Privacy Policy

1. Information We Collect · 2. How We Use Your Information · 3. Legal Bases for Processing (GDPR) · 4. Cookies and Tracking Technologies · 5. AI Processing Disclosure · 6. Sub-Processors · 7. How We Share Information · 8. Data Retention · 9. Your Rights and Choices · 10. California Residents (CCPA / CPRA) · 11. European / UK / Swiss Users (GDPR) · 12. International Data Transfers · 13. Latin America · 14. Children's Privacy · 15. Security · 16. Third-Party Links · 17. Do Not Track / GPC · 18. Biometric Data · 19. Future Features · 20. Data Breach Notification · 21. Changes to This Policy · 22. Contact

1. INFORMATION WE COLLECT

We collect information in three ways: information you provide directly, information generated automatically when you use the Service, and information we receive from third parties.

1.1 Information You Provide Directly

Account Registration:

• Full name and email address
• Password (stored as a hashed and salted value; we never store plaintext passwords)
• Google account information if you sign in via Google OAuth (name, email, profile picture)

Creative Work Submissions:

• Image files, design files, and visual creative work you upload for critique (JPG and PNG)
• Intake responses: your answers to mode-specific questions you complete before submitting work (creative context, audience, goals, platform, constraints)
• Any text, copy, or captions embedded in or accompanying submitted creative work

Payment Information:

• When you purchase a critique, payment is processed entirely by Stripe, Inc.
• ExaCrit does not collect, store, or have access to your full credit card number, CVV, or full billing address
• We receive from Stripe only: transaction confirmation, tier purchased, transaction amount, and a tokenized payment identifier

Communications:

• Emails you send to hello@exacrit.com or any support channel
• Feedback, survey responses, or testimonials you voluntarily provide

1.2 Information Collected Automatically

Usage and Log Data:

• Pages visited and time spent on each page
• Features accessed, buttons clicked, and navigation paths
• Submission history (mode, round number, timestamp, not content)
• Error logs and platform performance data
• HTTP request logs including IP address, browser type, operating system, referrer URL, and device type

Device and Technical Information: device type, browser type and version, operating system, screen resolution, and language preference.

Cookies and Similar Technologies: see Section 4.

1.3 Information From Third Parties

• Google OAuth: if you sign in with Google, we receive your name, email address, and Google profile picture as authorized by you
• Stripe: transaction confirmation data as described above
• Analytics providers: aggregated, anonymized usage patterns (see Section 4)

2. HOW WE USE YOUR INFORMATION

We use the information we collect only for the following purposes:

Service Delivery

Process your creative submissions, generate AI Critique Output, and deliver results to your Account dashboard

Account Management

Create and maintain your Account, authenticate your identity, manage your session

Payment Processing

Route payment transactions through Stripe and fulfill your selected tier

Transactional Email

Send account confirmations, critique delivery notifications, receipts, renewal notices, and security alerts

Product Improvement

Analyze aggregated, anonymized usage patterns to improve platform functionality, fix bugs, and develop features

Security & Fraud Prevention

Detect abuse, unauthorized access, and protect the integrity of the platform

Legal Compliance

Meet our legal obligations under applicable laws and regulations

Customer Support

Respond to your questions, requests, and support inquiries

3. LEGAL BASES FOR PROCESSING (GDPR / INTERNATIONAL)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data only where we have a valid legal basis:

Contractual Necessity (Art. 6(1)(b))

Account creation, critique delivery, payment processing: required to deliver the Service you contracted for

Legitimate Interests (Art. 6(1)(f))

Security monitoring, fraud prevention, platform analytics, product improvement: where our interests do not override your rights

Legal Obligation (Art. 6(1)(c))

Compliance with applicable laws, tax obligations, regulatory requirements

Consent (Art. 6(1)(a))

Marketing communications, optional analytics cookies, and any processing for which we explicitly request your consent

Vital Interests (Art. 6(1)(d))

Rare emergency circumstances requiring data use to protect life

You may withdraw consent at any time where consent is the legal basis. Withdrawal does not affect the lawfulness of prior processing.

4. COOKIES AND TRACKING TECHNOLOGIES

4.1 What Are Cookies

Cookies are small text files stored on your device. We also use local storage, session storage, and pixel tags. These are collectively referred to as "cookies" in this Policy.

4.2 Cookies We Use

Strictly Necessary

Authentication tokens, CSRF protection, payment session state, security tokens. Required for operation; cannot be disabled.

Functional

Remember preferences, mode selection, session history. Can be disabled via browser settings.

Analytics

Platform usage data, not linked to your name or email address, to improve the product (e.g., Google Analytics page views, feature interactions). Where the law requires consent first, analytics runs only after you accept; elsewhere you can opt out at any time using the cookie control in Section 4.4, a Global Privacy Control signal, or your browser settings.

Third-Party

Google OAuth session tokens; Stripe payment session and fraud detection tokens. Controlled by those services under their own policies.

4.3 Cookie Duration

• Session cookies: expire when you close your browser
• Authentication cookies: persist up to 30 days or until you sign out
• Analytics cookies: persist up to 2 years

4.4 Your Cookie Choices

• Most browsers allow you to refuse or delete cookies through browser settings
• Refusing strictly necessary cookies will prevent you from using the Service
• We honor the Global Privacy Control (GPC) signal where technically feasible
• A cookie consent banner will be presented on first visit where required by applicable law
• You can turn analytics cookies on or off at any time using the cookie control on this page

5. AI PROCESSING DISCLOSURE: ANTHROPIC

5.1 How AI Processing Works

ExaCrit uses the Anthropic Claude API (Anthropic PBC, San Francisco, CA) as its AI processing engine. When you submit creative work for critique:

• Your uploaded images and intake responses are transmitted to Anthropic's API over an encrypted HTTPS/TLS connection
• Anthropic's Claude model processes this data to generate your Critique Output
• The Critique Output is returned to ExaCrit and stored in your Account

5.2 What Anthropic Does and Does Not Do

ExaCrit uses Anthropic's commercial Claude API to process submitted content and generate Critique Output. ExaCrit does not use submitted creative content to train or fine-tune AI models. Under Anthropic's current commercial-product terms and policies, Anthropic does not use commercial API inputs or outputs for model training by default. Anthropic's retention and processing of submitted content are governed by the commercial terms applicable to ExaCrit's account.

Anthropic's Privacy Policy is available at anthropic.com/privacy.

5.3 No AI Training: Our Commitment

ExaCrit does not use Your Content to train, fine-tune, benchmark, or improve any AI model. ExaCrit will not change this commitment without updating these Terms and the Privacy Policy and providing notice as described in Section 21.

6. THIRD-PARTY SUB-PROCESSORS

The following companies process data on our behalf in connection with Service delivery:

Anthropic PBC (San Francisco, CA)

AI processing: receives submitted images and intake responses to generate Critique Output only

Supabase Inc. (San Francisco, CA)

Database, authentication, and temporary file storage: account data, critique metadata, session management, temporary storage of uploaded creative files

Vercel Inc. (San Francisco, CA)

Hosting, CDN, and serverless compute

Stripe Inc. (San Francisco, CA)

Payment processing only: does not receive submitted creative content

Google LLC (Mountain View, CA)

Authentication (Google OAuth) and website analytics (Google Analytics), subject to your cookie choices in Section 4

Plunk Inc. (San Francisco, CA)

Transactional and marketing email delivery

Each sub-processor is contractually obligated to protect your data and use it only as necessary to provide the services they deliver to ExaCrit. ExaCrit will update this list when sub-processors are added or removed.

7. HOW WE SHARE YOUR INFORMATION

We do not sell your personal data. We share your information only in these circumstances:

7.1 Sub-Processors

Sharing with sub-processors listed in Section 6, strictly as necessary to deliver the Service.

7.2 Legal Requirements

We may disclose your information if required by law, court order, subpoena, government request, or regulatory requirement. Where permitted by law, we will notify you of such requests before complying.

7.3 Protection of Rights

We may disclose information where we reasonably believe it is necessary to protect the rights, property, or safety of ExaCrit, our users, or the public, including cooperating with law enforcement to investigate suspected illegal activity.

7.4 Business Transfers

If ExaCrit is involved in a merger, acquisition, asset sale, or corporate reorganization, your information may be transferred as part of that transaction. We will notify you via email or site notice at least 30 days before your personal data is transferred and becomes subject to a different privacy policy. You will have the opportunity to delete your Account before the transfer if you do not agree to the new terms.

7.5 With Your Consent

We may share information with third parties with your explicit prior written consent, including for case studies or marketing with your permission.

7.6 Share Links You Create

If you choose to share a critique, ExaCrit creates a link that anyone who has it can open without an Account. The shared page shows only that critique's overall score, score band, mode, round, and category scores. It does not show your uploaded work, file name, goals, notes, or your name. Share links stop working when your Account is permanently deleted.

8. DATA RETENTION

We keep your information only as long as needed to provide the Service, then delete it on the schedule below.

Uploaded creative work (images and files). Your uploaded work is temporarily stored in Supabase and is deleted automatically no later than 24 hours after the critique is generated. This short window exists only to support processing, limited result-page functionality, and, when you resubmit within the window, comparing your new version with the original. We do not retain your original creative work beyond that period. This applies to all tiers, including paid tiers. If you resubmit a piece, the new critique can compare it with the earlier version. You may upload the earlier version again for this purpose, or, if you resubmit while your original upload is still stored, we may use that stored file instead. Either way, the earlier version is used only to generate that critique. ExaCrit does not store a version you upload again, and a stored original is deleted on the same schedule as above.

Critique Output (scores, notes, and written feedback). Your Critique Output is retained in your Account until you delete it or close your Account. Critique Output does not include your original uploaded file. Where the Service offers resubmission or comparison features, those features may use retained Critique Output and other non-file data rather than retaining the original uploaded work beyond the 24-hour period.

Account information. Account and profile data is retained while your Account is active and deleted following Account closure, except where a longer period is required by law. When you delete your Account, it is deactivated immediately. You can restore it by signing in within 14 days, or by contacting hello@exacrit.com within 30 days. Account data, profile data, and Critique Output are permanently deleted 30 days after your deletion request. Payment and transaction records are retained as required for tax and accounting purposes.

Payment records. Retained as required by Stripe and applicable financial and tax regulations, typically 7 years.

Log and usage data. Retained in anonymized or aggregated form for up to 24 months.

Email correspondence. 3 years from last communication.

Cookie data. Per Section 4: session to 2 years depending on type.

You may request deletion of your Account and associated data at any time. See Section 9. Retention periods may be extended only where required by applicable law. Account deletion follows the 14-day restore and 30-day permanent deletion schedule described above.

9. YOUR RIGHTS AND CHOICES

Regardless of where you are located, you have the following rights with respect to your data:

Access

Request a copy of the personal data we hold about you

Correction

Request correction of inaccurate or incomplete personal data

Deletion

Request deletion of your personal data (subject to legal retention obligations)

Portability

Request your data in a structured, machine-readable format

Objection

Object to certain types of processing, including direct marketing

Restriction

Request that we limit processing of your data in certain circumstances

Withdraw Consent

Withdraw consent where consent is the legal basis for processing

Opt Out of Marketing

Unsubscribe from marketing emails via the unsubscribe link in any email

To exercise any right: email hello@exacrit.com, Subject: "Privacy Request: [Right You Are Exercising]." We will respond within 30 days (45 days for complex requests, with notice). We may verify your identity before processing. We will not discriminate against you for exercising your privacy rights.

10. CALIFORNIA RESIDENTS: CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific additional rights regarding your personal information.

10.1 Categories We Collect

Identifiers

Name, email address, IP address, Account ID

Personal Information (§1798.80(e))

Name, email address

Commercial Information

Purchase history, tier selected, transaction records

Internet / Network Activity

Usage data, page views, feature interactions, browser and device info

Visual / Creative Content

Images and design files submitted for critique (treated as personal information)

Inferences

Aggregated usage patterns, used for product improvement only

10.2 Your CCPA / CPRA Rights

• Right to Know: know what personal information we collect, use, disclose, and share
• Right to Delete: request deletion of your personal information
• Right to Correct: request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: we do not sell or share your personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: we do not process sensitive personal information beyond what is necessary to provide the Service
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights

10.3 We Do Not Sell

ExaCrit does not sell personal information under the CCPA/CPRA. ExaCrit does not share personal information for cross-context behavioral advertising. No opt-out is required because no sale or sharing occurs.

10.4 Submit a CCPA Request

Email hello@exacrit.com, Subject: "CCPA Request." We will respond within 45 days, with up to 45-day extension for complex requests. Authorized agents: California residents may designate an authorized agent with written authorization from the Account holder.

11. EUROPEAN / UK / SWISS USERS: GDPR

If you access ExaCrit from the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional protections apply under the GDPR, UK GDPR, and Swiss Federal Act on Data Protection (nFADP).

11.1 Data Controller

Renderal Studio LLC, operating ExaCrit, is the data controller for personal data collected through the Service. Contact: hello@exacrit.com. Mailing address: P.O. Box 1413, Simi Valley, CA 93062, United States.

11.2 Your GDPR Rights

• Right of access (Art. 15): obtain a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate personal data
• Right to erasure / right to be forgotten (Art. 17): request deletion subject to legal exceptions
• Right to restriction of processing (Art. 18): limit how we use your data
• Right to data portability (Art. 20): receive your data in machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making (Art. 22): ExaCrit does not make solely automated decisions with legal or significant effects on individuals
• Right to lodge a complaint with your national supervisory authority

11.3 EU / UK Representative

ExaCrit has not appointed a representative in the EU or the UK. The Service is currently directed to users in the United States. If we begin offering the Service in the EEA or the UK in a way that requires a representative, we will appoint one and update this Policy.

11.4 Data Protection Officer

ExaCrit does not currently have a designated Data Protection Officer.

11.5 Supervisory Authorities

• EEA users: supervisory authority in your EU member state
• UK users: Information Commissioner's Office (ICO) at ico.org.uk
• Swiss users: Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch

12. INTERNATIONAL DATA TRANSFERS

ExaCrit is operated from the United States. If you access the Service from outside the United States, including the EEA, UK, Switzerland, or Latin America, your personal data will be transferred to, stored, and processed in the United States and other countries where our sub-processors operate.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards, which may include:

• Standard Contractual Clauses (SCCs) as approved by the European Commission, where sub-processors require them
• UK International Data Transfer Agreements (IDTAs) or the UK Addendum for UK-to-US transfers
• The EU-U.S. Data Privacy Framework (DPF), only where the applicable sub-processor is actively certified under it

By using the Service from outside the United States, you acknowledge that your information will be transferred to the United States, which may have different data protection standards than your country of residence.

13. LATIN AMERICA

ExaCrit currently directs the Service to users in the United States. If you use the Service from Brazil, Mexico, or another Latin American country, you may have rights under your local data protection law, such as Brazil's Lei Geral de Proteção de Dados (LGPD) or Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), including rights to access, correction, deletion, portability, and information about sharing. To exercise them, contact hello@exacrit.com as described in Section 9, and we will respond as required by applicable law.

14. CHILDREN'S PRIVACY

The Service is not directed to and is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from anyone under 18.

If we become aware that we have inadvertently collected personal information from a person under 18, we will delete that information from our systems as promptly as possible. If you believe we may have collected information from a person under 18, please contact us immediately at hello@exacrit.com.

Where local law sets a minimum age for using an online service or consenting to data processing that is higher than 18, we apply that higher age. In all cases, the minimum age to use ExaCrit is the greater of 18 or the minimum age required in your jurisdiction.

15. SECURITY

We implement commercially reasonable technical and organizational security measures designed to protect your personal data from unauthorized access, loss, misuse, alteration, disclosure, or destruction. Our security measures include:

• Encrypted data transmission using HTTPS/TLS for all data in transit
• Hashed and salted password storage; plaintext passwords are never stored
• Access controls limiting employee and contractor access on a strict need-to-know basis
• Database-level access controls and audit logging via Supabase
• Restricted access to Supabase storage containing submitted creative work
• Payment data handled entirely by Stripe's PCI DSS Level 1 compliant infrastructure; we do not receive raw payment data
• Regular security monitoring through platform infrastructure tools
• Incident response process for data breach detection and notification

No security system is impenetrable. We cannot guarantee that unauthorized third parties will never be able to defeat our security measures. In the event of a data breach, see Section 20.

16. THIRD-PARTY LINKS AND SERVICES

The Service may contain links to third-party websites or services. ExaCrit is not responsible for the privacy practices, content, or security of those third parties. We encourage you to review the privacy policies of any third-party services you access through or alongside ExaCrit. Third-party integrations you may encounter include payment processing (Stripe), authentication (Google OAuth), and AI processing (Anthropic), each governed by their own policies in addition to our contractual obligations with them.

17. DO NOT TRACK / GLOBAL PRIVACY CONTROL

Some browsers include a "Do Not Track" (DNT) feature. ExaCrit does not currently respond to DNT browser signals, as there is no uniform industry standard for what DNT requires.

We do honor the Global Privacy Control (GPC) signal where technically feasible. In jurisdictions where GPC is legally required to be honored (such as California under CPRA), we treat a valid GPC signal as an opt-out of any data sharing for cross-context behavioral advertising. ExaCrit does not conduct cross-context behavioral advertising.

18. BIOMETRIC DATA

ExaCrit does not collect, process, or store biometric identifiers or biometric information as defined under applicable law, including the Illinois Biometric Information Privacy Act (BIPA), the Texas CUBI Act, or the Washington My Health My Data Act. We do not collect facial recognition data, voiceprints, fingerprints, or any other biometric identifier. If you submit creative work containing images of people, we do not perform biometric processing on those images.

19. FUTURE FEATURES AND USES

ExaCrit is an evolving product. Before implementing any new use of your data that is materially different from what this Policy describes, we will: (a) update this Privacy Policy and notify you; (b) obtain your consent where required by applicable law; and (c) provide you the opportunity to opt out before new processing begins.

Potential future features that may affect data processing include: team or agency accounts, PDF report generation and delivery, Figma or Canva integrations, progress tracking across submissions, and public testimonial or portfolio features. None of these are active at this time.

20. DATA BREACH NOTIFICATION

In the event of a data breach that materially affects your personal data, ExaCrit will:

• Notify you via email to your Account address as soon as reasonably practicable and as required by applicable law
• Notify relevant supervisory authorities within legally required timeframes (72 hours under GDPR where applicable)
• Provide information about the nature of the breach, data affected, steps we are taking, and steps you can take to protect yourself

ExaCrit maintains an incident response process for detecting, containing, and reporting data security incidents.

21. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make changes:

• The "Last Updated" date at the top will be revised
• For material changes, we will notify you via email at least 14 days before the change takes effect
• For significant changes affecting your rights or how we use your data, we may present an in-app notification requiring your acknowledgment
• Your continued use of the Service after the effective date constitutes acceptance of the revised Policy

If you disagree with a material change, you may delete your Account before the change takes effect. Contact hello@exacrit.com if you need assistance.

22. CONTACT AND DATA REQUESTS

General Privacy Inquiries

hello@exacrit.com

Data Deletion Requests

hello@exacrit.com, Subject: "Data Deletion Request"

CCPA Requests

hello@exacrit.com, Subject: "CCPA Request"

GDPR / International Requests

hello@exacrit.com, Subject: "GDPR Request: [Right]"

Data Breach Notification

hello@exacrit.com

DMCA / Copyright Notices

hello@renderalstudio.com, Subject: "DMCA Takedown Notice"

Legal Entity

Renderal Studio LLC (California)

Mailing Address

P.O. Box 1413, Simi Valley, CA 93062, United States

Response time: we aim to respond to all privacy requests within 30 days. For complex GDPR or CCPA requests, we may extend by 30 to 45 days with notice.