Privacy policy.
crub is the back office for creators. This policy explains what crub collects, what it does with it, who helps us run it, and the choices you have. It covers crub.co and the crub app at app.crub.co.
- 1. Who we are
- 2. What we collect
- 3. Gmail and Google data
- 4. Google API Services User Data Policy
- 5. AI features
- 6. How we use data, and why
- 7. Who processes data for us
- 8. International transfers
- 9. How long we keep data
- 10. Security
- 11. Your rights and choices
- 12. Cookies and browser storage
- 13. Children
- 14. Changes to this policy
- 15. Contact
1. Who we are
crub is operated by Golden Locks, Lda., a company registered in Portugal with NIPC 514264233, whose registered office is at Av. Miguel Bombarda 42, 6A, 1050-166 Lisboa, Portugal. Golden Locks, Lda. is the controller of the personal data described here under the EU General Data Protection Regulation (GDPR).
Questions about privacy: privacy@crub.co.
2. What we collect
Account
You sign in to crub with Google. Sign-in asks Google only for the openid, email and profile scopes, which give us your name, your email address, your Google account identifier and the profile picture address your Google account provides. crub never sees your Google password.
Details you enter
Your creator type, the platforms you work on and their handles, your agency and its fee, your invoicing details (legal name, tax number, address), your currency, your default payment terms and your time zone.
Your work in crub
The companies, people, campaigns, deliverables, invoices, lists, notes, tasks and files you create or that crub files for you from your email. Files include anything you upload to a campaign, such as a contract, a brief or a mood board.
Only if you connect Gmail or use your forwarding address. Section 3 describes exactly what crub reads, stores and sends.
Company websites
For each company you email or add to crub, crub visits that company's public website: its homepage, at most an About page and a legal notice, and its public DNS records. From them crub shows the company's logo, what it does, where it is based, when it was founded, its social profiles, and the legal details it publishes, which crub offers for your invoices. crub reads each website once for every account that has the company, from crub's own servers, so your browser never visits it and the website is not told who you are. When the website does not state a detail, crub looks the company up by its web address in Wikidata, the free public database of the Wikimedia Foundation, and uses what Wikidata publishes about it: when it was founded, where it is based, its size, its parent company, its social profiles and its logo. Nothing about you goes to Wikidata, only the company's web address. Logos are kept as images at addresses made from the image itself, which reveal nothing about who has which company.
Technical data
Our hosting and database providers keep short-lived logs of requests to crub (IP address, browser, time and errors) to keep the service secure and working. crub uses no analytics and no advertising trackers.
Waitlist
If you join the waitlist on crub.co: your email address, how you heard about crub, the kind of creator you are and, if you give them, your main platform and your handle there. We email you a link to confirm the address is yours, and keep the date you signed up and confirmed. To stop abuse of the form, we also keep a scrambled form of the internet address it was sent from (a keyed hash, not the address itself) for one day.
3. Gmail and Google data
Connecting Gmail is optional. It is a separate step after you sign in, and you can disconnect at any time. When you connect, crub asks Google for these permissions. Only the first is required; you can untick the others on Google's screen.
| Permission | What crub does with it |
|---|---|
gmail.modifyRead, compose and send email from your Gmail account | Reads your messages to find the conversations you have with brands, agencies and other contacts, and keeps the ones that matter to your work: who wrote, to whom, when, the subject, the message text and the names of its attachments. Attachment files stay in Gmail; crub fetches one only when you open it. From them crub files companies and people, shows each conversation on the right record, and keeps campaigns, deliverables and invoices current. Sends email from your Gmail address only when you press send in crub: a reply you wrote, or a payment reminder you reviewed first. crub never sends email on its own. When you open a conversation in crub, or mark it unread, crub marks it the same way in Gmail. |
calendar.eventsView and edit events on your calendars | Optional. For calendar features in crub: showing your calls with a brand next to its campaign, and adding deliverable deadlines to your calendar. crub does not read or change your calendar until you use one of these features. |
drive.fileOnly the Google Drive files you use with crub | Optional. Opens only the files you choose from your Drive in crub, for example a contract or media kit to attach to an email or a campaign. crub cannot see any other file in your Drive. |
What crub does not do with Gmail:
- It does not store newsletters, promotions, social and update notifications, forum mail, spam, trash, drafts or other automated mail. These are recognised and skipped.
- It does not store email from domains or addresses you block in Settings.
- It never deletes your email. The only change it makes in Gmail is marking messages read or unread, when you read or mark them in crub.
- It does not access any other Google service, apart from Calendar and Drive as described above.
Your forwarding address
Each crub account has a private address at in.crub.co. Email you forward or copy to it is stored and used the same way as email from Gmail. crub accepts it only from the addresses on your account; anything else is held until you confirm it. The raw message is deleted 30 days after crub has processed it.
Disconnecting
Disconnect Gmail in crub under Settings, Email sync. crub stops reading your mailbox immediately, revokes its access with Google, including Calendar and Drive, and deletes the email text, attachment details and AI results that came from Gmail. Your companies, people, campaigns and invoices stay. You can also remove crub's access at any time from your Google Account permissions page; to delete what crub stored, disconnect in crub or delete your account.
4. Google API Services User Data Policy
crub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice this means:
- crub uses Google user data only to provide and improve the features you can see and use in crub.
- crub does not sell Google user data, does not use it for advertising, and does not use it to decide creditworthiness or for lending.
- crub transfers Google user data to others only as needed to provide those features (for example to our database host, or to our AI provider for the AI features in section 5), for security, to comply with the law, or as part of a merger, acquisition or sale of assets after notifying you.
- No one at crub reads your email, unless you ask us to for a specific message (for example in a support request), it is needed to investigate abuse or a security incident, the law requires it, or the data has been aggregated and anonymised for internal operations.
- crub does not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models, and does not let any provider do so.
5. AI features
crub can summarise email conversations and suggest updates, such as a new campaign from an enquiry or an invoice marked paid when a brand confirms payment. These features are off until you switch them on, which crub asks you when you set up Gmail or your forwarding address. You can switch them off in Settings at any time.
- When they are on, the text of the relevant email conversations is sent to our AI provider, Anthropic, which returns the summary or suggestion to crub. Under its commercial terms Anthropic does not train its models on this data, and it deletes it from its systems within 30 days, except where it must keep it longer to enforce its usage policies or comply with the law.
- Every suggestion shows the email lines it came from and waits for you to accept, edit or dismiss it. Nothing it suggests changes in crub on its own.
- Email content is treated as information, never as instructions: the AI that reads it cannot take actions, and its results are checked before crub shows them to you.
- AI results are stored with links to the messages they came from and are deleted when those messages are deleted.
Company details
Company details with AI are on unless you switch them off in crub under Settings, Email sync. For each company website crub reads (see section 2), it sends the company's web address and the text of those public pages to Anthropic, which writes a one-line description, picks up to three categories and reads details the pages state, such as the founding year or the headquarters. Nothing from your email messages is sent. As with email, Anthropic does not train its models on this text and deletes it within 30 days.
- A detail the AI reads from a page is kept only if it quotes that page; otherwise crub drops it. Website text is treated as information, never as instructions, and the AI that reads it cannot take actions.
- crub fills in only details that are empty, shows where they came from and when ("From brand.com, updated 16 Oct"), and never changes a detail you edited. The legal details are only offered for your invoices; crub copies them into your billing details only when you choose to.
- If you switch it off, crub no longer sends company websites to Anthropic on your behalf and removes the descriptions and categories its AI wrote for your companies. You still see each company's logo and the facts its website states.
6. How we use data, and why
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the features you use: sign-in, records, reminders, email sync and sending | Performance of our contract with you |
| Reading and sending Gmail, the forwarding address, and AI features on email | Your consent, which you give when you connect or switch them on, and can withdraw at any time |
| Showing the logo and details of the companies in your account, read from their public websites, with descriptions and categories written by AI unless you switch that off | Performance of our contract with you |
| Keeping crub secure, preventing abuse and fixing errors | Our legitimate interest in a safe, working service |
| Service messages, such as security notices or changes to these terms | Performance of our contract and our legitimate interest |
| Keeping records the law requires | Legal obligation |
| Running the waitlist: confirming your email, inviting you when it's your turn, and learning who signs up and how they heard about crub | Your consent, which you give when you sign up, and can withdraw at any time |
Apart from the waitlist emails you sign up for (one to confirm your address and one when it's your turn), crub does not send marketing email, and it does not build advertising profiles.
7. Who processes data for us
We do not sell personal data. These providers process data on our behalf, under contracts that limit them to providing their service to us:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage for the crub app, and the waitlist | Frankfurt, Germany (EU) |
| Cloudflare | Hosting of crub.co and app.crub.co, DNS, security, and email routing for crub addresses | Global network |
| Google sign-in, the Gmail API, and the spreadsheet where we see waitlist sign-ups and whether each one is confirmed | Global | |
| Resend | Sends the email that confirms your waitlist sign-up | Ireland (EU) |
| Anthropic | Company descriptions, categories and details from public website text, unless you switch this off; AI summaries and suggestions on email, only if you switch them on | United States |
We may also disclose data where the law requires it, or to protect the rights, property or safety of our users or others. If crub is part of a merger, acquisition or sale of assets, we will tell you before your data is transferred, and you can delete your account first.
8. International transfers
crub's database is in the EU. Where a provider processes data outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses or another safeguard recognised under the GDPR, such as the EU-US Data Privacy Framework.
9. How long we keep data
- Account and work data: while your account is open. Deleted within 30 days of you deleting your account.
- Email from Gmail: while Gmail is connected, so the history on your records stays complete. Deleted within 30 days of disconnecting Gmail or deleting your account.
- Forwarded email: the raw message is deleted 30 days after processing; what crub filed from it stays until you delete it or your account.
- AI results: deleted with the messages they came from.
- Company websites: what crub read from a company's website and from Wikidata is kept while any crub account has that company, and read again about once a year (logos every six months). Once no account has the company, it is deleted within two days, logo included. The details on your own companies are deleted with your account.
- Waitlist: sign-ups that are never confirmed are deleted after 7 days, from crub and from our spreadsheet. Confirmed sign-ups are kept while the waitlist is open and deleted within 3 months of it closing, or sooner if you ask. The scrambled internet address is deleted after a day.
- Backups: removed in the normal backup cycle, typically within 90 days.
- Legal records: kept longer only where the law requires it.
10. Security
- All traffic to crub is encrypted with TLS, and data is encrypted at rest.
- Your Gmail access token is stored encrypted and can be read only by crub's server code, never by the app in your browser.
- Every record is tied to your account, and the database itself refuses access to any other account's records.
- Email text is kept in crub's database, where each account can read only its own email. Attachment files are not copied: crub fetches one from Gmail only when you open it, after checking it is yours.
- Files you upload are kept in private storage that only your account can read. The app opens them through short-lived links, never a public address.
- If a breach affects your personal data, we will tell you and the supervisory authority without undue delay, as the GDPR requires.
11. Your rights and choices
You can ask to access, correct, delete, restrict or export your personal data, object to processing based on our legitimate interests, and withdraw any consent you gave. Much of this you can do in crub itself: edit your details, disconnect Gmail, switch AI features off, or delete your account (see data deletion).
To leave the waitlist, email privacy@crub.co from the address you signed up with.
For a copy of your data or anything else, email privacy@crub.co from the address on your account. We answer within 30 days. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live.
12. Cookies and browser storage
crub.co sets no cookies. The crub app keeps your sign-in session in your browser's storage so you stay signed in. Cloudflare may set a strictly necessary security cookie to protect the service from abuse. crub uses no analytics, advertising or tracking cookies. If that ever changes, we will update this policy first and ask for your consent where the law requires it.
13. Children
crub is for people aged 18 or over. If we learn that we hold data about someone younger, we delete it.
14. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in crub before the change takes effect. The date at the top shows when it last changed.
15. Contact
Golden Locks, Lda.
Av. Miguel Bombarda 42, 6A, 1050-166 Lisboa, Portugal
NIPC 514264233
privacy@crub.co