Privacy Policy
Last updated: July 12, 2026
At Cronos, we take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. We process personal data only for the purposes described here and in accordance with applicable law.
1.Who We Are
The data controller responsible for your personal data is:
For questions about this policy or to exercise your rights, contact us at the address above.
2.What Data We Collect
2.1 Account & Identity Data
When you create an account or sign in, we collect:
- Name and email address
- Phone number (optional, for booking notifications)
- Address as option to save your home location
- Authentication identifiers
- Profile preferences and settings
2.2 Business Data
If you operate a business on Cronos, we additionally collect:
- Business name, address, and contact details
- Team member information (names, email addresses, roles)
- Products, services, pricing, and availability configurations
- Operational data including orders, bookings, invoices, and fulfillment records
- Payment account details (handled by Stripe — we do not store card numbers)
- Integration credentials for third-party services you connect
2.3 Consumer Activity Data
When you use Cronos as a consumer (booking products or services), we collect:
- Order and booking history
- Subscription and loyalty program activity
- Event attendance and calendar data
- Payment transaction records (amount, date, status — not card details)
- Communications with businesses through the platform
2.4 Usage & Technical Data
When you use the platform, we automatically collect:
- IP address and approximate location
- Browser type and device information
- Pages visited and features used
- Session timestamps and duration
- Error logs and performance metrics
This data is used to operate, secure, and improve the platform. We do not use it for behavioral advertising.
2.5 AI Interaction Data
When you interact with the Sky AI agent, we process the content of your messages and the context of your business operations (products, availability, bookings) to generate responses. Conversation logs are retained to support continuity and improve accuracy. We do not use your conversation data to train general AI models.
3.How We Use Your Data
We use your personal data only for the following purposes:
- Service delivery — Processing bookings, orders, payments, and fulfillment
- Account management — Authentication, access control, and account settings
- Communications — Booking confirmations, reminders, and service notifications
- Platform operations — Security monitoring, fraud prevention, and technical support
- Legal obligations — Invoicing, tax records, and compliance requirements
- Service improvement — Fixing issues and improving platform stability
We do not sell your personal data to third parties. We do not use your data for targeted advertising.
4.Legal Basis for Processing
We process your data under the following legal bases:
- Contract performance — Processing necessary to deliver the service you’ve subscribed to
- Legitimate interests — Security, fraud prevention, and service improvement
- Legal obligation — Compliance with applicable laws (tax, invoicing, data retention)
- Consent — Where we explicitly ask for it (e.g., marketing communications)
5.Data Sharing
5.1 Service Providers
We share data with trusted third-party processors who help us operate the platform. All processors are contractually bound to protect your data and use it only for the purposes we specify:
- Stripe — Payment processing
- OpenAI / Nebius — AI model providers for the Sky agent (data is not used to train models)
- Resend — Email delivery
- Railway — Hosting, database, and CDN services
5.2 Business-to-Consumer Sharing
When you make a booking with a business on Cronos, we share relevant information (name, contact details, booking details) with that business to fulfill your order. The business becomes an independent data controller for how they use that information.
5.3 Legal Disclosures
We may disclose your data if required by law, court order, or regulatory authority, or if necessary to protect the rights, property, or safety of Cronos, our users, or the public.
6.Data Retention
We retain your data for as long as necessary to provide the service and meet legal obligations:
- Active account data — Retained for the duration of your account
- Transaction records — Retained for 7 years for tax and accounting compliance
- AI conversation logs — Retained for 12 months, then deleted
- Technical/usage logs — Retained for 90 days
- Deleted account data — Purged within 30 days of deletion request, except where retention is legally required
7.Your Rights
Depending on your location and applicable law, you may have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you
- Rectification — Request correction of inaccurate or incomplete data
- Erasure — Request deletion of your data (“right to be forgotten”). Personal data is removed from our systems, though some financial records (orders, payments, invoices) are retained for legal and tax compliance with PII stripped from them.
- Portability — Receive your data in a structured, machine-readable format (JSON or CSV)
- Restriction — Request that we limit how we process your data. You can toggle processing restriction at any time in your privacy portal.
- Objection — Object to processing based on legitimate interests
- Withdraw consent — Where processing is based on consent, you may withdraw it at any time
7.1 Automated Decision-Making & AI Rights
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (GDPR Art. 22). You may:
- Opt out of AI processing — Disable AI-assisted features (chatbot, recommendations, automated suggestions) at any time in your privacy portal
- Request human review — Ask for a human review of any decision made by our AI systems
7.2 Exercising Your Rights
You can exercise most of these rights directly through our privacy self-service portal without contacting us. This includes data export, account deletion, processing restriction, and AI opt-out.
For erasure requests, there is a 7-day cooling-off period during which you can cancel the deletion request. After this period, your personal data is permanently removed.
We process requests within 10 business days. For requests that cannot be handled through the self-service portal, contact us at issue@cronos.nexus. We may need to verify your identity before processing the request.
8.Cookies & Tracking
We use the following types of cookies and local storage:
- Essential cookies — Session management, authentication, and security (required for the platform to function)
- Preference storage — Saving your UI settings (theme, active business, language) in localStorage
We do not use analytics, advertising, or tracking cookies. We do not share browsing data with ad networks.
9.Security
We implement industry-standard security measures to protect your data:
- Encryption in transit (TLS) and at rest
- Role-based access controls limiting who can access your data
- Regular security reviews and dependency audits
- Two-factor authentication (2FA) support for accounts
- PCI-compliant payment processing via third-party processors
In the event of a data breach that poses a risk to your rights or freedoms, we will notify affected users and relevant authorities as required by law.
10.International Data Transfers
SuddenDev FZE is based in Dubai, UAE. Your data may be processed by our service providers in other countries, including within the EU/EEA and the United States. Where data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses for EU data transfers).
11.Children's Privacy
The Cronos platform is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.
12.Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and notify active users by email or in-app notification.
Continued use of the Service after changes constitutes acceptance of the updated policy.