the Acru agent, we send relevant parts of your travel profile and chat messages to our AI providers through their developer APIs. Current categories include large language model providers for conversation and recommendation generation.
Per those providers API terms, data submitted through their APIs is not used to train their foundation models. We do not use your personal information to train AI models ourselves that are shared with others. We may use deidentified or aggregated data to improve the Service, which no longer identifies you.
Do not enter sensitive personal information into the agent that you would not want processed by these providers. Acru automated recommendations are informational only. We do not make solely automated decisions about you that produce legal or similarly significant effects, such as credit decisions. Acru never decides whether you get a card, only the card issuer does.
We do not sell your personal information and we do not share it for cross context behavioral advertising. We have not sold or shared personal information for such advertising in the preceding 12 months.
We share information only as follows. A. Service providers under contract who process information on our behalf and only to deliver their service to us: hosting, database, and infrastructure; authentication and two factor delivery; payment processing via Stripe; AI processing via API; transactional email delivery; error monitoring and diagnostics; and the cloud browser service for award searches. Each provider is bound by contract to protect your information and to use it only for its service to us. A current list of providers and their functions is available on request at privacy@acru.tech. B. Legal and safety: to comply with law, court order, or regulatory request, to enforce our Terms, to protect rights, safety, and security of Acru, users, and others. C. Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to continued protection of your information.
We do not disclose your phone number used for two factor authentication to any third party for marketing.
Trip Optimizer queries third party award search and travel sites to retrieve availability. Those sites have their own terms and privacy practices, which we do not control. We are not responsible for their content or practices.
We use only first party, functional cookies and local storage for authentication, preferences, and basic analytics and diagnostics. We do not use advertising cookies or cross site tracking pixels, and we do not sell or share cookie data for targeted advertising.
You can control cookies through your browser settings. Some features, such as staying signed in, may not work without them. Our Service does not currently respond to browser Do Not Track signals because there is no industry standard, and because we do not track you across other sites, honoring them would not change our behavior.
We retain personal information only as long as needed for the purposes described, unless longer retention is required by law. Account and travel profile data is retained while your account is active and deleted or anonymized within 30 days after an account deletion request, subject to the exceptions below. Chats, saved trips, and the card tracker are retained while your account is active and deleted when you delete them or your account. Billing identifiers, Stripe customer and subscription IDs, transaction history, and tax records are retained up to 7 years for tax, accounting, dispute, and legal obligations, even after account deletion. Usage logs and security events are retained for up to 12 months for security, debugging, and abuse prevention, then deleted or aggregated. Error logs are retained for up to 90 days, then deleted or aggregated. Email preferences are retained until you opt out, plus a suppression record retained indefinitely so we do not email you again after opt out. Referral records are retained for up to 3 years for fraud prevention and accounting.
Deidentified or aggregated data that no longer identifies you may be retained without a fixed period.
We use industry standard safeguards, including encryption in transit using TLS, encryption at rest where appropriate, two factor authentication, role based access controls, and logging. Access to personal information is limited to those who need it to operate the Service, and our service providers are contractually required to protect it. No method of transmission or storage is 100 percent secure, and we cannot guarantee absolute security.
We maintain an incident response process to investigate, contain, and remediate security incidents involving personal information. Where applicable law requires, we will notify affected users and regulators without undue delay.
You can update profile data in the app and opt out of marketing email via the unsubscribe link. Service emails such as receipts and security notices will still be sent while you maintain an account.
To exercise access, correction, deletion, or portability rights, email privacy@acru.tech. We will verify your identity, typically via email verification and account information matching, before acting. We will respond within 45 days, with a possible 45 day extension where permitted by law, and will explain any extension. We will not discriminate against you for exercising any right.
A. United States state residents, including California, Colorado, Connecticut, Virginia, Utah, and similar laws. Categories of personal information we collect in the last 12 months: identifiers such as email and IP address, commercial information such as subscription status, internet activity such as usage logs, and inferences such as travel preferences derived from your profile. Sources: directly from you, automatically from your device, and from service providers such as Stripe. Purposes and recipients: as described in Sections 3 and 5.
You have the right to know the categories and specific pieces of personal information we hold about you, to access and obtain a portable copy, to correct inaccuracies, to delete your personal information subject to legal exceptions such as tax and security records, and to data portability. We do not sell personal information and do not share it for cross context behavioral advertising, and we have not done so in the preceding 12 months, so there is no opt out to exercise. If that ever changes, we will update this Policy and provide the required opt out and notice before doing so. We do not use or disclose sensitive personal information for purposes that would require a limit use right.
You may appeal a denial of a request by replying to our decision email within 60 days. We will review and respond in writing within 45 days, with an explanation of the result. California residents may also contact the California Department of Consumer Affairs Complaint Assistance Unit if a complaint is not resolved. You may designate an authorized agent to make a request on your behalf by providing written permission and verifying your identity, or through a valid power of attorney. We may still require direct verification for security.
B. European Economic Area, United Kingdom, and Swiss residents. Acru is the controller. In addition to the rights above, you have the right to restrict or object to processing based on legitimate interests, to withdraw consent at any time, the right not to be subject to solely automated decisions with legal or similarly significant effects, which we do not make, see Section 4, and the right to lodge a complaint with your local supervisory authority, for example in the EU your member state authority, in the UK the ICO, or in Switzerland the FDPIC. You may object to processing based on legitimate interests by contacting us and explaining your particular situation.
We are based in the United States and process data there and in other countries where our service providers operate. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.
Where required by law for transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, the UK Addendum or UK International Data Transfer Agreement, and the Swiss equivalents, plus supplementary measures where needed. You may request a copy of the relevant safeguards by contacting privacy@acru.tech.
The Service is for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us at privacy@acru.tech and we will delete it promptly.
We may update this Policy from time to time. We will post the new version with an updated Last updated date and, where appropriate, notify you by email or in product notice. Material changes will be notified at least 30 days in advance where required by law. Continued use after the new effective date constitutes acceptance.
Acru Technologies, Inc. 3997 W 1180 N Lehi, UT 84048, USA Email: privacy@acru.tech For billing or account support: support@acru.tech