Crystal Privacy Policy

Effective date: 4 September 2026

This Privacy Policy explains how Crystal handles personal data. It applies to the Crystal website, waitlist, related communications, and any other Crystal service that links to this Policy. A particular service may provide an additional notice if it uses personal data in a different way.

1. Who is responsible for your data

Crystal is currently operated jointly by Kamil Moskała and Filip Wnęk. They are joint controllers of the personal data described in this Policy and share responsibility for how it is used and protected.

You may exercise your rights against either joint controller. For the simplest contact route, email support@crystal.design. This arrangement does not limit any rights you have under applicable law.

Crystal is not yet operated by an incorporated company. If a company later becomes responsible for Crystal, we will update this Policy and provide any notice required by law.

2. Personal data we collect

The data we collect depends on how you interact with Crystal.

Data you provide

We may collect:

• your email address and signup details when you join the waitlist;
• your communication preferences and records of consent or withdrawal;
• information you include when you contact us; and
• records relating to privacy requests, complaints, and our responses.

Please do not submit sensitive personal data through the waitlist or ordinary support messages.

Data collected when you use the website

We may collect limited information needed to operate, protect, and understand use of the website, including:

• network, browser, device, and operating-system information;
• approximate location derived from network information;
• pages viewed, referring pages, campaign information, and interactions with the website; and
• diagnostic, security, and error information.

Our website analytics are designed to avoid identifying visitors directly. We do not provide information submitted through the waitlist form to our analytics service.

3. How and why we use personal data

Where we rely on legitimate interests, we consider the impact on the people whose data is involved and use proportionate safeguards. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully.

4. Waitlist and communications

Joining the waitlist asks us to keep your email address and contact you about Crystal's launch or access. If we offer a broader newsletter, joining it will be optional and separate from joining the waitlist.

You may leave the waitlist or withdraw an optional newsletter subscription at any time by using an unsubscribe method included in a message, where available, or by emailing support@crystal.design. Leaving the newsletter does not remove you from the waitlist unless you ask us to remove you from both.

5. Analytics

We use limited, privacy-focused analytics to understand aggregate website traffic, campaign performance, and interactions with the website. We do not use advertising trackers, build advertising profiles, or track visitors across unrelated websites for behavioural advertising.

Analytics may involve processing website usage, device and network information, campaign information, and approximate location. You can enable the Do Not Track setting in your browser to prevent collection by our current analytics service.

6. How we disclose personal data

We do not sell or rent personal data. We do not share personal data for cross-context behavioural advertising.

We may disclose only the data reasonably necessary to:

• providers that support hosting, security, data storage, analytics, and communications;
• professional advisers where their assistance is reasonably necessary;
• authorities or other parties when disclosure is required by law or necessary to protect rights, safety, and security; and
• a future Crystal company, buyer, or successor as part of a genuine reorganisation, financing, sale, or transfer, subject to appropriate notice and safeguards.

Service providers may process data only for the agreed services, their legitimate legal obligations, and other purposes permitted by applicable law.

7. International data transfers

Our service providers may process personal data in countries other than the country where you live.

Where applicable law requires safeguards for an international transfer, we use an appropriate legal mechanism and additional safeguards where necessary. You may contact us for more information about safeguards relevant to your data.

8. Retention

We keep personal data only for as long as needed for the purposes described in this Policy:

• waitlist data: while Crystal is being developed and access is being introduced, unless you leave earlier; we review at least annually whether continued retention remains necessary;
• optional newsletter data: until you withdraw your consent or request deletion;
• unsubscribe records: the minimum information needed to honour your choice and demonstrate compliance;
• website analytics and technical records: for the period reasonably needed to measure the website, maintain security, troubleshoot problems, and prevent abuse; and
• communications and privacy requests: for the time needed to respond and maintain an appropriate compliance record.

We may keep limited information for longer where required by law or reasonably necessary to establish, exercise, or defend legal claims. When data is no longer needed, we delete it or anonymise it.

9. Security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, encrypted transmission, and limiting access to people who need the data. No method of transmission or storage is completely secure.

10. Your choices and rights

You may contact us to ask for access to or correction or deletion of your personal data. Depending on where you live and which law applies, you may also have rights to:

• restrict or object to processing;
• receive a portable copy of certain data;
• withdraw consent at any time;
• opt out of certain sales, sharing, targeted advertising, or profiling; and
• appeal a decision or complain to a regulator.

You may complain to a data-protection, privacy, or consumer-protection authority where applicable law gives you that right.

To exercise a right, email support@crystal.design. We may request information reasonably necessary to verify your identity and request. We will not discriminate against you for exercising a right provided by applicable law.

Providing an email address is voluntary, but we cannot add you to the waitlist or optional newsletter without it. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

11. Children

Crystal is intended for people aged 16 or older. We do not knowingly collect personal data from anyone under 16. If you believe that a person under 16 has submitted personal data, contact support@crystal.design so we can investigate and delete it where appropriate.

12. Changes to this Policy

We may update this Policy when Crystal, our data practices, or legal obligations change. We will post the updated version with a new effective date. If a change materially affects how we use data already collected, we will provide additional notice or request consent where required.

Additional features may be covered by a supplementary privacy notice. We will update the relevant notice before using personal data for a materially different purpose.

13. Legal information and contact

For questions, withdrawals, or privacy requests, contact:

Email: support@crystal.design

The joint controllers are:

Kamil Moskała
Wesoła 4/34
32-050 Skawina, Poland

Filip Wnęk
Gołaśka 14
30-619 Kraków, Poland