Privacy policy

The data controller is KROWS NEXORA, S.L.U., with tax ID B05867726 and address at [Registered address pending]. Privacy contact: hello@krows.app. This policy follows Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

We do not ask for your name, ID document or bank details to use the platform.

• Providing the service (dashboard, voting, chat, messages with founders, trust score, subscription): performance of the contract (art. 6.1.b GDPR).
• Security, fraud prevention and moderation, including investigating reports: legitimate interest (art. 6.1.f).
• Replying to your messages: your request and our legitimate interest.
• Newsletter and marketing emails: your consent (art. 6.1.a), which you can withdraw at any time.
• Complying with legal obligations (invoicing, consumer law, international sanctions, requests from authorities): legal obligation (art. 6.1.c). This is why we keep the country of residence you declare when investing.

The trust score is automated processing that may limit features. When it does, we explain the rule applied, and you have the right to human intervention, to express your view and to contest the decision (art. 22 GDPR) from the Trust score page; we reply within one month at most.

The operations you sign (investments, votes, withdrawals, distributions) are recorded publicly and permanently on the Solana network, which Krows does not control. Krows cannot modify or delete those records.

That is why Krows only writes wallet addresses, amounts, random identifiers and fingerprints (hashes) of texts to the blockchain, never your name, your email or readable texts: for example, the reason for a withdrawal is stored by Krows and only its fingerprint goes on-chain. Your rights to erasure and rectification apply to the data Krows keeps off the blockchain.

We do not sell your data or share an investor’s email with founders. We only share it with providers that give us services, under a processing agreement under article 28 GDPR (unless stated that they act as controllers), and with authorities when required by law:

• Supabase: account database and files, in Frankfurt (Germany).
• Resend: sending emails (confirmations, notices and newsletter), from Ireland.
• Privy: sign-in with email, Google, Apple or wallet and embedded wallets; uses a client identifier for security and analytics of its service.
• Stripe: charging Krows Pro and founder services; for payments it also acts as an independent controller.
• Google Firebase Hosting: serves the app and investment pages (receives your IP when loading them).
• WalletConnect: list of compatible wallets on the sign-in screen (receives your IP).
• Solana RPC provider: sends and reads transactions on the network (receives your IP and wallet address).
• Card USDC purchase provider: processes your payment data as an independent controller.
• OVH: hosting of krows.app, in the EU.

The website serves its typeface and press images from our own servers: when you visit it your IP is not sent to Google or to the media cited. If any provider accesses data from outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework where the provider is certified and, otherwise, on the European Commission’s standard contractual clauses.

• Platform activity: while you use Krows and up to 5 years after to handle claims and legal obligations.
• Contact messages: 24 months from receipt; then they are deleted automatically.
• Newsletter: we use double opt-in. If you do not confirm your email within 7 days, it is deleted. If you unsubscribe, we stop writing to you immediately and keep your email and the proof of consent (date, IP address and version of the accepted text) for 3 years, only to be able to prove you gave it and not to write to you again; then they are deleted.
• Security logs: up to 12 months.

You can exercise your rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions by writing to hello@krows.app. To check you own a wallet, we may ask you to sign a message with it (never your phrase). If you are not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es).

Krows is not aimed at people under 18 and we do not knowingly process their data. We apply technical and organizational measures to protect data, such as encryption in transit, access control and activity logging.