Privacy policy

This Privacy Policy explains how Crew Labs LLC ("CrewLabs," "we," "our") collects, uses, and protects information when you use the CrewLabs website, dashboard, and the AI agents we operate on your behalf. We've written it to be readable. If anything is unclear, email hello@crewlabs.net and we'll explain it.

1. Who we are

CrewLabs is a product of Crew Labs LLC, a Florida limited liability company headquartered in Miami, Florida, USA. You can reach us at hello@crewlabs.net for any privacy-related question, request, or concern.

2. What we collect

We collect five categories of information:

• Account data. Name, work email, company, authentication credentials, and billing information (handled by Stripe — we don't store full card numbers ourselves).
• Discovery form submissions. What you tell us on the discovery questionnaire — business name, agent goal, channels you want covered, expected message volume, and any notes you add.
• Channel binding metadata. The identifiers we need to route messages — Telegram chat IDs, Slack workspace IDs, Discord guild IDs, WhatsApp/Twilio numbers, Microsoft Bot Framework IDs. We don't store the raw content of messages we don't process; we only store the wiring that lets us reach your channels.
• Agent message history. The conversations your agent participates in — both inbound and outbound. We keep these because the agent uses them as memory and we use them to debug and improve the agent for you. They're encrypted at rest, isolated to your account, and retained per the schedule below.
• Usage telemetry. Token counts, agent uptime, latency, error rates, and similar operational metrics. We use these to bill accurately, alert on thresholds, and keep your agent healthy.

3. How we use it

• To deliver the agent service you signed up for.
• To bill you and process payments.
• To send threshold alerts (50%/80%/95%/100% of your monthly allotment) and operational notifications.
• To provide customer support when you ask for it.
• To detect and prevent fraud, abuse, and platform misuse.
• To improve the product. Where we use account data for product improvement, it's aggregated or anonymized. We do not use your customers' conversations to train models for other customers.

4. Subprocessors

We rely on a small set of third-party services to deliver CrewLabs. As of the effective date above, our subprocessors are:

• OpenRouter — routes inference requests to the right LLM for each task.
• Fly.io — runs your dedicated agent virtual machine.
• Neon — primary Postgres database (US region, us-east-1).
• Stripe — billing, subscriptions, and payment processing.
• Resend — transactional email (alerts, receipts, support replies).
• Twilio — SMS and WhatsApp delivery, when you enable those channels.
• Cal.com — discovery-call scheduling.
• Vercel — website and dashboard hosting (US region, iad1).

When we add or change a subprocessor that has access to customer data, we'll update this list. Material changes are also communicated by email to active customers.

5. Data retention

We retain customer data for the life of your account plus 30 days after cancellation, after which it's permanently deleted from our production systems. Backups roll off on a 90-day cycle. Aggregated and anonymized analytics — the kind that can't be tied back to you — may be retained indefinitely to help us understand how the product is used.

You can request earlier deletion at any time (see Section 6). If a longer retention is required by law (for example, tax-record obligations on invoices), we'll keep only what the law requires and nothing more.

6. Your rights

You have the right to access, correct, delete, or export your data. You can also object to certain uses or restrict processing. To exercise any of these rights, email hello@crewlabs.net and tell us what you want. We'll respond within 30 days.

If you're in a jurisdiction with stronger statutory rights (such as the EU under GDPR, California under CCPA/CPRA, or Brazil under LGPD), you keep those rights regardless of where you write us from. We don't maintain a separate GDPR Data Protection Officer at our current size — your contact for any of these requests is the same email above, and a real human will read it.

7. Security

We encrypt customer data in transit (TLS) and at rest. Each customer's agent runs in its own isolated virtual machine on Fly.io; agent data is not shared between customer environments. Authentication credentials and integration tokens are encrypted with AES-256-GCM before storage. Access to production systems is restricted to engineers who need it to operate the service.

No system is 100% secure. If we detect a breach affecting your data, we'll notify you without undue delay and explain what happened, what we're doing about it, and what (if anything) we need from you.

8. Children

CrewLabs is a B2B service and is not directed at children under 13. We don't knowingly collect data from children. If you're a parent or guardian and believe a child has given us information, email us and we'll delete it.

9. International users

We host customer data in the United States — Neon (us-east-1), Vercel (iad1), and Fly.io (region depends on the agent VM you're assigned). If you use CrewLabs from outside the US, you acknowledge that your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

10. Changes to this policy

We'll update this policy when our practices change. For material changes, we'll email registered customers at least 30 days before the change takes effect. The effective date at the top of this page always reflects the current version.

11. Contact

Questions, requests, or complaints? Email hello@crewlabs.net. A real person will read it.