Privacy Policy

Last updated: August 19, 2026

This Privacy Policy describes how Cruxdata ("we," "our," or "us") collects, uses, and shares personal information when you use our platform at cruxdata-dashboard-production.up.railway.app, our marketing site, and any related services (collectively, the "Service").

1. Information We Collect

a. Information You Provide Directly

• Account information from operators / admin users: name, email, password (hashed via bcrypt-equivalent), preferences.
• Client business information that operators enter: business name, contact name, email, phone, address, website URL, industry, and any notes.
• Onboarding form submissions: when a prospect completes a form at /onboard/<token>, we collect the fields the form asks for (business info, contact, marketing goals, platform IDs, and any consent choices).
• Content you upload: images, HTML files, documents you attach to campaigns or client records.
• Client message content: messages exchanged between the agency and its clients through the client portal.

b. Information We Collect From Connected Accounts

When an operator connects a third-party account to a client record, we retrieve and store information from that provider:

• Google (Ads, Analytics 4, Search Console, Drive, Business Profile, Calendar, Gmail): ad performance metrics, session and traffic data, search performance, calendar events, and email content when you authorize the Gmail scope.
• Meta (Facebook / Instagram): ad performance data, ad account structure, Page details, and Ad Library data for competitor tracking.
• GoHighLevel: form submissions, contacts, opportunities, pipeline stages, and calendar bookings from a connected sub-account.
• HubSpot: contacts and deals synced via a private-app token.
• Stripe: subscription and payment metadata (we never receive or store raw card numbers — that data lives with Stripe).

c. Information We Collect Automatically

• Log data: IP address, browser, user agent, referring URL, timestamps.
• Cookies: a session cookie for admin authentication; a preference cookie for cookie-consent choices. We do not use third-party advertising cookies on the Cruxdata Service itself.
• Usage data: which features are used, error events, request timings.

2. How We Use Your Information

• To operate and provide the Service, including all dashboards, reports, campaign management, optimization, and client portal features.
• To generate content, reports, ad copy, blog drafts, email personalizations, and other outputs using artificial intelligence (see Section 4).
• To send transactional emails (monthly reports, notifications, welcome emails) and, where authorized, marketing emails.
• To debug, secure, and improve the Service.
• To comply with legal obligations.

3. Third Parties We Share Data With

We use the following processors and share the minimum data necessary for each. Each vendor is bound by their own privacy commitments; where practical we require a Data Processing Agreement (DPA).

• Anthropic, PBC — we send data to Anthropic's Claude API to generate reports, ad copy, brand voice profiles, review responses, blog drafts, cold-email personalization, competitor summaries, root-cause diagnostics, quarterly business reviews, and other AI-generated content. This may include client business data, ad performance metrics, opportunity data, review text, and lead attributes.
• Google LLC — Google Ads, Analytics, Search Console, Drive, Gmail, Business Profile, and Calendar APIs for the corresponding integrations.
• Meta Platforms, Inc. — Meta Marketing / Business / Ad Library APIs for the corresponding integrations.
• HighLevel Inc. (GoHighLevel) — CRM sync, form submissions, opportunities, and calendar for connected sub-accounts.
• HubSpot, Inc. — contacts and deals sync when a HubSpot integration is connected.
• Resend — transactional and outbound email delivery.
• Stripe, Inc. — payment processing and subscription management.
• Railway Corp. — application hosting and infrastructure.
• Slack Technologies, LLC — only when a client provides an incoming-webhook URL to receive weekly digests; the payload is delivered to that webhook.

We do not sell personal information. We do not share personal information with advertisers for cross-context behavioral advertising.

4. Our Use of Artificial Intelligence

Cruxdata uses AI extensively. Substantially all content generation, analysis, and diagnostic features in the Service call large language models operated by Anthropic (Claude). This includes, but is not limited to: monthly report summaries, ad strategy proposals, ad copy edits, review response drafts, brand voice extraction, competitor ad summaries, blog briefs and drafts, cold-email personalization, root-cause diagnostics, quarterly business reviews, and website / landing page generation.

When you use these features, the input data (which may include client business information, ad metrics, contact attributes, review text, and website content) is transmitted to Anthropic for processing. Anthropic's privacy policy and commercial terms govern their handling of that data.

AI-generated content may be inaccurate or unrepresentative. All AI outputs in the Service are reviewable and editable by a human operator before publication or sending.

5. Data Retention

We retain personal information for as long as necessary to provide the Service and comply with legal obligations. When a client record is deleted from Cruxdata, related data (submissions, opportunities, reports, uploaded files, cached reviews, campaign drafts, etc.) is deleted from our active database on a cascading basis. Backups may retain data for up to 30 days.

6. Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that inaccurate information be corrected.
• Deletion — request that we delete your personal information. Submit a request at /legal/data-request or by emailing preston@cruxdata.io.
• Portability — request that we export your personal information in a machine-readable format.
• Opt-out of sale / sharing — we do not sell personal information, but you may confirm this in writing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at preston@cruxdata.io. We will respond within 30 days.

a. California Residents (CCPA / CPRA)

California residents have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. You may request to know, delete, correct, and opt-out of the sale or sharing of your personal information. We do not sell personal information. We do not knowingly process the personal information of consumers under 16.

b. EU / UK Residents (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, our lawful bases for processing include: (i) performance of a contract; (ii) legitimate interests in operating and improving the Service; (iii) your consent for marketing communications; and (iv) compliance with legal obligations. You have the right to lodge a complaint with a data protection authority.

7. Security

We use industry-standard security measures including HTTPS/TLS in transit, hashed authentication credentials, unique unguessable tokens for public URLs (onboarding invites, portal links, website previews), and access controls on the admin interface. No system is 100% secure — if a breach occurs that affects your personal information, we will notify you and applicable regulators as required by law.

8. Marketing Emails and Opt-Out

Marketing and cold-outbound emails sent through the Service include an unsubscribe link. Clicking that link immediately suppresses your email address and prevents further outbound emails to you from that campaign or any future campaign. You may also email preston@cruxdata.io to be added to the global suppression list.

9. Children

Cruxdata is not directed to children under the age of 16 and we do not knowingly collect personal information from children.

10. International Transfers

The Service is hosted in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other jurisdictions where our processors operate.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be posted here with an updated "Last updated" date.

12. Contact

Cruxdata
Email: preston@cruxdata.io