1. Who We Are, and Our Role

Krystal OS is operated by RebrandLand AI, located in Georgia, United States. This policy covers the Krystal OS platform at heykrystal.ai.

Two different relationships are at work here, and the difference matters:

• For your own account — your name, email, organization details, how you use the platform — we decide how that information is handled. We are the controller.
• For the people your organization records — donors, supporters, team members, the individuals named in your notes and documents — your organization decides what to collect and why. You are the controller; we process that information on your instructions, as your processor. The commitments in this policy apply to it either way.

2. Information We Collect

Your account

• Name, email address and password (held by our authentication provider, never in readable form)
• Organization details: nonprofit name, mission, focus areas, location, size
• Profile information and preferences, and your onboarding answers
• Colleagues you invite: their name, email and role on your team

What you record in the platform

• Donor and supporter records: name, email, phone, address, giving history, tags and notes
• Your correspondence log: the type, subject and body of messages your team records as sent to a supporter
• Donations: amount, date, campaign, purpose, payment method, receipt reference and notes
• Program participants: the people your programs serve — name, contact details, which programs they are enrolled in, case notes, and a log of what your team has said to them
• Programs, grants, applications, budgets and impact metrics
• Documents you upload or generate, and the text extracted from them
• Your conversations with the Co-Pilot, and grant searches you run
• Facts the Co-Pilot remembers about your organization between conversations — your funding position, your programs, how you prefer to work. Some of these you write yourself; others the Co-Pilot writes down at the end of a conversation because you mentioned them. Every one of them is visible to you in Settings, where you can edit or delete any of them. Nothing is kept that you cannot see.

Documents and notes are free text. Whatever your team writes there — including information about the people you serve — is stored as written. Section 6 explains what happens to it before any of it reaches an AI provider.

Email you forward to us

Your account can have a private forwarding address, which you switch on yourself in Settings and can turn off or replace at any time. Forward a funder's email to it — an award letter, a decline, a deadline notice — and Krystal reads it and offers to file what it found.

What we keep is deliberately less than the message: the sender's address, the subject, when it arrived, and what Krystal extracted from it. The body of the email stays with our email provider (Section 7) rather than being copied into our database; we fetch it once to read it, send it through the anonymisation in Section 6, and do not store it. Anyone can send to an address once they know it, so treat a suggestion as something to check rather than something we vouch for — nothing is filed against your grants until you say so.

Your colleagues can see what you forward. The address itself is yours alone — each person on your team switches on their own, and knowing one address does not reveal another. What arrives through it is different: a forwarded message is filed against your organization, so anyone on your team can see who it came from, its subject, when it arrived and what Krystal took from it, the same as any other grant record. That is deliberate — an award letter matters to whoever picks the work up next, not only to whoever happened to open the email. If you would rather something stayed between you and the sender, do not forward it.

From services you connect

If you connect a fundraising platform or another tool, we import data from it on your instruction. See Section 5.

Technical information

• Server logs: request paths, status codes, timings and error diagnostics
• Rate-limiting counters tied to your account

3. What We Do Not Collect

Stating this plainly is as useful as listing what we do collect:

• No card or bank details. Krystal OS does not take payments and does not process donations. When you connect a fundraising platform we read a record of income that has already been received there; card numbers and bank details stay with that platform and never reach us.
• No advertising or analytics trackers. The platform sets no third-party tracking cookies, runs no advertising pixels, and sends no behavioural data to ad networks.
• No sale of data. We do not sell, rent or trade personal information, and we do not share it for cross-context behavioural advertising.

4. How We Use Your Information

• Run the features you asked for: programs, donors, grants, budgets and reporting
• Find and recommend grant opportunities that fit your mission
• Produce AI insights, drafts and document summaries, under Section 6
• Import income from the platforms you connect, and attach it to your programs
• Send transactional email: team invitations, waitlist confirmations, service notices
• Keep the platform secure, diagnose faults and prevent abuse
• Meet legal obligations

We do not use your organization's data, your donors' data, or your documents to train AI models — ours or anyone else's.

5. Services You Connect

You can connect Krystal OS to tools your organization already uses. Nothing is connected until you connect it, and each connection can be removed at any time from Connected Apps.

Fundraising platforms

Connections to Stripe, PayPal, Donorbox, Givebutter, Bloomerang and Zeffy are read-only. We retrieve a record of income you have already received — amount, date, the supporter's name and email where the platform provides it, and the platform's own reference for the payment — and store it as donations against your account. We do not create charges, take payments, move funds, or write anything back to those platforms.

Other tools

Connections to Salesforce, HubSpot, Google Sheets, Google Drive, Google Calendar, Notion, Slack and Zapier move data between Krystal OS and accounts you control, in the direction you configure. Once data reaches one of those services it is governed by that provider's terms and privacy policy, not this one.

Credentials

Access tokens, refresh tokens, API keys and webhook URLs for connected services are encrypted before they are stored, with a key held outside the database. A copy of the database on its own does not yield a working credential. Tokens for external AI clients are stored only as a hash and cannot be recovered from us at all.

6. AI Features and Personal Data

Krystal OS uses Anthropic's Claude models for Co-Pilot chat, insights, grant discovery, application drafting, donor email drafts and document parsing. Because those prompts are built from your records, personal information is removed before the prompt leaves our servers.

• People become pseudonyms. Your donors, team members and account holder are replaced with stable stand-ins — "Donor 1", a placeholder email, a placeholder phone number — consistently across the whole request, so the model can still reason about a person's giving history without knowing who they are.
• Names in free text are caught too. Names in notes and documents, along with email addresses and phone numbers we were not told about, are replaced before sending.
• Some things are never sent at all. Social Security numbers and payment card numbers are withheld and are not restored afterwards. A date of birth is generalised to an age band and a street address to a three-digit ZIP prefix, so funder reporting still works without identifying a household.
• Replies are restored. Real names come back before you see the answer, so a drafted email still opens "Dear Jane". Anything irreversibly withheld stays withheld.

The provider still receives your organization's non-personal context: mission, program descriptions, grant names and amounts. Grant discovery additionally runs web searches built from your mission and focus areas; those queries describe the organization, not individuals.

We also expose your account to AI clients you connect yourself, such as a desktop assistant. Those results are anonymised on the way out in the same way, and phone numbers and addresses are withheld entirely. Non-AI connected apps (Section 5) are not anonymised — copying your records into your own Salesforce or spreadsheet is what you connected them to do.

Two honest limits. First, this is pattern detection, not certainty: an unusual name appearing alone in a document, with nothing marking it as a person, may pass through. Second, AI output is generated text and can be wrong; check anything you are about to send to a funder or a supporter. AI-generated content is labelled as such in the interface. Technical detail is published in docs/ai-privacy.md in our repository.

7. Who Else Sees Your Data

We do not sell, trade or transfer your personal information to third parties for their own purposes. We rely on a small number of service providers to run the platform, each handling data only on our instructions:

Beyond these, we disclose personal information only with your explicit instruction, to comply with a legal obligation or valid court order, or to protect the rights, property or safety of our users or ourselves. If Krystal OS is ever acquired or merged, we will tell you before your information becomes subject to a different privacy policy. We will update this list before adding a provider that handles personal data.

8. Data Security

• All traffic to and from the platform is encrypted in transit (HTTPS, with HSTS)
• Database storage is encrypted at rest by our database provider
• Connected-app credentials are separately encrypted with a key held outside the database
• API tokens are stored as hashes; the plaintext is shown once and never again
• Every record is scoped to the account that owns it, and that scoping is enforced on the database query itself rather than in the interface — one organization cannot read another's donors, donations or correspondence
• A strict Content Security Policy and related browser headers are enforced on every page
• Passwords are handled by our authentication provider and are never visible to us

No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant authorities without undue delay, and in any event within 72 hours of becoming aware of it where the law requires.

9. Your Rights and Choices

You have the right to:

• Access, update, or delete your personal information
• Export your data in a portable format
• Restrict or object to certain data processing activities
• Withdraw consent for optional data uses
• Request information about how your data is used
• Complain to your data protection authority

You can exercise the first two yourself, at any time and without asking us, from Settings → Account → Your Data. "Export" downloads a JSON file containing everything held against your account — including donors, donations, correspondence, participants and their enrolments, programs, grants, budgets, documents, forwarded email and what was read from it, Co-Pilot history and everything the Co-Pilot has remembered. Credentials for connected services are listed but their secret values are withheld, since an export file is a document you will carry around. "Delete account" permanently erases the account and everything in it. For the remaining rights, or if you would rather we handled a request for you, email dpo@heykrystal.ai and we will respond within one month.

If you are a donor or supporter of an organization that uses Krystal OS and want to see, correct or remove what is held about you, contact that organization — it decides what to record about you. Write to us at the address above if you cannot reach them, and we will help them respond.

10. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. When you delete your account from Settings, your data is erased immediately rather than queued for later deletion: your profile, grants, donors, donations, donor and participant correspondence, participant records, programs, budgets, documents, your forwarding address and everything read from email sent to it, connected-app credentials, Co-Pilot history and everything the Co-Pilot remembered are removed, along with your sign-in credentials. Copies held in routine database backups are purged as those backups age out. We keep nothing afterwards except where retention is required by law.

Some records have a fixed limit and are deleted automatically, whether or not you ever delete your account:

• Co-Pilot conversations — 24 months. Individual messages expire, so a conversation you still use keeps its recent part.
• What the Co-Pilot remembers about your organisation — 24 months after a fact was last confirmed. A fact that keeps coming up keeps its place; one nobody has mentioned in two years is removed.
• Security and access records — 400 days, which covers a full audit period.

These sweeps run daily. Deleting your account is still immediate and takes everything, whatever its age.

Some data is short-lived by design: generated file downloads are held for minutes and then discarded, and prompts sent to our AI provider are not retained by us at all — the anonymisation described in Section 6 exists in memory for one request and is never written down.

11. Cookies and Browser Storage

Krystal OS does not use advertising cookies, analytics cookies, or third-party tracking of any kind. What the platform does use is your browser's own storage, which never leaves your device:

• Your signed-in session, so you are not asked to log in on every page
• Interface preferences such as sidebar state and your place in the product tour

Signing out, or clearing site data for heykrystal.ai, removes all of it. Your actual records — donors, participants, programs, everything in Section 2 — live on the server, so they follow you to another device and are visible to the colleagues you have invited.

Nothing on our pages is loaded from a third party. Fonts, styles and scripts are all served from heykrystal.ai, so no other company sees you arrive.

12. International Data Transfers

We operate from Georgia, United States, and every provider listed in Section 7 processes data in the United States. If you use Krystal OS from outside the United States, your information — and the information you record about people in your community — is transferred there. Where the transfer is from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses with our providers. Contact dpo@heykrystal.ai for details of the safeguards in place.

13. Children and Program Participants

Krystal OS is a tool for nonprofit staff and is not directed at children. We do not knowingly collect information directly from anyone under 13.

Many organizations using Krystal OS serve young people, and staff may record details about them in program notes and documents. That information belongs to your organization, and it is your responsibility to have the consent or lawful basis to hold it. Please do not record more than your reporting genuinely requires, and never record Social Security numbers or payment card details — the platform is not built to hold them, and the AI layer strips them rather than passing them on.

14. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Material changes — a new category of data, a new provider handling personal information, a new purpose — will also be notified by email to account holders before they take effect.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: