Privacy Policy

[Crewaid legal entity] is the controller of the personal data described here. For your content (what you and your bots put into Crewaid), we act on your instructions: you decide what goes in, and we process it to run the service for you. Write to us at [privacy email] about anything on this page.

• Account. Your name, email address and profile picture from the sign-in you choose (Google, GitHub or an emailed link), and your team if you have one.
• Your content. Messages with your bots, files you share and files bots produce, what a bot’s screen shows while it works, recordings you make to teach it, skills, memories, routines and tasks.
• Connections. Model keys you bring and tokens for the apps you connect as plugins. These are stored encrypted and are never shown back in full.
• Usage and billing. How much computer time and model usage each bot consumes, your plan, and payment records. Card details are held by our payment processor, Stripe, not by us.
• Technical data. App version, device type, IP address and error logs, kept to keep the service running and secure.

• To provide the service you asked for: running your bots, their computers and routines (performance of our contract with you).
• To bill you and to keep records the law requires (contract; legal obligation).
• To keep Crewaid secure, prevent abuse and fix problems (legitimate interests).
• To send you messages about your account and the service (contract; legitimate interests).

• We do not sell your personal data or your content.
• We do not use your content to train AI models.
• We do not use advertising or cross-site tracking cookies.
• We do not read your content except when you ask us to, or when the law or a security incident requires it.

Messages, credentials and API keys are encrypted before they are stored, so the database holds ciphertext. Credentials are encrypted with AES-256-GCM, each one bound to its owner and connection, under keys that can be rotated. Keys are used on the server to make calls and are never placed on your crew’s computer.

More on how the service is built to protect your data is on the Security page.

You choose a region when you sign up, for example the European Union, and your content, files and backups are stored in that region. If a service we rely on processes data outside your region (a model provider, for instance), we use safeguards the law recognises, such as the EU Standard Contractual Clauses.

Only the providers we need to run Crewaid, each bound by contract to protect it:

• The model provider a bot uses (for example OpenRouter, OpenAI or Anthropic) receives the conversation and context needed to produce each reply. If you bring your own key, your agreement with that provider applies.
• The apps you connect as plugins receive what a bot sends them on your behalf.
• Infrastructure providers that host our servers, databases and backups in your chosen region.
• Our email provider, to send sign-in links and account messages.
• Stripe, our payment processor, to take payments and keep billing records.
• OpenRouter, which serves the models included with a plan. When a bot uses one, the conversation it needs for that reply is sent to OpenRouter and the model provider it routes to. Models on your own keys go only to the provider you chose.

We may also disclose data where the law requires it. Where we are allowed to, we will tell you first.

We keep your content for as long as your account is active. You can delete a message, clear a conversation or delete a bot at any time. When you close your account we delete your content within 30 days, and it leaves our backups on their normal rotation. Billing records are kept for as long as tax law requires.

Wherever you live, you can ask us to access, correct, export or delete your personal data, or to object to or restrict how we use it. You can also ask for an audit or a privacy report at any time: what we hold about you, where it is stored, and who can read it.

Write to [privacy email]. We answer within 30 days. If you are in the EU or UK, you can also complain to your data protection authority.

Crewaid is not for children. We do not knowingly collect data from anyone under 16.

When we change this policy in a way that matters, we will tell you before the change applies. The date at the top of this page shows when it last changed.