Privacy Policy
Last updated November 10, 2026
Crustomer is a customer-relationship and operations platform for small local businesses, such as event groups, venues, home services, beauty, fitness, retail and professional services. It is operated by CRUSTOMER LLC ("Crustomer", "we", "us"). This policy explains what information we collect, how we use it, who we share it with, and the choices you have.
It covers two groups of people: Customers (businesses that use Crustomer, and the team members they invite) and Contacts (people whose details a Customer keeps in Crustomer, including people who message a Customer's Instagram account).
Our role
For a Customer's account details, we decide how the information is used. For the information a Customer keeps in Crustomer about its Contacts (leads, attendees, messages, invoices and similar), we act on the Customer's behalf and only process it to provide the service to that Customer. If you're a Contact and want to know what a business holds about you, please contact that business. We'll help them respond.
Information we collect
- Account information: your name, email address and password (stored in hashed form by our authentication provider), the organizations you belong to and your role in them.
- Customer content: what Customers add to or import into Crustomer, such as leads, attendees, events, projects, invoices, notes and uploaded files.
- Instagram information, when a Customer connects an Instagram professional account through Instagram's official login and API:
- the account's ID, username and name;
- an access token, which is stored only on our servers;
- the account's direct-message conversations: the other person's Instagram username, name and account ID, message text, timestamps, and links to attachments.
- Google information, only if a Customer connects Google: calendar events, spreadsheets and files that Crustomer creates, and read-only access to email, used for the syncing features the Customer turns on.
- Payment information: handled by Stripe. We receive payment status and limited details (such as the last four digits of a card), never full card numbers.
- Technical information: log data such as IP address, browser type and pages requested, and the cookies needed to keep you signed in. We use privacy-focused, aggregate analytics from our hosting provider and no advertising cookies.
Passkeys, Face ID and fingerprints
If you sign in with a passkey, your phone or computer checks your face, fingerprint or device code itself. Your face or fingerprint never leaves your device, and Crustomer never receives, sees or stores it. We only store a public key that lets us confirm the sign-in came from your device. Crustomer has no face, voice or other biometric features.
Visitors to Customers' websites
When you visit a website a Customer hosts on Crustomer, the Customer is responsible for that site, and the Customer's own privacy notice applies to what you send through its forms. To show the Customer how the site is doing, Crustomer records page views and taps (such as call or directions) without cookies: the page, the site that sent you, your approximate city from your IP address, your device and browser type, and page speed. We don't keep the IP address itself. Visits are grouped with a code made from your IP address and browser that changes every day, so they can't be linked across days or across sites. Crustomer-hosted sites don't load advertising pixels or trackers.
If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any "sale" or "sharing" of your personal information, and Crustomer never loads advertising tags for you.
How we use information
- To provide Crustomer: showing a Customer's inbox, leads, events and invoices, and sending the emails and invoices the Customer asks us to send.
- To sort Instagram conversations for the Customer who connected the account. This means suggesting a contact type, category, status and location, and pulling contact details people shared in their messages. Sorting uses rules we wrote and may use an AI service provider acting on our behalf. Results are suggestions the Customer can review and change.
- At a Customer's direction, to send hashed (scrambled) email addresses and phone numbers of that Customer's own contacts to the Customer's own Meta ad account as advertising audiences. Only contacts the Customer collected directly are used. Contacts who opted out are removed automatically, and nothing from Instagram's API is included.
- To keep the service secure, prevent abuse, and fix problems.
- To provide support, process payments, and meet legal obligations.
Instagram and Google data
Information we receive from Instagram or Google is used only to provide the features the Customer who connected that account turned on. We never sell it, never use it for advertising or targeting, never include it in the aggregate insights or partner offers described below, and never share it with another Customer. We don't use Customer content, including Instagram messages, to train AI models, and we choose AI providers that don't train on it either.
Marketing to Crustomer users
We may email people who use Crustomer about our own products, features and offers. You can unsubscribe at any time with the link in those emails. Service messages, like security notices and billing, will still be sent.
Aggregate insights
We may combine information across Customers into aggregate, de-identified statistics that can't reasonably be used to identify any person or business. For example: "event demand in Miami rose this quarter." We may use these insights to improve Crustomer, publish them, or share them with partners. They never include information from Instagram or Google, and we won't try to re-identify anyone from them.
Partner offers, only with consent
Some Customers' forms (for example a guest-list or ticket signup) may include an optional box such as "Also send me events and offers from other Crustomer partners." If a Contact checks it, we and participating partners may send that person offers and may use the details they provided on that form to do so. We only do this for people who opted in. Anyone can withdraw consent at any time by unsubscribing or emailing us. We honor the opt-out rights the law gives you, including the right to opt out of any "sale" or "sharing" of personal information as those terms are defined in laws that apply to you.
Who we share information with
We use service providers that process information for us under contract:
- Supabase: database and sign-in (United States)
- Vercel: hosting and aggregate analytics
- Stripe: payments and invoicing
- Resend: account and sign-in emails
- Amazon Web Services (Amazon SES): sending the email campaigns Customers write to their contacts
- Telnyx: text messages, only when a Customer turns on texting
- Meta (Instagram, Meta Ads): only when a Customer connects Instagram or their Meta ad account
- Google: only when a Customer connects Google
- Anthropic: AI features a Customer turns on: sorting messages, drafting replies for a person to edit and send, short acknowledgments in the welcome flow, and reading screenshots the Customer uploads. Anthropic doesn't train its models on this data.
We share Contacts' details with participating partners only for people who opted in to partner offers (see below). We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.
Requests from public authorities
If a government agency, court or other public authority asks us for someone's information, we:
- check that the request is lawful and properly made before answering it;
- challenge or refuse requests we believe are unlawful, too broad or not properly made;
- disclose only the minimum information the request lawfully requires;
- keep a record of each request, our response and the legal reasoning behind it;
- tell the affected Customer first, unless the law forbids it.
How long we keep information
We keep Customer information while the account is active. When a Customer disconnects Instagram, we delete the access token immediately. Stored conversations stay until the Customer deletes them or asks us to. When an account is closed or a deletion request is confirmed, we delete the data within 30 days. Backup copies roll off within a further 30 days.
Security
Data is encrypted in transit. Each Customer's data is kept separate using database-level access rules. Access tokens for connected services are stored only on our servers and are never sent to browsers. Our staff accounts require two-step sign-in, and Customers can turn it on for theirs. No system is perfectly secure. If a breach affects a Customer's data, we'll tell that Customer without undue delay, and within 72 hours of confirming it, so they can meet their own obligations. We'll also notify people and regulators as the law requires.
Your choices and rights
- Customers can view, edit, export and delete their data in Crustomer, or ask us to.
- Customers can disconnect Instagram at any time in Crustomer (Instagram → Settings → Disconnect), or in Instagram (Settings → Website permissions → Apps and websites).
- Depending on where you live, you may have rights to access, correct, delete or port your information, or to object to certain uses. Email us to use them; we'll respond within the time the law requires.
- To delete data, see our data deletion instructions.
Children
Crustomer is a business tool for people 18 and older. It isn't directed at children, and we don't knowingly collect information from anyone under 13.
Changes
We'll post changes here and update the date above. For significant changes, we'll notify Customers by email or in the app. If we ever start sharing personal information with partners for their own marketing beyond the opt-in partner offers above, we'll update this policy and notify Customers in advance, and we'll only do it with any consent the law requires.
Contact
CRUSTOMER LLC
575 NE 5th Terrace, Apt 140, Fort Lauderdale, FL 33301
privacy@crustomer.us
Place names used to read where contacts are come from the US Census Bureau and from GeoNames (licensed under CC BY 4.0).