Privacy Policy

Crustomer is a customer-relationship and operations platform for event groups, promoters and venues. It is operated by [Legal business name — pending] ("Crustomer", "we", "us"). This policy explains what information we collect, how we use it, who we share it with, and the choices you have.

It covers two groups of people: Customers (businesses that use Crustomer, and the team members they invite) and Contacts (people whose details a Customer keeps in Crustomer, including people who message a Customer's Instagram account).

Our role

For a Customer's account details, we decide how the information is used. For the information a Customer keeps in Crustomer about its Contacts (leads, attendees, messages, invoices and similar), we act on the Customer's behalf and only process it to provide the service to that Customer. If you're a Contact and want to know what a business holds about you, please contact that business. We'll help them respond.

Information we collect

• Account information: your name, email address and password (stored in hashed form by our authentication provider), the organizations you belong to and your role in them.
• Customer content: what Customers add to or import into Crustomer, such as leads, attendees, events, projects, invoices, notes and uploaded files.
• Instagram information, when a Customer connects an Instagram professional account through Instagram's official login and API:
  • the account's ID, username and name;
  • an access token, which is stored only on our servers;
  • the account's direct-message conversations: the other person's Instagram username, name and account ID, message text, timestamps, and links to attachments.
  When a Customer uploads Instagram's "Download your information" file instead, the file is read in their browser and only message text, names, usernames and timestamps are sent to us; photos and videos are not.
• Google information, only if a Customer connects Google: calendar events, spreadsheets and files that Crustomer creates, and read-only access to email, used for the syncing features the Customer turns on.
• Payment information: handled by Stripe. We receive payment status and limited details (such as the last four digits of a card), never full card numbers.
• Technical information: log data such as IP address, browser type and pages requested, and the cookies needed to keep you signed in. We use privacy-focused, aggregate analytics from our hosting provider and no advertising cookies.

How we use information

• To provide Crustomer: showing a Customer's inbox, leads, events and invoices, and sending the emails and invoices the Customer asks us to send.
• To sort Instagram conversations for the Customer who connected the account. This means suggesting a contact type, category, status and location, and pulling contact details people shared in their messages. Sorting uses rules we wrote and may use an AI service provider acting on our behalf. Results are suggestions the Customer can review and change.
• At a Customer's direction, to send hashed (scrambled) email addresses and phone numbers of that Customer's own contacts to the Customer's own Meta ad account as advertising audiences. Only contacts the Customer collected directly are used. Contacts who opted out are removed automatically, and nothing from Instagram's API is included.
• To keep the service secure, prevent abuse, and fix problems.
• To provide support, process payments, and meet legal obligations.

Instagram and Google data

Information we receive from Instagram or Google is used only to provide the features the Customer who connected that account turned on. We never sell it, never use it for advertising or targeting, never include it in the aggregate insights or partner offers described below, and never share it with another Customer. We don't use Customer content, including Instagram messages, to train AI models, and we choose AI providers that don't train on it either.

Marketing to Crustomer users

We may email people who use Crustomer about our own products, features and offers. You can unsubscribe at any time with the link in those emails. Service messages, like security notices and billing, will still be sent.

Aggregate insights

We may combine information across Customers into aggregate, de-identified statistics that can't reasonably be used to identify any person or business. For example: "event demand in Miami rose this quarter." We may use these insights to improve Crustomer, publish them, or share them with partners. They never include information from Instagram or Google, and we won't try to re-identify anyone from them.

Partner offers, only with consent

Some Customers' forms (for example a guest-list or ticket signup) may include an optional box such as "Also send me events and offers from other Crustomer partners." If a Contact checks it, we and participating partners may send that person offers and may use the details they provided on that form to do so. We only do this for people who opted in. Anyone can withdraw consent at any time by unsubscribing or emailing us. We honor the opt-out rights the law gives you, including the right to opt out of any "sale" or "sharing" of personal information as those terms are defined in laws that apply to you.

Who we share information with

We use service providers that process information for us under contract:

• Supabase: database and sign-in (United States)
• Vercel: hosting and aggregate analytics
• Stripe: payments and invoicing
• Resend: sending email
• Meta (Instagram, Meta Ads): only when a Customer connects Instagram or their Meta ad account
• Google: only when a Customer connects Google
• Anthropic: message sorting, if a Customer uses AI-assisted sorting

We share Contacts' details with participating partners only for people who opted in to partner offers (see below). We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

How long we keep information

We keep Customer information while the account is active. When a Customer disconnects Instagram, we delete the access token immediately. Stored conversations stay until the Customer deletes them or asks us to. When an account is closed or a deletion request is confirmed, we delete the data within 30 days. Backup copies roll off within a further 30 days.

Security

Data is encrypted in transit. Each Customer's data is kept separate using database-level access rules. Access tokens for connected services are stored only on our servers and are never sent to browsers. No system is perfectly secure, but we work to protect your information and will notify affected Customers of a breach as the law requires.

Your choices and rights

• Customers can view, edit, export and delete their data in Crustomer, or ask us to.
• Customers can disconnect Instagram at any time in Crustomer (Instagram → Settings → Disconnect), or in Instagram (Settings → Website permissions → Apps and websites).
• Depending on where you live, you may have rights to access, correct, delete or port your information, or to object to certain uses. Email us to use them; we'll respond within the time the law requires.
• To delete data, see our data deletion instructions.

Children

Crustomer is a business tool for people 18 and older. It isn't directed at children, and we don't knowingly collect information from anyone under 13.

Changes

We'll post changes here and update the date above. For significant changes, we'll notify Customers by email or in the app. If we ever start sharing personal information with partners for their own marketing beyond the opt-in partner offers above, we'll update this policy and notify Customers in advance, and we'll only do it with any consent the law requires.

Contact

[Legal business name — pending]
[Business mailing address — pending]
privacy@crustomer.us