# Acru Privacy Policy

**Effective date:** July 12, 2026
**Last updated:** July 13, 2026

This Privacy Policy explains how **Acru Technologies, Inc.**, or Acru, we, us,
collects, uses, and shares information when you use the website at **acru.tech**
and related services, or the Service. By using the Service you agree to this
Policy. If you have questions or requests, contact us at **privacy@acru.tech**.

---

## 1. Who we are and how to contact us
Acru is a travel rewards and credit card optimization service. We help you choose
credit cards, plan trips, and find award flight availability using your travel
profile and AI assisted tools.

The data controller for purposes of European and United Kingdom law is Acru
Technologies, Inc. Contact: privacy@acru.tech. Mailing address: 3997 W 1180 N,
Lehi, UT 84048, USA.

## 2. Personal information we collect
**A. Information you provide directly.** Account information: email address, name,
and phone number used only for two factor authentication codes via SMS, managed
through our authentication provider. Providing a phone number is never a condition
of purchase and we do not use it for marketing. Travel profile: information you
enter to personalize recommendations, such as home city and airport, how often and
why you travel, frequent and dream destinations, airline and hotel preferences,
spending categories, and the credit cards you tell us you hold. Card entries are
self reported names only. We do not ask for, collect, or store full card numbers,
expiration dates, CVVs, or loyalty program passwords. Do not submit passwords,
security codes, or authentication credentials for any airline, hotel, bank, or
loyalty program. Content you create: chat messages with the Acru agent, saved
trips, saved searches, card progress tracker entries, and referral codes you
generate or use. Communications: messages you send to support, feedback, survey
responses, and email and notification preferences.

**B. Information collected automatically.** Usage and device data: IP address,
browser type, operating system, pages viewed, features used, approximate request
metadata, timestamps, and referral URLs. Diagnostics and security: error logs,
performance logs, and security events collected through our error monitoring
provider to operate and secure the Service. Storage technologies: first party
cookies and browser local storage for authentication, preferences, and session
continuity, for example your saved cards list and recent chats. We do not use
advertising cookies, ad networks, or cross site tracking pixels.

**C. Information from third parties.** Payment information: processed by Stripe.
Stripe collects and stores payment card details directly. We do not store full
card numbers. We retain limited billing identifiers such as Stripe customer ID,
subscription ID, subscription status, and payment history for accounting. Service
providers: authentication provider, hosting and database infrastructure, AI
processing providers, transactional email provider, and cloud browser service that
performs award searches.

We do not intentionally collect sensitive personal data as defined by applicable
law, such as government IDs, precise location, health, political beliefs, or
biometric data, and we ask that you not submit it.

## 3. How we use your information and lawful bases
We use personal information only for the purposes described below. We provide and
personalize the Service, including card recommendations, AI concierge responses,
Trip Optimizer results, and alerts (lawful basis: performance of contract,
legitimate interests in operating the Service). We authenticate you and secure
your account, including two factor authentication (lawful basis: performance of
contract, legitimate interests in security). We process payments, manage
subscriptions, handle renewals and cancellations, and operate referrals (lawful
basis: performance of contract, legitimate interests, legal obligation for tax and
accounting). We communicate with you, send transactional messages, security
notices, and where permitted, the Acru newsletter and product updates (lawful
basis: performance of contract, consent where required, legitimate interests). We
monitor, debug, prevent abuse, and enforce our Terms (lawful basis: legitimate
interests, legal obligation). We comply with law and protect rights and safety
(lawful basis: legal obligation, legitimate interests).

Where we rely on legitimate interests, we have balanced those interests against
your rights. Where we rely on consent, you may withdraw consent at any time
without affecting prior processing.

## 4. How AI is used
To generate recommendations and power the Acru agent, we send relevant parts of
your travel profile and chat messages to our AI providers through their developer
APIs. Current categories include large language model providers for conversation
and recommendation generation.

Per those providers API terms, data submitted through their APIs is not used to
train their foundation models. We do not use your personal information to train AI
models ourselves that are shared with others. We may use deidentified or
aggregated data to improve the Service, which no longer identifies you.

Do not enter sensitive personal information into the agent that you would not want
processed by these providers. Acru automated recommendations are informational
only. We do not make solely automated decisions about you that produce legal or
similarly significant effects, such as credit decisions. Acru never decides
whether you get a card, only the card issuer does.

## 5. How we share information
**We do not sell your personal information and we do not share it for cross
context behavioral advertising.** We have not sold or shared personal information
for such advertising in the preceding 12 months.

We share information only as follows. **A. Service providers** under contract who
process information on our behalf and only to deliver their service to us:
hosting, database, and infrastructure; authentication and two factor delivery;
payment processing via Stripe; AI processing via API; transactional email
delivery; error monitoring and diagnostics; and the cloud browser service for
award searches. Each provider is bound by contract to protect your information and
to use it only for its service to us. A current list of providers and their
functions is available on request at privacy@acru.tech. **B. Legal and safety:**
to comply with law, court order, or regulatory request, to enforce our Terms, to
protect rights, safety, and security of Acru, users, and others. **C. Business
transfers:** in connection with a merger, acquisition, financing, or sale of
assets, subject to continued protection of your information.

We do not disclose your phone number used for two factor authentication to any
third party for marketing.

## 6. Third party travel sites
Trip Optimizer queries third party award search and travel sites to retrieve
availability. Those sites have their own terms and privacy practices, which we do
not control. We are not responsible for their content or practices.

## 7. Cookies and similar technologies
We use only first party, functional cookies and local storage for authentication,
preferences, and basic analytics and diagnostics. We do not use advertising
cookies or cross site tracking pixels, and we do not sell or share cookie data for
targeted advertising.

You can control cookies through your browser settings. Some features, such as
staying signed in, may not work without them. Our Service does not currently
respond to browser Do Not Track signals because there is no industry standard, and
because we do not track you across other sites, honoring them would not change our
behavior.

## 8. Data retention
We retain personal information only as long as needed for the purposes described,
unless longer retention is required by law. Account and travel profile data is
retained while your account is active and deleted or anonymized within 30 days
after an account deletion request, subject to the exceptions below. Chats, saved
trips, and the card tracker are retained while your account is active and deleted
when you delete them or your account. Billing identifiers, Stripe customer and
subscription IDs, transaction history, and tax records are retained up to 7 years
for tax, accounting, dispute, and legal obligations, even after account deletion.
Usage logs and security events are retained for up to 12 months for security,
debugging, and abuse prevention, then deleted or aggregated. Error logs are
retained for up to 90 days, then deleted or aggregated. Email preferences are
retained until you opt out, plus a suppression record retained indefinitely so we
do not email you again after opt out. Referral records are retained for up to 3
years for fraud prevention and accounting.

Deidentified or aggregated data that no longer identifies you may be retained
without a fixed period.

## 9. Security
We use industry standard safeguards, including encryption in transit using TLS,
encryption at rest where appropriate, two factor authentication, role based access
controls, and logging. Access to personal information is limited to those who need
it to operate the Service, and our service providers are contractually required to
protect it. No method of transmission or storage is 100 percent secure, and we
cannot guarantee absolute security.

We maintain an incident response process to investigate, contain, and remediate
security incidents involving personal information. Where applicable law requires,
we will notify affected users and regulators without undue delay.

## 10. Your rights and choices
You can update profile data in the app and opt out of marketing email via the
unsubscribe link. Service emails such as receipts and security notices will still
be sent while you maintain an account.

To exercise access, correction, deletion, or portability rights, email
privacy@acru.tech. We will verify your identity, typically via email verification
and account information matching, before acting. We will respond within 45 days,
with a possible 45 day extension where permitted by law, and will explain any
extension. We will not discriminate against you for exercising any right.

**A. United States state residents**, including California, Colorado, Connecticut,
Virginia, Utah, and similar laws. Categories of personal information we collect in
the last 12 months: identifiers such as email and IP address, commercial
information such as subscription status, internet activity such as usage logs, and
inferences such as travel preferences derived from your profile. Sources: directly
from you, automatically from your device, and from service providers such as
Stripe. Purposes and recipients: as described in Sections 3 and 5.

You have the right to know the categories and specific pieces of personal
information we hold about you, to access and obtain a portable copy, to correct
inaccuracies, to delete your personal information subject to legal exceptions such
as tax and security records, and to data portability. We do not sell personal
information and do not share it for cross context behavioral advertising, and we
have not done so in the preceding 12 months, so there is no opt out to exercise.
If that ever changes, we will update this Policy and provide the required opt out
and notice before doing so. We do not use or disclose sensitive personal
information for purposes that would require a limit use right.

You may appeal a denial of a request by replying to our decision email within 60
days. We will review and respond in writing within 45 days, with an explanation of
the result. California residents may also contact the California Department of
Consumer Affairs Complaint Assistance Unit if a complaint is not resolved. You may
designate an authorized agent to make a request on your behalf by providing
written permission and verifying your identity, or through a valid power of
attorney. We may still require direct verification for security.

**B. European Economic Area, United Kingdom, and Swiss residents.** Acru is the
controller. In addition to the rights above, you have the right to restrict or
object to processing based on legitimate interests, to withdraw consent at any
time, the right not to be subject to solely automated decisions with legal or
similarly significant effects, which we do not make, see Section 4, and the right
to lodge a complaint with your local supervisory authority, for example in the EU
your member state authority, in the UK the ICO, or in Switzerland the FDPIC. You
may object to processing based on legitimate interests by contacting us and
explaining your particular situation.

## 11. International transfers
We are based in the United States and process data there and in other countries
where our service providers operate. If you access the Service from outside the
United States, your information will be transferred to and processed in the United
States.

Where required by law for transfers from the EEA, UK, or Switzerland, we rely on
appropriate safeguards such as Standard Contractual Clauses approved by the
European Commission, the UK Addendum or UK International Data Transfer Agreement,
and the Swiss equivalents, plus supplementary measures where needed. You may
request a copy of the relevant safeguards by contacting privacy@acru.tech.

## 12. Children's privacy
The Service is for adults and is not directed to children under 18. We do not
knowingly collect personal information from children. If you believe a child has
provided us data, contact us at privacy@acru.tech and we will delete it promptly.

## 13. Changes to this Policy
We may update this Policy from time to time. We will post the new version with an
updated Last updated date and, where appropriate, notify you by email or in
product notice. Material changes will be notified at least 30 days in advance
where required by law. Continued use after the new effective date constitutes
acceptance.

## 14. Contact
**Acru Technologies, Inc.**
3997 W 1180 N
Lehi, UT 84048, USA
**Email: privacy@acru.tech**
For billing or account support: support@acru.tech