Privacy Policy

1. Who we are and what this policy covers

Hypothis is operated by Kratu AI LLC, a Utah limited liability company, 2114 Wasatch Blvd, Sandy, UT 84092 ("we", "us"). This policy explains what personal information we collect through hypothis.ai, the Hypothis app, our emails and public research forms, how we use and share it, and the choices and rights you have.

• Account holders (founders using Hypothis): we are the controller (GDPR) / business (CCPA) for your account data.
• Respondents (people answering a founder's form): the founder who published the form is the controller of your answers; we process them on the founder's behalf as a processor / service provider under our Data Processing Addendum. See Section 13.
• Website visitors: we are the controller for analytics and cookie data.

2. Information we collect

We do not use device fingerprinting to recognise or track you across sites or visits, use advertising or retargeting pixels, or buy personal information from data brokers. We don't intentionally collect sensitive personal information other than account login credentials, which are used only to sign you in.

3. How we use information, and our legal bases

For visitors and users in the EU/EEA, UK and Switzerland, each use relies on a legal basis under the GDPR:

4. AI processing

Hypothis uses Google's Gemini API to draft hypotheses and forms, analyse responses, produce verdicts and — if a founder turns it on — ask respondents adaptive follow-up questions in real time. To do this, the relevant idea and research content, and respondents' open-ended answers (including answers to adaptive follow-up questions), are sent to Google. When we analyse responses, fields we detect as contact details are excluded, and email addresses, phone numbers and links written inside answers are redacted first.

• We keep verbatim AI prompts and outputs for up to 30 days to debug and improve reliability, then delete them automatically. Usage counts (for billing) are kept longer without the content.
• We don't use your content or respondent data to train AI models, and we use Google's paid API tier, under which Google doesn't use API data to train its models.
• Verdicts are assessments of a business idea, not decisions about a person. We don't make decisions with legal or similarly significant effects about anyone based solely on automated processing, and Hypothis isn't used to make decisions about employment, credit, housing, insurance, healthcare or similar consequential matters affecting an individual.
• You're interacting with an AI system. Adaptive follow-up questions shown to respondents (when a founder enables that feature) are generated by AI in real time and are labeled as such on the form. Ask us any time and we'll confirm whether you're interacting with a person or an AI system.

5. How we share information

We do not sell personal information, and we do not "share" it for cross-context behavioural advertising (as those terms are defined in the CCPA/CPRA). We disclose it only:

• To subprocessors / service providers who process it for us under contract — hosting, CDN and security (Cloudflare), AI (Google Gemini), payments (Stripe), email and contact management (Brevo), analytics (PostHog, Google Analytics — consent-based), error monitoring (Sentry). The current list, with what each receives and where, is at hypothis.ai/subprocessors.
• To services you connect — e.g. rows you export to Google Sheets or payloads you send to your own webhooks.
• To the founder who owns a form, for respondents' answers.
• For legal reasons — to comply with law or valid legal process, to enforce our Terms, or to protect the rights, property or safety of people or the Service (including reporting child sexual abuse material to NCMEC).
• In a business transfer — if we're involved in a merger, acquisition or sale of assets, subject to this policy.
• With your consent or at your direction.

6. Marketing email and text messages

Email

• Account, security, billing and trial emails (for example email verification, receipts, "your trial ends in 3 days") are part of the Service and are sent regardless of marketing preferences.
• Marketing email (product news, founder tips, discount offers) is off by default. You can opt in at sign-up or in Settings. If you're outside the EU/UK/Switzerland and haven't opted out, we may occasionally send you offers related to your account (for example a discount after your trial ends).
• Every marketing email includes an unsubscribe link that works in one click, and our postal address. You can also turn marketing off in Settings → Account → Email preferences, or email [email protected]. We honour opt-outs immediately.
• We keep unsubscribed addresses on a suppression list so we don't email them again, even if the account is deleted.

Text messages (SMS)

We don't currently send text messages. If we add SMS, we'll only send marketing texts with your prior express written consent, which is never a condition of purchase; you'll be able to reply STOP to opt out and HELP for help; message and data rates may apply; and we won't share your mobile number or SMS consent with third parties for their marketing.

7. Cookies and similar technologies

• EU/EEA, UK, Switzerland: analytics load only after you accept them.
• Elsewhere: analytics are on by default and you can opt out.
• Global Privacy Control: if your browser sends a GPC signal we treat it as an opt-out of analytics (and of any sale/sharing, which we don't do anyway). We also honour Do Not Track for analytics.
• Change your choice any time: Your Privacy Choices / Cookie settings (also in the site footer).
• Public research forms don't load analytics or advertising tools.
• Hypothis's own fonts are served from our servers. If a founder picks a custom font for a form (for example Roboto or Poppins), that font loads from Google Fonts, which receives the respondent's IP address.

8. How long we keep information

9. Security

We use TLS encryption in transit, Argon2id password hashing, AES-256-GCM encryption for stored sign-in tokens, tenant isolation in the database, least-privilege access, rate limiting and bot protection, and off-site encrypted backups. No system is perfectly secure; if we learn of a breach affecting your personal information, we'll notify you and regulators as the law requires. Report vulnerabilities to [email protected].

10. International transfers

We're based in the United States and our main infrastructure is in the U.S.; some subprocessors (such as Brevo in France) are elsewhere. When we transfer personal data from the EU/EEA, UK or Switzerland, we rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where our subprocessors are certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum), plus supplementary measures where appropriate.

11. Your privacy rights

Everyone

• Access & portability: Settings → Account → Privacy & your data → Download gives you a ZIP of your account data.
• Correction: edit your name in Settings, or ask us to correct anything else.
• Deletion: Settings → Delete account.
• Marketing & analytics opt-out: Settings → Email preferences; the unsubscribe link; Your Privacy Choices.

EU/EEA, UK and Switzerland (GDPR)

You can access, rectify, erase, restrict or object to processing of your personal data, receive it in a portable format, and withdraw consent at any time (without affecting earlier processing). You can object at any time to processing based on legitimate interests and to direct marketing. You may complain to your local data protection authority, though we'd appreciate the chance to help first.

California (CCPA/CPRA) and other U.S. states

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws have, depending on the state, the right to: know what personal information we collect, use and disclose and access a copy; correct it; delete it; obtain it in a portable format; opt out of its sale, sharing for cross-context behavioural advertising, targeted advertising, and profiling in furtherance of significant decisions (we do none of these); and not be discriminated against for exercising these rights. We don't use sensitive personal information for purposes that would give you a right to limit it.

How to make a request

• Use the in-app tools above, or email [email protected] from your account email.
• We verify requests by confirming control of the account email; we may ask for more information if needed. We don't require you to create an account to make a request.
• You may use an authorized agent; we'll ask for proof of their authority and may verify your identity directly.
• We respond within one month (GDPR) or 45 days (U.S. state laws), and will tell you if we need an extension the law allows.
• Appeals: if we decline a request, reply to our decision or email [email protected] with "Appeal" in the subject. We'll answer within the time your state requires (typically 45–60 days). If you're unhappy with the result you can contact your state Attorney General.

12. Notice at collection for California residents

In the last 12 months we collected the following categories of personal information (as defined by the CCPA):

Sources, purposes and retention for each category are described in Sections 2, 3 and 8. We have not sold or shared personal information, including of consumers under 16. Nevada residents: we don't sell covered information; you can still email [email protected] to register a request.

13. If you answered a form built with Hypothis

The founder who published the form decides what to ask and what to do with your answers; their own privacy notice (if they have one) applies to them. We host the form and store and process your answers on their behalf. Specifically:

• We collect your answers, anything you choose to add (like a name or email for follow-up), your truncated IP address, approximate city/country, device, browser and time zone, and a daily visitor hash that can't be reversed. We use these to show the founder aggregate analytics and to block spam and bots. Your IP is truncated when stored and removed after 30 days.
• If the founder enabled AI follow-up questions, some of your open-text answers are sent to Google's Gemini API in real time to generate the next question.
• If you happen to be signed in to your own Hypothis account while answering, your account email is recorded with your response.
• Public forms don't load analytics or advertising trackers.
• To access, correct or delete your answers, contact the founder who sent you the form. If you can't reach them, email [email protected] with the form link and we'll forward your request and help as a processor must.

14. Children's privacy

Hypothis isn't directed to children. You must be at least 16 to create an account. We don't knowingly collect personal information from children under 13 (or under 16 in the EU/UK), and founders may not use Hypothis to do so without the consents the law requires. If you believe a child has given us personal information, email [email protected] and we'll delete it.

15. Changes to this policy

We'll post any changes here and update the effective date. For material changes we'll notify account holders by email or in the app before they take effect, and ask for consent again where the law requires.

16. Contact us

Kratu AI LLC, Attn: Privacy, 2114 Wasatch Blvd, Sandy, UT 84092 · [email protected]. For respondents to a founder's form, see Section 13.