kraitr Privacy Policy
Last updated: 18 October 2026
This policy explains how kraitr uses the personal data of visitors, waitlist sign-ups, brands, creators and people we contact, on kraitr.com and in the kraitr app.
1. Who is responsible
kraitr is run by Hlib Savenko as a sole proprietor in Austria. Hlib Savenko is the controller for the personal data described in this policy.
Hlib Savenko, trading as kraitr Koschatgasse 57/2/3, 1190 Wien, Austria Email: kraitr.marketplace@gmail.com
Write to this address with any question about your data or to use your rights (section 10).
2. What kraitr does
kraitr is a marketplace for sponsored Instagram videos. Health and wellness businesses ("brands") buy videos from people who run AI personas on Instagram ("creators"). Brands pay a fixed price per video. kraitr checks every script, relays every message between brand and creator, takes the payment and pays the creator.
3. Where your data comes from
Most data comes from you: the forms you fill in, the files you upload and the messages you send. Some data comes from others:
- Instagram (Meta): if you are a creator and connect your Instagram account (section 4.5).
- Stripe: the status of a payment, the country of the card used, and whether a creator's payouts are enabled.
- The other side of an order: a creator receives the brand's brief; a brand receives the creator's scripts and videos.
- Public sources: public Instagram profiles and business websites, for the people we contact before they sign up (section 4.3).
4. What data we use
4.1 Visitors
You can browse kraitr.com, the market and the creator pages without an account. We count page views with PostHog in a mode that sets no cookies. We look at these numbers only in total, not per person. Our hosting provider (Vercel) processes your IP address and technical request data (such as browser type, time and page) to deliver the website and keep it secure.
4.2 Brand waitlist
Before launch, businesses can join a waitlist. We store the email address, business name, business type (company or sole proprietor), website, country, product category and the time the email was confirmed. We send one email to confirm the address. Entries that are not confirmed are deleted after 30 days.
4.3 People we contact before they sign up
We look for AI creators and health and wellness brands on Instagram, on business websites and in similar public places, and send them a short message about kraitr. For this we keep a list.
- Creators: Instagram handle, follower count, niche, country, whether the profile shows Instagram's AI label, whether it is a professional account, views of sample Reels, the status of our contact and notes.
- Brands: business name, website, Instagram handle, product, product category, country, contact name, email address or Instagram handle, the status of our contact and notes.
If you do not want to hear from us, tell us. We will stop contacting you and remove you from the list.
4.4 Creators
- Application: persona name, Instagram handle, niches, country, three sample Reels, and your confirmations that the account is an AI persona and uses no real person's face, voice or name.
- Account: email address, name and role.
- Profile and listing: persona name, persona picture, niches, price range, videos per 30 days, pause status, listing status, founding status and number, strikes, and the version and time of the creator terms you accepted.
- Payouts: your Stripe account id and whether payouts are enabled, the payouts made to you, and the data we need for your monthly self-billed statement (your legal name, country, address and VAT number if you have one).
Stripe collects your identity and bank details directly during Stripe's onboarding. We do not receive your full bank details.
4.5 Instagram data (creators)
When you connect your Instagram professional account, you allow kraitr to read data through Meta's Instagram API with the permissions "instagram_business_basic" and "instagram_business_manage_insights". We read:
- your account id, username, follower count and number of posts;
- for your latest 30 posts: the id, time, link and caption, and for each Reel the views, reach, likes, comments, saves and shares;
- an access token that lets us read this data. We store it encrypted and never write it to logs.
We read this every night, once more about 7 days after each new Reel, and, for videos posted through kraitr, at 48 hours and 7 days after they go live. For 90 days after a kraitr video goes live, we check that the post is still online. We do not read your direct messages, the text of comments, or who your followers are.
From this data we compute your expected views, a "usually at least" view figure, reach and engagement signals, a score and your daily price (section 6).
While our Meta app has standard access, we add your Instagram handle as a tester in Meta's app dashboard so you can connect. Meta therefore learns that your account is a tester of the kraitr app.
4.6 Brands
- Account: email address, name and role.
- Business details: business type (company or sole proprietor), legal name, address, country, VAT number, VAT class (set by kraitr), website, Instagram handle, and your declaration that you buy for your business and not as a consumer, with its time and IP address.
- Products: product URL, name, category and our approval or rejection with its reason.
- Payment and terms: your Stripe customer id, and the version and time of the brand terms you accepted.
- Brand check: whether your account email is on your company's domain or your VAT number was valid in the EU's VIES register, who checked it and when, the decision and its reason. We do not ask for a passport, ID card or selfie.
4.7 Orders and the work
- Quote and order: brand, creator, product, package, every price line (price, commissions, card fee, VAT, total), status and times, the Stripe payment id and the card's country.
- Brief: every field the brand fills in, including the brand's Instagram handle, and up to 10 product images or clips.
- Scripts: every version, its lines and caption, the results of our code and AI checks with their reasons, the AI model and prompt version used, and admin decisions.
- Videos: every uploaded file with its size, length, resolution and a fingerprint (hash).
- Reviews: the brand's approvals and the reasons chosen for changes or a retake.
- Delivery: the post link, the time it went live, when it is payable and when it was paid.
- Refunds, payouts and strikes: amounts, reasons, dates, and the Stripe refund or transfer id.
4.8 Messages and support emails
There is no chat between brands and creators. At launch, you write to kraitr.marketplace@gmail.com with your order id. Later, the order page gets a "Message kraitr" box. A person at kraitr answers or passes your question to the other side in their own words.
Before a message from the box is stored, our filter removes contact details (email addresses, phone numbers, links, handles, payment details). The removed parts are kept encrypted, as evidence in case of off-platform deals or abuse. The same filter checks every free-text field of a brief; a brief with contact details cannot be submitted.
We keep a log of the emails we send you: template, recipient, subject, time and the sending provider's id.
4.9 Payment data
Card payments run on Stripe's hosted checkout page. You enter your card details there. We never see or store your full card number. We receive the payment id, the payment status and the card's country, which we keep as tax evidence.
4.10 Audit log
Every admin action is logged: who did what, on which record, why and when.
5. Why we use your data, and the legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account and logging you in with an email link | Art. 6(1)(b): contract |
| Waitlist and launch emails | Art. 6(1)(a): your consent, given by confirming your email |
| Contacting creators and brands before they sign up | Art. 6(1)(f): our interest in finding creators and customers |
| Reviewing creator applications, listing creators, computing prices, verifying posts | Art. 6(1)(b): contract and steps before it |
| Brand check (company domain or VAT number) | Art. 6(1)(f): knowing who we deal with and preventing fraud and fake accounts; Art. 6(1)(b) |
| Checking business status and setting the VAT class | Art. 6(1)(c): VAT law; Art. 6(1)(f): proof that you buy as a business |
| Product review | Art. 6(1)(b); Art. 6(1)(f): keeping the ads on kraitr lawful |
| Orders, payments, refunds and payouts | Art. 6(1)(b): contract |
| Code and AI checks of scripts and captions, video and post checks | Art. 6(1)(b); Art. 6(1)(f): making sure every ad is disclosed and makes no forbidden claims |
| Relaying messages, removing contact details and keeping the removed parts | Art. 6(1)(b); Art. 6(1)(f): enforcing the no-direct-deals rule and preventing abuse |
| Showing creator profiles in the market | Art. 6(1)(b): creator terms |
| Service emails about your account and orders | Art. 6(1)(b): contract |
| Invoices, credit notes, self-billed statements and accounting records | Art. 6(1)(c): Austrian tax and accounting law |
| Audit log, security logs and error reports | Art. 6(1)(f): keeping kraitr secure and proving what happened |
| Page view counts | Art. 6(1)(f): knowing how the website is used |
| Defending or bringing legal claims | Art. 6(1)(f) |
| Giving data to authorities where the law requires it | Art. 6(1)(c) |
Where we rely on our legitimate interest (Art. 6(1)(f)), you can object (section 10). You do not have to give us your data. Without the data a form marks as required, we cannot create your account, verify you or process an order.
6. Automated checks and pricing
Script and caption checks. Every script and caption is checked in two steps. First, fixed rules in our code look for missing disclosure lines, first-person claims of using the product, disease and weight-loss claims, and contact details. Second, an AI model (Claude Haiku, run by Anthropic for us) reads the script against our content rules and answers "pass", "fail" or "unsure". A fail goes back to the creator with the reasons, to fix. "Unsure", and any technical error, goes to a person at kraitr, who decides. There is no pass without a result from the model. If the AI check is not running, a person at kraitr reads every script.
The checks do not make final decisions about you. A fail does not by itself cancel an order, cost money or cause a strike. Refunds, pausing and delisting are decided by a person at kraitr. You can ask us to look at any check result by writing to kraitr.marketplace@gmail.com.
Creator prices. Every night at 03:00 UTC, our software computes each creator's price from their Instagram numbers, inside the price range the creator chose. If a creator's minimum is above kraitr's price cap, the listing is hidden automatically until the numbers or the range change. This is automated processing that evaluates the performance of your account. It is necessary for our contract with you (Art. 22(2)(a) GDPR). You can ask us to check your price or listing, explain how it was reached, and hear your view: write to kraitr.marketplace@gmail.com.
We make no other decisions about you based only on automated processing.
7. Who receives your data
7.1 Our service providers
These providers process data for us, on our instructions, under data processing terms:
| Provider | What for |
|---|---|
| Supabase | database, login and file storage (including videos) |
| Vercel | hosting and running the website and app |
| Stripe | card payments, refunds and creator payouts |
| Resend | sending emails, including login links |
| Google (Gmail, Google Sheets) | our kraitr.marketplace@gmail.com mailbox and our outreach lists |
| Anthropic | the AI check of scripts and captions |
| PostHog | counting page views, without cookies |
7.2 Others who use data for their own purposes
- Stripe also uses payment data for its own purposes, such as fraud prevention and its legal duties. For creators, Stripe checks identity and bank details during onboarding as its own controller. Stripe's privacy policy applies to that: stripe.com/privacy.
- Meta provides the Instagram data we read, and runs Instagram under its own terms and privacy policy. A video a creator posts is published on Instagram by the creator.
- Authorities and courts, such as tax authorities, where the law requires it.
7.3 Between brands and creators
- A creator sees the brand's name and Instagram handle, the product and the brief, and the brand's review decisions. A creator does not see the brand's contact details, address or the person behind the account.
- A brand sees the creator's persona, public profile on kraitr, scripts, videos, the post link and the order status. A brand does not see the creator's legal name or contact details.
- kraitr never passes contact details from one side to the other.
7.4 Public
The market and creator pages are public. They show a creator's persona name, persona picture, niches, badges, price and daily change, recent prices, "usually at least" views, the saving compared with a human creator and the 6 latest Reels, which kraitr serves itself. They never show the creator's handle, link, email, price range, cap or score.
We do not sell personal data and do not use it for advertising.
8. Transfers outside the EEA
Several of our providers are based in the US or process data there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for that framework. Otherwise it relies on the EU Standard Contractual Clauses in the provider's data processing terms. You can ask us for a copy of these safeguards.
If the other side of your order is outside the EEA (for example a creator in the US, UK, Canada or Switzerland), the order data we must share with them (section 7.3) goes to that country. We do this because it is necessary to carry out the order (Art. 49(1)(b) and (c) GDPR). The UK, Switzerland and Canada are also covered by EU adequacy decisions.
9. How long we keep data
| Data | How long |
|---|---|
| Account data (email, name, role) | as long as the account exists, plus 30 days |
| Waitlist entry, not confirmed | 30 days |
| Waitlist entry, confirmed, if you never sign up | until 6 months after kraitr launches |
| Rejected creator applications | 6 months after the decision |
| Outreach lists (section 4.3) | 12 months after our last contact; at once if you object |
| Other profile data (creator profile, range and capacity, strikes, products) | as long as the account exists, plus 30 days |
| Your acceptance of the terms (version and time) | 7 years |
| Business details, VAT number, business-use declaration with time and IP | 7 years (tax law) |
| Record of the brand check (who, date, decision, reason) | 7 years |
| Instagram access token | until you disconnect (stored encrypted) |
| Reels, captions and views read from Instagram | 2 years |
| Metrics and daily prices we compute | 2 years |
| Orders, amounts, refunds, payouts, invoices, credit notes, self-billed statements | 7 years |
| Card country | 7 years |
| Briefs, scripts, videos and review decisions | 2 years after the order |
| Messages and emails about an order, including removed parts | 2 years after the order |
| Support emails not about an order | 12 months after the last message (emails about an order: as above) |
| Email send log | 12 months |
| Audit log | 7 years |
| Page view counts (PostHog) | 12 months |
| Server logs and error reports | Server logs are kept by our hosting provider (Vercel) only as long as its plan keeps them, currently at most 30 days. We do not use an error-tracking service yet; we will update this section before we do. |
When a period ends, we delete the data or make it anonymous. Data we must keep under tax law cannot be deleted earlier; we block it from any other use until the period ends.
10. Your rights and how to use them
You have the right to:
- access your data and get a copy (Art. 15 GDPR);
- correct wrong data (Art. 16);
- have your data deleted (Art. 17);
- restrict its use (Art. 18);
- receive your data in a common machine-readable format, or have it sent to someone else (Art. 20);
- object to uses based on our legitimate interest (Art. 21), including our outreach messages. We then stop, unless we have compelling reasons or need the data for legal claims;
- withdraw your consent at any time (Art. 7(3)). This does not affect what we did before.
To use a right, email kraitr.marketplace@gmail.com, if possible from the email address of your account. If we cannot tell that the request comes from you, we may ask you to confirm your identity. We answer without undue delay and within one month. It is free.
Deleting your Instagram data. You have three ways:
- Remove kraitr in Instagram: Settings → Website permissions → Apps and websites → kraitr → Remove. Instagram tells us, we delete your access token and stop reading your account. You are then no longer bookable.
- Ask for deletion of your kraitr data through Instagram's data-deletion option for apps.
- Email kraitr.marketplace@gmail.com from your account email, with your Instagram handle, and ask us to delete the Instagram data we hold.
We then delete the data we received from Instagram. We keep only what we need for orders and invoices (for example the link and caption of a kraitr video), for the periods in section 9.
11. Complaints
If you think we handle your data unlawfully, you can complain to the Austrian data protection authority:
Österreichische Datenschutzbehörde Barichgasse 40-42, 1030 Wien, Austria dsb@dsb.gv.at · www.dsb.gv.at
You can also complain to the data protection authority in the EU country where you live or work. We would like to hear from you first, so we can try to fix the problem.
12. Cookies and browser storage
We use no advertising or tracking cookies.
- Login: when you log in with the email link, your browser stores a session (a cookie or a local storage entry) so you stay logged in. This is strictly necessary for the service you asked for.
- Page counts: PostHog runs in a mode that sets no cookies.
- Payment: when you pay, you are on Stripe's checkout page. Stripe sets its own cookies there for the payment and fraud prevention, under Stripe's policies.
If we ever want to use cookies that need your consent, we will ask first.
13. Security
Every table in our database has row-level security: your private data can be read only by you and by kraitr's admin. Instagram tokens are stored encrypted. We set up our logs so that they do not identify people. Our accounts with service providers use two-factor login. If a data breach puts your data at risk, we report it to the data protection authority within 72 hours and tell you where the law requires it.
14. Age
kraitr is for adults only. You must be at least 18 to use it. If we learn that someone under 18 has given us data, we delete it.
15. Changes to this policy
We update this policy when kraitr changes. The date at the top shows the latest version. If a change matters for account holders, we tell them by email before it applies.
16. Contact
Hlib Savenko, trading as kraitr Koschatgasse 57/2/3, 1190 Wien, Austria kraitr.marketplace@gmail.com