Privacy notice

1. Scope and responsibility

This notice covers Cruuz’s website, account administration, business research, and support, and explains customer-directed processing. “We” refers to Cruuz’s legal operator, Unfaro.

For account administration and website inquiries, the operator determines the processing purposes. For a customer’s uploaded documents or connected mailbox, the customer may be the controller and Cruuz its processor. Responsibility for sourced prospects must be assessed per workflow. This notice does not replace a required data processing agreement.

2. Information you provide

• Account details: name, work email, organization, membership, role, authentication records, and preferences.
• Business materials: website details, briefs, targeting criteria, case studies, and uploaded documents.
• Communications: demo requests, support messages, drafts, and information supplied through connected accounts.
• Billing: plan, billing status, subscription/payment references, and invoice information. Payments are handled by a PCI-compliant payment processor whose privacy terms also apply at checkout. We do not store full card or bank details.

The contact form collects your name, work email, company name, and optional business type and message. It sends the inquiry to our team using an email-delivery service. Required details allow us to respond; optional fields are your choice.

3. Information from other sources

Research can include company websites, news, public professional information, and search/enrichment providers. Records may include names, business contact details, titles, employers, source links, buying signals, and inferred relevance or communication profiles. They may concern people who have never opened a Cruuz account.

Public availability does not remove privacy rights. Contact us about inaccurate information or an objection to its use. Requests concerning a specific customer’s outreach may also need to be handled by that customer.

4. Technical information and browser storage

Requests can produce IP addresses, browser/device information, timestamps, request logs, and security/error records. The contact endpoint uses IP-based rate limiting to reduce abuse. The app uses browser storage for sign-in state and interface preferences.

The website serves fonts locally and uses no advertising pixels. The app may use product-analytics and support tools to understand feature usage and answer requests; where the law requires it, we ask for consent before enabling them.

5. Purposes and lawful bases

Information is processed to create and secure accounts, deliver requested research and drafts, operate connected workflows, manage billing, respond to inquiries, investigate errors and abuse, and meet legal obligations. AI-derived profiles and scores help prioritize and personalize outreach; they are not verified facts about a person.

Where applicable law requires a lawful basis, account services rely on our contract with you, security and research rely on our assessed legitimate interests, optional processing relies on consent, and recordkeeping relies on legal obligation.

6. AI processing

Relevant portions of submitted material and prospect context are sent to AI services to generate briefs, classifications, scores, profiles, and drafts. Requests are routed through an AI gateway to selected model providers under their business terms. Operational traces may record processing used to diagnose runs.

Do not submit sensitive information the workflow does not need. Check output before use; automated inferences can be wrong.

7. Connected mailboxes

A connected account grants the permissions disclosed in its authorization flow. Depending on the feature, processing can involve identifiers, contact/message metadata, email content, sending, and reply handling. Connected-account functions are provided through a third-party integration provider.

Disconnect an account and revoke provider authorization when appropriate. Disconnection does not necessarily remove stored drafts, messages, or records; request deletion separately. The authorization screen lists the exact permissions before you connect.

8. Recipients and providers

Information may be disclosed to authorized workspace users; infrastructure, storage, AI, enrichment, integration, payment, email, and support providers needed for the feature; professional advisers where necessary; authorities where legally required; and a successor in a business transaction subject to applicable protections. A current list of service providers is available on request.

9. International processing

Providers may process information outside your country, including in the United States and India. Where the law requires it, we rely on recognized transfer safeguards; contact us for details.

10. Retention and deletion

We keep information only as long as needed for the stated purpose, customer instructions, security, disputes, and applicable recordkeeping requirements. Subscription cancellation does not automatically delete all data, and mailbox disconnection is separate from deleting stored records. When honoring an objection, we may keep a minimal suppression record so the person is not re-imported.

11. Rights and requests

Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of information; restrict or object to processing; withdraw consent; opt out of certain disclosures or profiling; and complain to a regulator. Withdrawing consent does not undo prior lawful processing.

Send requests to [email protected] with “Cruuz privacy request” in the subject. No Cruuz account is needed. Include context to locate the information, but do not send passwords or identity documents unless a secure, proportionate verification process is arranged.

Any necessary verification will be proportionate. Customer-controlled information may require coordination with that customer. We will explain a lawful reason preventing fulfillment and any applicable appeal route. You may also complain to your competent privacy regulator.

12. Security and children

We use access controls, encryption in transit, and provider oversight appropriate to the information we hold. No service can guarantee absolute security. Report suspected unauthorized access or a data incident to the operator without including credentials. Cruuz is for adult business users and is not directed at children. Customers must not collect or profile children’s information using the service; notify us if it has been submitted.

13. Changes and contact

Updated notices will be dated and additional notice provided where required. Material changes in purpose need the appropriate assessment, notice, and any necessary consent before they are applied.

Privacy contact: [email protected].