Privacy Policy

At HelloCrush, a platform operated by SRE Capital Investments SAS, a commercial company domiciled in Colombia, we value and respect your privacy. This Privacy Policy describes how we collect, use, store, and protect your personal information, in compliance with Ley 1581 de 2012 (Colombian Habeas Data Law) and Decreto 1377 de 2013 of the Republic of Colombia, the General Data Protection Regulation (GDPR) of the European Union, and the California Consumer Privacy Act (CCPA/CPRA) of the United States, as applicable to each user. We recommend that you read this document carefully before using the Service.

By registering for and using HelloCrush, you grant your free, prior, express, and informed consent for the processing of your personal data in accordance with this Policy.

1. Information We Collect

1.1 Registration Data

When you create an account, we collect:

• Email address
• Username
• Display name
• Password (stored as a bcrypt-encrypted hash; never in plain text)

1.2 Conversation Data

During your use of the Service, we store text messages exchanged with the AI Companions, transcriptions of voice notes and calls (processed through a third-party speech-to-text provider), and the conversation history necessary to provide a long-term memory experience.

1.3 Payment Data

Payments are processed entirely by Stripe. HelloCrush does not store credit/debit card numbers or sensitive banking data. We do store the Stripe customer identifier, subscription identifier, payment status, and credit transaction history within the platform.

1.4 Usage Data

We record Service usage data for billing, rate limiting, and product improvement purposes, including: request type (text, image, video, audio), AI provider used, tokens consumed, estimated cost, request duration, and success/error metrics.

1.5 Multimedia Files

Images you upload to the Service are stored on Cloudflare R2. AI-generated images and videos requested by you are also stored on R2 and associated with your account.

1.6 Vector Embeddings

To provide long-term conversation memory, HelloCrush generates vector representations (embeddings) of fragments of your conversations using AI models. These embeddings are stored in our internal database and are used exclusively to retrieve relevant context during your interactions with the AI Companions.

1.7 Waitlist Data

Before the Service launches, you can join our waitlist. In that case we collect only your email address, your preferred language, the country your connection comes from (approximate, derived from your network address) and the date you signed up. We use this information exclusively to notify you when the Service becomes available; it is not used for any other purpose or shared with third parties for marketing. A bot-protection check runs when you submit the form. You can ask us to remove your email from the waitlist at any time using the contact details in Section 13, and we delete the waitlist once the launch notification has been sent.

2. How We Use Your Information

We use your information to:

• Create and manage your user account.
• Provide and personalize the Service, including generating AI Companion responses.
• Process payments and manage subscriptions and credits.
• Maintain the security of the Service and detect fraud or abuse.
• Send Service-related notifications (payment confirmations, policy changes, security alerts).
• Comply with legal and regulatory obligations.
• Improve the Service through aggregated and anonymous analysis of usage patterns.

HelloCrush does not sell your personal data to third parties.

3. Third Parties and Service Providers

To operate the Service, we share data with the following providers, who act as data processors under HelloCrush's instructions:

4. Cookies and Similar Technologies

HelloCrush uses JWT (JSON Web Tokens) to manage user authentication. These tokens are stored in the browser's local storage (localStorage) and are valid for 7 days. We do not use third-party tracking cookies or behavioral advertising.

We may use aggregated analytics technologies without individual identification to measure Service performance. If we do so, we will inform you accordingly.

5. Data Subject Rights

In accordance with Ley 1581 de 2012 (Colombian Habeas Data Law), you have the following rights regarding your personal data:

• Access, update, and rectify your personal data.
• Request proof of the authorization granted for the processing of your data.
• Be informed about how your personal data has been used.
• Revoke authorization and/or request the deletion of your data when there is no legal or contractual obligation requiring its retention.
• File complaints with the Superintendencia de Industria y Comercio (SIC) (Colombian Superintendence of Industry and Commerce) for violations of data protection regulations.

To exercise any of these rights, send a written request to legal@hellocrush.ai. We will respond within a maximum period of ten (10) business days, as established by law.

6. Additional Rights for Users in the European Union (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the processing of your data is additionally governed by the General Data Protection Regulation (EU) 2016/679 (GDPR).

6.1 Legal Basis for Processing

We process your data based on:

• Performance of a contract -- necessary to provide the Service (Art. 6.1.b GDPR).
• Consent -- for AI-generated content and optional communications (Art. 6.1.a GDPR).
• Legitimate interest -- for security, fraud prevention, and Service improvement (Art. 6.1.f GDPR).
• Legal obligation -- to comply with tax and regulatory requirements (Art. 6.1.c GDPR).

6.2 Your Rights Under the GDPR

In addition to the rights described in section 5, you have the right to:

• Data portability: receive a copy of your data in a structured, machine-readable format.
• Restriction of processing: request that the processing of your data be restricted in certain circumstances.
• Objection: object to processing based on legitimate interest.
• Erasure (right to be forgotten): request the deletion of your personal data.
• Not be subject to automated decisions: request human review of decisions made exclusively by automated means that significantly affect you.

To exercise these rights, contact our Data Protection Officer at legal@hellocrush.ai. We will respond within a maximum period of 30 calendar days. You may also file a complaint with the data protection supervisory authority in your country of residence.

6.3 International Transfers

Your data is transferred outside the EEA to servers in the United States and other jurisdictions. These transfers are carried out on the basis of the European Commission's Standard Contractual Clauses (SCCs) or other appropriate safeguards in accordance with Chapter V of the GDPR.

7. Additional Rights for Residents in the United States

7.1 California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights:

• Right to know: request what categories and specific personal data we have collected about you.
• Right to delete: request the deletion of your personal data.
• Right to correct: request the correction of inaccurate data.
• Right to opt out: opt out of the sale or sharing of your personal data.
• Non-discrimination: you will not receive inferior service for exercising your privacy rights.

HelloCrush does not sell or share your personal data as defined by the CCPA/CPRA. We do not use behavioral advertising or share data with third parties for advertising purposes.

7.2 Other U.S. States

If you reside in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), or other states with similar privacy laws, you have comparable rights of access, correction, deletion, and opt-out. To exercise these rights, contact legal@hellocrush.ai.

8. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the Service. After account cancellation:

• Profile data and credentials are deleted within 30 days.
• Transaction records are retained for 5 years due to tax and accounting obligations.
• Messages and multimedia files are deleted within 90 days, unless the law requires their retention.
• Vector embeddings associated with your account are deleted along with the conversation data.

9. International Data Transfers

The operation of HelloCrush involves the use of providers whose servers may be located outside of Colombia (United States, European Union, or other jurisdictions). By using the Service, you expressly authorize the international transfer of your personal data to such providers, pursuant to Article 26 of Ley 1581 de 2012 (Colombian Habeas Data Law).

HelloCrush contractually requires its providers to maintain protection standards equivalent to those established by Colombian law.

10. Data Security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure, including:

• Password encryption using bcrypt.
• Encrypted data transmission via TLS/HTTPS.
• Authentication tokens with automatic expiration (7 days).
• Database access restricted by roles and credentials.
• Object storage protected by access control mechanisms.

However, no security system is infallible. In the event of a security breach affecting your data, we will notify you in accordance with applicable legal requirements.

11. Minors

The Service is intended exclusively for persons aged 18 years or older. HelloCrush does not intentionally collect personal data from minors. If you are a parent or guardian and believe that a minor under 18 has provided personal data through the Service, please contact us immediately at legal@hellocrush.ai so that we may proceed with its deletion.

12. Changes to This Policy

HelloCrush may update this Privacy Policy periodically. When material changes are made, we will notify you by email or through a notice on the Service with at least 15 days advance notice. The updated version will take effect on the date indicated at the beginning of this document. Continued use of the Service after that date implies acceptance of the new Policy.

13. Contact and Data Protection Officer

For any inquiries, requests to exercise your rights, or privacy incident reports, please contact our Data Protection Officer (DPO):

You may also file complaints with the Superintendencia de Industria y Comercio (SIC) (Colombian Superintendence of Industry and Commerce) -- sic.gov.co --, the authority responsible for enforcing Ley 1581 de 2012 in Colombia.