Privacy Policy

1. Who is responsible for your data

The data controller for Kerux is Mažoji bendrija IRIR.LT (MB IRIR.LT), company code 302918106, registered at Bazilijonų g. 6-17, Vilnius, Lithuania, Lithuania (EEA). For any privacy question or to exercise your rights, contact hello@keruxapp.com.

2. Data we collect

• Account data: your email address, used for passwordless (one-time code) sign-in.
• Content you create: calendars and events, including any titles, locations, descriptions, dates, and other information you enter — which may itself contain personal data you choose to include.
• Payment data: handled by Stripe. We store your Stripe customer and subscription identifiers and your plan status — we never receive or store your full card number.
• AI inputs:if you use “add events by voice” or “from photo”, the audio/text or image you submit is sent to our AI provider for event extraction.
• Usage data: scan/visit counts on public calendar pages, and cookieless product analytics.
• Technical data: logs and standard request data (e.g. IP address, approximate location, browser) processed by our hosting/CDN provider to deliver and secure the Service.

3. Why we use it & our legal bases

• To provide the Service, your account, and calendar publishing — performance of a contract (GDPR Art. 6(1)(b)).
• To send you sign-in codes and essential service emails — contract (Art. 6(1)(b)).
• To process payments and keep billing/accounting records — legal obligation (Art. 6(1)(c)) and contract.
• To secure, maintain, analyse, and improve the Service and prevent abuse/fraud — our legitimate interests (Art. 6(1)(f)).

4. Who processes your data (subprocessors)

We use trusted providers who process data on our behalf under data processing agreements:

• Supabase— database & authentication.
• Stripe — payment processing and subscriptions.
• Netlify — hosting and content delivery.
• Anthropic — AI processing for the voice/photo event-import features.
• PostHog (EU) — privacy-friendly, cookieless, EU-hosted product analytics.

Where a provider processes data outside the EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses or an adequacy/Data Privacy Framework mechanism.

5. Cookies

We use only strictly necessary cookies: authentication/session cookies (to keep you signed in) and a kerux-locale cookie (to remember your language). Our analytics is cookieless and does not track you across sites, so we do not show a cookie consent banner. We do not use advertising cookies.

6. How long we keep it

We keep account and content data while your account is active. If you delete your account, we permanently delete your account and content data within 30 days (allowing a short recovery window and backup rotation), except where we must retain certain records longer — in particular, payment and accounting records retained to meet Lithuanian legal obligations (generally up to 10 years). AI inputs are processed to return a result and are not retained by Kerux as a standing store.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time. To exercise any right, email hello@keruxapp.com. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or your local supervisory authority.

8. Public content

Calendars you publish are public by design: anyone with the link or QR code can view them and subscribe to the feed. Do not include information in public calendars that you would not want publicly accessible.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal data.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, make reasonable efforts to notify you.

11. Contact

Mažoji bendrija IRIR.LT (MB IRIR.LT), company code 302918106, Bazilijonų g. 6-17, Vilnius, Lithuania. Privacy enquiries: hello@keruxapp.com. See also our Terms & Conditions.