Data Processing Addendum
Last updated
How these terms fit
These terms apply to the content you process with Crewloop and add to our Terms of Service. Where the two conflict, these terms control for the content you process with Crewloop, except that the Disputes section of the Terms of Service always governs any dispute about the content you process with Crewloop; these terms do not restate, change or replace it.
Who does what
The business that uses Crewloop ("you") decides which conversations and tools to connect and why. For that content you are the controller (the "business" under the CCPA) and Crewloop is your processor (your "service provider").
The services you connect on your own account (your phone system, recorders, meeting tools, email, chat, storage and AI app) are yours. They work for you under your agreements with them, not as our sub-processors.
What we do with your content
- We process your content only to provide, secure and support Crewloop for you, as you direct through the service and as these terms and our Terms of Service describe, and as the law requires.
- We do not sell or share your content, and we do not use it for any purpose of our own outside our work for you.
- Crewloop runs no AI model of its own. Today we do not use your content to train any AI model.
- Everyone at Crewloop who can reach your content is bound to keep it confidential.
Security
We take reasonable technical and organizational measures to protect your content, including encryption in transit and at rest, and keeping each company’s data apart from every other company’s in our database.
If we learn of a breach of security that leads to unauthorized access to your content, we will tell your account owner without undue delay and as the law requires, and give you the information we reasonably can to help you meet your own obligations.
Sub-processors
You allow us to use the companies below to run Crewloop. Each is bound to protect your content as these terms require. We may add or replace one; the date on this page shows when the list last changed.
| Vendor | What it does | Data it receives | Where | Audit report |
|---|---|---|---|---|
| Cloudflare | Runs Crewloop's services, its connection runners and queues, and the website; checks that sign-ups come from a person (Turnstile); and counts website visits (Web Analytics). | Everything the service handles while it processes it: a business's conversations in transit and in the runners' storage, sealed connection credentials, and each request's IP address and browser details. | United States, and other countries where Cloudflare’s network runs | Report (Cloudflare) (under NDA) |
| Supabase | Hosts Crewloop's database (accounts, early-access sign-ups and the conversation index) and runs sign-in. | Accounts, sign-ups, sign-in records and the conversation index. | United States | Report (Supabase) |
| Stripe | Processes payments and calculates and collects tax. | A business's billing contact, company address, card details (held by Stripe) and subscription. | United States, and other countries where Stripe operates | Report (Stripe) |
| Resend | Sends Crewloop's email, such as sign-in codes and the reports a business chooses to receive by email. | Recipients’ addresses and the content of each message. | United States | Report (Resend) |
| Hosts Crewloop's team inboxes (Google Workspace), where messages you send to our addresses arrive. | The messages you send us, with your name and email address. | United States, and other countries where Google operates | Report (Google) |
Requests from the people in your conversations
If a person asks to see, correct or delete what Crewloop holds about them, we will help you answer as the law requires. If they write to us directly, we will send the request to you. Write to support@crewloop.ai.
Deletion and return
Your full record is already in your own storage. Crewloop's index of it can be exported, and when you delete your company's account, or ask us to, we delete your content from our systems, except where the law requires us to keep something. Copies in backups expire on their normal schedule.