TEMPLATE — NOT YET REVIEWED BY A LAWYER. This draft must be reviewed by a licensed attorney and the bracketed placeholders filled in before Crewnook accepts paying customers.
Last updated: [DATE]
This policy explains what information [LEGAL ENTITY NAME] ("Crewnook", "we") collects when businesses use the Crewnook service, how we use it, and the choices you have.
Account data (your name, email, business name, plan): we are responsible for it. Customer Data you enter about your own leads and customers (names, emails, phone numbers, notes): we process it only on your behalf and on your instructions, as a "service provider"/"processor". You are responsible for having a lawful basis and giving any notices required to your own customers.
Text you type into AI features is sent to our AI model provider ([PROVIDER NAME, e.g. Cloudflare Workers AI / OpenAI]) to generate a response. We do not store AI chat conversations or writer drafts on our servers. AI pipeline insights send only aggregate numbers (counts and dollar totals), not names or contact details. Do not enter passwords, payment card numbers, government IDs or health information into AI features. [CONFIRM PROVIDER DATA-RETENTION AND NO-TRAINING TERMS BEFORE LAUNCH.]
To provide, secure and support the Service; to enforce plan limits; to prevent fraud and abuse; to communicate about your account; and to comply with law. We do not sell personal information and do not use Customer Data to advertise to your customers.
Only with sub-processors that help run the Service (hosting and database: Cloudflare; payments: Stripe; AI: [PROVIDER]), when required by law, or as part of a business transfer with equivalent protections.
Encrypted HTTPS connections, salted and hashed passwords (PBKDF2-SHA256), HttpOnly secure session cookies, strict separation of each business's data, role-based permissions, rate limiting, security headers and an audit log of sensitive actions. No system is perfectly secure; we will notify affected customers of a breach as required by law.
We keep data while your account is active. Account owners can permanently delete their workspace in Settings; this removes users, leads, usage and audit records immediately from the live database. Backups held by our hosting provider expire on their normal schedule. Rate-limit counters are temporary.
Depending on where you live (for example California or the EU/UK), you may have rights to access, correct, delete or port your personal information. Contact [PRIVACY EMAIL]. If you are a customer of one of our business users, please contact that business first.
The Service is for businesses and is not directed to anyone under 18.
We will post updates here and notify account owners of material changes. Contact: [LEGAL ENTITY NAME] · [MAILING ADDRESS] · [PRIVACY EMAIL]