Privacy Policy – Genuinely

Effective Date: July 19, 2026
Last Updated: July 19, 2026

Controller / Company: Krava Technologies Private Limited (“Krava,” “Genuinely,” “we,” “us,” or “our”)
Privacy and Support Contact: admin@kravalabs.com

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you access or use the Genuinely mobile application and related websites, features, communications, and services (collectively, the “Service”).

This Privacy Policy applies to information processed through the Service. It does not apply to third-party services that operate under their own privacy policies.

1) What Genuinely does

Genuinely allows users to submit photos and other information about an item for automated analysis. Depending on the item and available information, the Service may provide authenticity-related assessments, classifications, scores, explanations, pricing or valuation information, and other related outputs.

Genuinely uses automated systems, including artificial intelligence and machine-learning technologies, to generate results. Results are informational estimates only and are not guarantees of authenticity, condition, ownership, legality, market value, or future resale value.

2) Information we collect

We may collect the following categories of information. Not every category is collected from every user.

A) Information you provide

This may include:

Uploaded content: photos, item images, and other content you submit for analysis.
Item and search information: asking price, item details, descriptions, search inputs, and other information provided in connection with a scan or analysis.
Account and profile information: name, email address, mobile number, date of birth, time zone, and other profile information, where provided or otherwise associated with your account.
Authentication information: password hashes, authentication tokens, and identifiers associated with Apple, Google, or other sign-in methods.
Feedback: ratings, selections, comments, and other feedback about searches, results, or the Service.
Support communications: messages, attachments, and other information you provide when contacting us.
Other voluntary information: any other information you choose to provide through the Service.

B) Information collected automatically

When you use the Service, we and our service providers may automatically collect:

Device and application information: device model, operating system, app version, build number, language, locale, time zone, device identifiers, app identifiers, and similar technical information.
Usage and interaction information: screens viewed, features used, taps, searches, session information, ad interactions, and other usage events.
Diagnostics and performance information: crash reports, error logs, latency, service performance, and debugging information.
Network and log information: IP address, timestamps, request records, security logs, and related network information.
Approximate location or market information: country, region, or market context inferred from information such as SIM settings, locale, device configuration, network information, or IP address. We do not currently require precise GPS location to provide the core Service.
Consent and permission information: advertising consent, tracking permission, notification permission, privacy choices, and related preference signals.
Security and abuse signals: information used to identify suspicious activity, repeated misuse, fraud, invalid traffic, or attempts to bypass restrictions.

C) Subscription and transaction information

If you purchase a subscription or other paid entitlement, the applicable app store or payment processor handles the payment transaction. We may receive and retain information such as:

product, plan, or entitlement identifiers;
subscription status;
billing, renewal, cancellation, grace-period, hold, pause, expiration, or revocation status;
receipt, transaction, and validation identifiers;
app-store platform and country information; and
other information needed to validate, administer, restore, or support purchases.

We do not receive your complete payment-card details from the app store or payment processor.

D) Advertising and rewarded-ad information

If you request, view, or interact with an advertisement, we and our advertising-related service providers may collect or process:

advertising identifiers, where permitted;
IP address, device information, app information, and approximate country or market information;
ad requests, impressions, completions, dismissals, clicks, and other interaction events;
consent, tracking-permission, and advertising-preference signals;
measurement, attribution, frequency-control, fraud-prevention, and invalid-traffic information;
server-side verification information;
records concerning ad-related credits, including issuance, status, use, expiration, reversal, or refund; and
other information required to deliver, verify, measure, secure, or administer advertising.

E) Push-notification information

If you enable push notifications, we and our service providers may process:

push-notification tokens;
device and delivery information;
notification permission and delivery status;
notification interaction information, where available; and
notification content, which may include information relating to an item, search, result, subscription, or account activity.

Push notifications are enabled only after you grant the relevant device permission. You can disable them through your device settings.

F) Hashed, transformed, and derived information

We may generate or retain hashed, pseudonymous, transformed, aggregated, or derived information from data we collect. This may include hashes or other transformed versions of email addresses, device identifiers, or social sign-in identifiers used for fraud prevention, abuse prevention, security, enforcement, and preventing circumvention of Service restrictions.

Such information may still be treated as personal data under applicable law where it can reasonably be linked to an individual or account.

3) How we use information

We may use information to:

Provide and operate the Service
- process photos, item information, asking prices, and search inputs;
- generate authenticity-related, pricing, valuation, and other analytical outputs;
- maintain accounts, search history, and service records;
- administer subscriptions, entitlements, and purchases; and
- provide features, communications, and notifications.
Provide and administer advertising
- request, deliver, personalise, limit, measure, and report advertisements;
- verify rewarded-ad completion;
- issue, apply, expire, reverse, refund, or otherwise administer ad-related credits; and
- prevent invalid traffic, advertising fraud, and reward abuse.
Improve, test, secure, and maintain the Service
- perform analytics, debugging, testing, quality assurance, and performance monitoring;
- understand use of the Service and improve features and user experience;
- detect and prevent fraud, abuse, unauthorised activity, duplicate-account misuse, and security incidents; and
- enforce our policies, terms, and usage restrictions.
Provide customer support
- respond to questions and privacy requests;
- investigate technical issues; and
- resolve account, subscription, advertising, and service-related problems.
Comply with law and protect rights
- comply with legal obligations and lawful requests;
- establish, exercise, or defend legal claims; and
- protect the rights, safety, property, and integrity of users, Krava, service providers, and others.

We may also use information for other purposes disclosed at the time of collection or with your consent where required.

4) AI processing and automated analysis

The Service relies primarily on automated processing. Photos, asking prices, item information, search context, and related inputs may be processed by our systems and by third-party AI, model-routing, search, data-enrichment, infrastructure, or similar service providers.

We do not use uploaded photos to train models owned by Krava.

Although normal analysis is automated, authorised personnel may access information where reasonably necessary for customer support, debugging, quality assurance, security, abuse investigations, legal compliance, or protecting the Service.

Genuinely’s outputs are informational and are not intended to make legal or similarly significant decisions about you.

5) How we disclose information

A) Service providers and processors

We may disclose information to providers that support the Service, including providers of:

hosting, cloud infrastructure, storage, databases, networking, and compute;
AI, model routing, search, and data enrichment;
authentication and account services;
analytics, diagnostics, testing, and crash reporting;
push notifications and communications;
advertising, consent management, measurement, attribution, and fraud prevention;
app-store, payment, purchase-validation, and subscription services;
security, compliance, anti-abuse, and risk-management services;
customer support and operational services; and
legal, accounting, audit, and other professional services.

These providers may process information on our behalf or, in some cases, under their own applicable terms and privacy policies.

We may add, replace, or remove providers without separately notifying you where the underlying purposes and privacy practices remain materially consistent with this Privacy Policy. We will update this Privacy Policy or provide notice where a change materially alters our practices or where applicable law requires it.

B) Legal, safety, and business disclosures

We may disclose information:

to comply with law, regulation, court order, subpoena, or valid legal process;
to investigate fraud, abuse, security incidents, or violations of our terms;
to protect the rights, safety, property, and integrity of Krava, users, service providers, or others;
to establish, exercise, or defend legal claims; or
in connection with an actual or proposed merger, acquisition, financing, restructuring, insolvency, sale of assets, or similar transaction, subject to appropriate safeguards where required.

We do not sell personal information for monetary payment.

However, disclosures involving advertising or measurement providers may be treated as a “sale,” “sharing,” targeted advertising, cross-context behavioural advertising, or similar regulated activity under certain privacy laws. Where applicable, we provide consent, opt-out, restricted-processing, or other controls required by law.

Rewarded advertisements are shown only after an affirmative action by the user requesting the advertisement or the related benefit.

Depending on your location, device settings, permissions, consent choices, provider availability, and applicable law, advertisements may be contextual, limited, non-personalised, or personalised.

We may use consent-management tools, operating-system permission prompts, or similar mechanisms to obtain or record choices relating to advertising and tracking. On Apple devices, we request App Tracking Transparency permission where required. Refusing tracking or personalised advertising does not necessarily prevent all advertisements from being shown; contextual, limited, or otherwise permitted advertising may still be available.

Advertising availability, format, provider, eligibility, and related benefits may vary over time.

We maintain applicable app-store privacy, data-safety, and advertising disclosures separately from this Privacy Policy.

7) Subscriptions and billing status

Subscriptions and renewals are managed through the applicable app store. Cancelling or deleting your Genuinely account does not itself cancel an app-store subscription.

You must manage or cancel auto-renewal through the applicable app store. Subscription status changes may not be reflected in Genuinely until we receive and process the relevant update from the store.

8) Data retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including service operation, analytics, security, fraud prevention, record-keeping, dispute resolution, legal compliance, and legitimate business purposes.

Current retention practices include:

Uploaded photos: ordinarily retained in active systems for up to 365 days from upload and then scheduled for deletion, unless continued retention is required for security, legal, backup, dispute-resolution, or integrity purposes.
Searches and generated outputs: may be retained for extended or indefinite periods, including after account deletion.
Item inputs, asking prices, and feedback: may be retained with the related search or service record for extended or indefinite periods.
Analytics, diagnostics, and logs: may be retained for extended or indefinite periods. These records may include IP addresses, timestamps, device information, and usage events.
Advertising and ad-credit records: may be retained for extended or indefinite periods for verification, fraud prevention, accounting, analytics, dispute resolution, and enforcement.
Device records and push-notification tokens: may continue to be retained after logout or account deletion.
Subscription and transaction records: may be retained for accounting, audit, tax, chargeback, store-compliance, legal, and dispute-resolution purposes.
Security and abuse-prevention identifiers: hashed, pseudonymous, or transformed identifiers may be retained indefinitely where reasonably necessary to prevent fraud, abuse, circumvention, or repeated misuse.

Account deletion does not necessarily delete all records associated with your use of the Service. Some records may remain connected to internal, pseudonymous, or technical identifiers even after selected direct account identifiers have been removed or transformed.

Retention periods may vary by record type and may change over time, subject to applicable law. Where applicable law requires deletion, shorter retention, or another restriction, we will apply the legally required standard.

9) Account deletion and retained information

You may request account deletion through the account-deletion option in the app.

When deletion is completed, we deactivate or soft-delete the account, revoke access, and remove or transform selected direct account identifiers, which may include name, email address, mobile number, password information, and social sign-in identifiers.

Account deletion does not necessarily delete all information associated with the account. Searches, generated results, uploaded photos until their ordinary deletion time, analytics records, IP logs, device records, push tokens, advertising records, subscription transactions, security records, and other service records may continue to be retained as described in Section 8.

Certain account, profile, technical, or service information—including date of birth and time zone information—may also remain in retained records. Retained information may continue to be linked through internal, pseudonymous, hashed, or technical identifiers.

A deleted account cannot be recovered. After selected account identifiers have been removed or transformed, we may be unable to locate, reconnect, or associate retained records with the former user for account recovery or certain account-specific requests.

Active or unresolved subscriptions

Account deletion may be temporarily unavailable while our records show a paid subscription as active or in certain unresolved billing states, including a grace period, on-hold state, or paused state.

To proceed, you must cancel auto-renewal through the applicable app store. You do not necessarily need to wait for the paid entitlement period to end, but deletion may remain unavailable until we receive and process the updated subscription status from the store.

If you have trouble using the account-deletion function, contact admin@kravalabs.com.

10) Security

We use reasonable technical and organisational measures designed to protect information, including measures such as encryption in transit, access controls, authentication safeguards, monitoring, and least-privilege access.

No method of transmission, storage, or processing is completely secure. We cannot guarantee absolute security.

11) Children and age

Genuinely is a general-audience service. It is not specifically designed, marketed, or offered as a service for children.

We do not currently use a universal age gate or age-verification mechanism. We therefore may not know the age of every user.

Minors should use the Service only with any supervision, permission, or consent required under applicable law. If you are a parent or guardian and believe that a child has provided personal information in circumstances that violate applicable law, contact admin@kravalabs.com. We may request information needed to verify the request and will take appropriate action where legally required.

If we gain actual knowledge that information has been collected or processed in a manner that triggers applicable children’s-privacy obligations, we may restrict the account, request additional information or consent, limit processing, or delete information as required by law.

12) Your privacy rights

Depending on where you live and subject to applicable law, you may have rights to:

request access to personal data;
request correction of inaccurate personal data;
request deletion of personal data;
obtain a portable copy of certain personal data;
object to or restrict certain processing;
withdraw consent where processing is based on consent;
opt out of certain sale, sharing, targeted advertising, or similar activities; and
complain to an applicable data-protection authority.

To exercise a privacy right, email admin@kravalabs.com with the subject “Privacy Request – Genuinely.”

We may request information to verify your identity, account ownership, authority, or jurisdiction. Rights may be subject to legal exceptions, lawful retention requirements, technical limitations, and whether we can reasonably identify the relevant information as belonging to you.

After account deletion, we may be unable to identify or reconnect retained records to the former account because selected account identifiers have been removed or transformed. This may limit our ability to recover the account or fulfil certain account-specific operations.

EU and UK legal bases

Where the EU GDPR or UK GDPR applies, we may process personal data under one or more of the following legal bases:

Contract: to provide and administer the Service.
Legitimate interests: to operate, improve, secure, analyse, and protect the Service; prevent fraud and abuse; and enforce our rights.
Consent: where required for advertising, tracking, permissions, communications, or other processing.
Legal obligation: to comply with law and lawful requests.
Establishment, exercise, or defence of legal claims: where necessary.

United States and other regions

Where applicable, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to opt out of certain sale, sharing, targeted advertising, or profiling activities. We will respond to valid requests as required by applicable law.

13) International data transfers

We operate and use service providers in multiple countries. Your information may therefore be processed in countries other than the country in which you live.

Where required by applicable law, we use recognised safeguards for international transfers, such as contractual protections, adequacy mechanisms, or other legally permitted transfer tools.

14) Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, technology, providers, legal requirements, or our practices.

Provider, infrastructure, or implementation changes that remain materially consistent with this Privacy Policy may occur without separate individual notice. If a change materially alters how we collect, use, disclose, or retain personal information, we will update the “Last Updated” date and provide additional notice where required by applicable law.

15) Contact

Krava Technologies Private Limited
Privacy and Support: admin@kravalabs.com