IntoruBack to home

Privacy Policy

Last updated: July 16, 2026

KRG Capital OÜ, registry code 16327861, VAT ID EE102552320, trading as Intoru ("we", "us", or "our"), operates the website intoru.ai and the Intoru platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

For GDPR purposes, KRG Capital OÜ is the controller of personal data processed through the Service. Our registered office is Tormi tn 9, Saku alevik, Saku vald, Harju maakond 75501, Estonia.

1. Information We Collect

Account Information

When you create an account through Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.

Profile & Product Information

You provide details about your business, role, team size, product stage, customer-search habits, acquisition source, product, ideal customer profile (ICP), competitors, and target subreddits. We use this information to understand who uses Intoru, improve the service, and configure your lead discovery pipeline.

When you create an account, we also record signup campaign parameters such as UTM source, medium, campaign, content, and term, together with the external referring page address without its query string. We attach this information to your account to understand which acquisition sources bring people to Intoru.

Payment Information

Payment processing is handled by Stripe. We do not store your credit card number or full payment details. We receive only a confirmation of payment status and subscription details from Stripe.

Usage Data

We use PostHog for product analytics inside Intoru. Product analytics can include your internal account ID, named product actions, selected plan category, campaign ID, timestamps, deployment version, and a masked recording of eligible app sessions. We use this data to find signup and activation problems and improve the service.

Session replay is limited to selected authentication and product pages. We mask all form inputs and page text and block campaign content, intake conversations, Reddit content, lead drafts, support messages, request and response bodies, headers, cookies, and URL query strings. Admin, password-reset, billing-management, account-management, and account deletion pages are excluded from replay.

2. How We Use Your Information

  • To provide and maintain the Intoru service
  • To personalize your lead discovery pipeline based on your product profile
  • To process payments and manage your subscription
  • To send transactional emails (e.g., new lead alerts, account notifications)
  • To improve and optimize our service
  • To comply with legal obligations

3. Public Data Processing

Intoru monitors publicly available Reddit posts to identify potential leads for your business. We only access content that is publicly available. We do not access private messages, private subreddits, or any non-public content. The leads we surface are derived from public posts.

We process this public content on the basis of our legitimate interest in providing lead-discovery services. The raw content is retained only for a short period; posts surfaced as leads remain available to the customer they were delivered to. If you are a Reddit user and want content you authored excluded from our processing, contact us at [email protected] and we will action it.

4. Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases: the performance of our contract with you (account, campaigns, billing, and delivering the service), our legitimate interests (processing public Reddit content as described above, securing and monitoring the service, and preventing abuse), and your consent where we ask for it specifically. We do not sell personal data, and we do not use your data to train AI models.

5. Third-Party Services

We use the following third-party services:

  • Google OAuth: authentication. Subject to Google's Privacy Policy.
  • Stripe: payment processing. Subject to Stripe's Privacy Policy.
  • Hetzner: cloud infrastructure and database hosting (Ashburn, Virginia, US).
  • OpenAI & Anthropic: AI processing for lead scoring and synthesis. Your product profile data is sent to these providers to evaluate leads. Subject to their respective privacy policies.
  • Resend: transactional email delivery.
  • Sentry: error monitoring. When something breaks, error reports may include your IP address and request context. Subject to Sentry's Privacy Policy.
  • PostHog Cloud EU: identified product analytics and masked session replay, processed in Frankfurt, Germany. PostHog receives our internal account ID and the bounded usage data described above. It does not receive your email address, name, passwords, campaign text, prompts, or Reddit content from this integration. Subject to PostHog's Privacy Policy.

6. Where Your Data Is Stored

Our servers are located in the United States (Ashburn, Virginia), operated by Hetzner. If you are in the EU/EEA, this means your personal data is transferred to and stored in the United States. These transfers are safeguarded by the European Commission's Standard Contractual Clauses with our infrastructure and service providers.

7. Cookies

We use essential cookies and browser storage to maintain your authentication session and remember your preferences (e.g., sidebar state), and keep signup attribution while you move between registration pages. Signup attribution is removed from browser session storage after successful authentication. PostHog uses first-party browser storage to maintain a product analytics identity and session. We do not use third-party advertising cookies.

8. Data Retention

We retain your account data for as long as your account is active. Lead data (opportunities) is retained for the lifetime of your account. Identified PostHog events and eligible session replays are retained for up to 30 days. If you delete your account, we submit deletion of the PostHog person and associated recordings using your internal account ID and delete your other personal data within 30 days. A failed provider deletion remains queued for retry and operator review. Aggregated, anonymized data may be retained for analytics purposes.

9. Data Security

We use industry-standard security measures including encrypted connections (TLS/SSL), secure authentication tokens, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and personal data
  • Export your data in a portable format
  • Withdraw consent for optional data processing
  • Ask us to disable optional product analytics for your account

To exercise any of these rights, contact us at [email protected].

11. Children's Privacy

Intoru is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].