Privacy Policy

Last updated October 2026

Kromadic is a place to run deals. It holds the details of your deals so it can tell you what needs you. This page says what it holds, where, who can see it, and how to take it back. It is written to be read.

What Kromadic stores

• Your account: the email address you sign in with, and the name and handle you give it.
• Your deals: brands, contacts, fees, terms, deliverables, dates, notes, invoices, and anything you write on a brand's page.
• Your settings: your plan, your pipeline stages, and integrations you connect (for Slack, the webhook URL you paste).
• Usage counts: how many questions you have asked Kroma this month and how many contracts it has read, to apply your plan's limits.
• How you found Kromadic: the campaign tags, landing page, referring site and button described under Analytics and cookies, and your answer to "How did you hear about us?" if you give one.

This is stored in a Postgres database hosted by Supabase, with row-level security so that only your account can read your rows. A copy is cached in your browser so the app works offline.

Contracts

When you drop a contract PDF into Kromadic, the text is extracted in your browser. The file itself is not uploaded. The values you confirm from it (fee, terms, exclusivity) are stored as part of the deal, like anything else you type, and so is the contract's text (up to its first 24,000 characters), so that Kroma can answer questions about it later. When you ask Kroma about that deal, the text is sent with your question, as described below.

Kroma, the assistant

When you ask Kroma a question or for a draft, the facts of your deals (brands, amounts, dates, terms, notes) and your question are sent through Kromadic's own server to a language model provider (Anthropic, directly or via OpenRouter) to produce the answer. That data is used to answer you and is not used to train models. Kroma never sends anything to a brand; every email, invoice or change it proposes waits for you to press the button, unless you turn on Auto on a Pro plan.

Integrations you connect

Slack: if you paste a webhook, Kromadic posts to that channel: what happened in your pipeline and a morning brief. It reads nothing from Slack. Disconnecting removes the URL.

Other integrations are listed in Settings as coming; none is connected until you connect it, and each will say here what it reads and writes.

Analytics and cookies

Kromadic measures how people find it and how they use it. This is all of it.

• Kromadic's own cookie. On your first visit to kromadic.com, a first-party cookie named kr_ft is set on .kromadic.com for 90 days. It holds the campaign tags in the link you arrived from (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the page you landed on, and the domain of the site that sent you, never a full address. It is read only by Kromadic.
• Which button you clicked. Links from the website into the app carry those campaign tags and a short label for the button, such as pricing.plans.start-solo. The app keeps the label in your browser until you create an account.
• Website analytics. Page views and load times on kromadic.com are measured by Vercel Web Analytics and Speed Insights. They set no cookies and see no account or deal data.
• Google Analytics. kromadic.com also uses Google Analytics to count visits, see which pages and posts bring people in, and see which buttons into the app are clicked. It sets first-party cookies (named _ga and _ga_*) for up to two years, with Google signals and ad personalization turned off. It runs only on this website, not in the app.
• Product analytics in the app. app.kromadic.com uses PostHog, hosted in the United States and reached through Kromadic's own address, to see which features are used and where things break. It runs from the sign-in screen, before you sign in, and after. It records clicks, page views, errors and session replays, which are recordings of what happened on the screen. Kromadic sets it to mask the text on the screen, everything you type, and link addresses, so deal names, amounts and contacts are not captured. Once you sign in, these events are linked to your account. PostHog keeps an identifier in a cookie and in your browser's storage.
• On your profile. When you create an account, the campaign tags, landing page, referring domain and button label above are saved on your profile and sent to PostHog with the sign-up event.

None of this is used for advertising, and none of it is sold.

What Kromadic does not do

• It does not sell or share your data with advertisers or data brokers.
• It does not use advertising or cross-site tracking cookies. The cookies it does use are listed under Analytics and cookies. Sign-in uses the storage your browser provides for the session.
• It does not read your inbox, your social accounts, or your bank, unless and until you connect one, and it will ask first.

Money

Kromadic does not hold your card or bank details. Subscriptions are handled by a payment processor (Stripe) that holds those details under its own privacy policy. Kromadic takes no fee on invoices.

Your data is yours

• Export everything, or a tax-ready summary, from Settings › Money at any time.
• Delete your account from Settings › Plan. Any subscription is cancelled at once, then your account and everything in it are removed. Stripe keeps its own record of past payments, as payment law requires. Analytics already sent to PostHog can be erased on request at hello@kromadic.com.
• Chats with Kroma live only in your browser, for thirty days, and never sync.

Questions

Write to hello@kromadic.com. If this policy changes, the date at the top will, and anything that changes what is stored or shared will be said in plain words.