Privacy Policy

Information We Collect

We collect the following categories of information:

• Account information you provide, such as your name, business name, email address, phone number, and login credentials.
• Contact and lead information you add to the platform, including names, phone numbers, email addresses, company details, and any custom fields your workspace defines.
• Message content and metadata for SMS/MMS, email, and the connected Facebook Messenger, Instagram, and WhatsApp channels that you send or receive through the Service.
• Call records and recordings, including the audio of calls placed through the Service, their duration, and their outcome.
• Calendar events and their attendees, where a calendar is connected.
• Files you upload, including note and email attachments and profile images.
• Business records you create, such as tasks, notes, invoices, products, and transactions.
• Data you import in bulk from a previous CRM, from a file, from a device address book, or through an inbound webhook.
• Payment information processed by our payment processor. We receive subscription status and billing metadata; we do not receive or store full card numbers.
• Usage and device information, such as log data, IP address, and browser type, collected automatically when you use the Service.

How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service.
• Send and deliver the messages you initiate to your leads and customers.
• Generate AI assistance, suggestions, and automated replies where you have enabled those features.
• Authenticate users, secure accounts, and prevent fraud or abuse.
• Process payments and administer subscriptions.
• Provide customer support and respond to your requests.
• Comply with legal obligations and enforce our terms.

We do not use the contact and lead information in your workspace for our own marketing, and we do not use it to train AI models.

SMS / Text Messaging

The Service enables our business customers to send SMS/MMS messages to the leads and customers who have consented to be contacted. We use a third-party messaging provider (Twilio) to deliver these messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and messaging consent are never sold, rented, or shared with any third party or affiliate for marketing or promotional purposes. We share information about your messaging activity only with the subcontractors and service providers who help us operate the Service (for example, our messaging provider, Twilio), solely to deliver the messages you have requested and never for their own or any other party’s marketing purposes.

You may opt out of receiving text messages at any time by replying STOP to any message. For help, reply HELP or contact us at support@tristanahumada.com. Message and data rates may apply, and message frequency varies.

Voice Calls and Recordings

Calls placed through the Service are recorded by default, on both sides of the conversation. Recordings and call metadata are stored with the contact’s record in the business’s workspace and are carried by our telephony provider.

The business placing the call is responsible for obtaining any consent its jurisdiction requires and for announcing the recording where the law requires it. If you are on a call with a business using the Service and do not wish to be recorded, tell them at the start of the call.

Email and Calendar Integrations

You may connect a Google or Microsoft mailbox and a Google Calendar. Where you do, the Service reads and writes messages and events in those accounts to log correspondence against contacts and to keep events in sync.

Crumbse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you connected it for; we do not transfer it except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized.

We do not use Google or Microsoft user data to train AI models. You may disconnect an integration at any time in the Service’s settings, and revoke our access from your Google or Microsoft account.

Messaging Channels (Messenger, Instagram, WhatsApp)

Where a business connects a Facebook Page, Instagram professional account, or WhatsApp Business number, we receive the messages sent to it, the sender’s platform-scoped identifier, and the display name the platform provides, so the conversation can be delivered to that business’s shared inbox. We use these only to deliver and log the conversation.

The platform’s own privacy policy governs what it collects about you independently of us.

AI Features and Automated Processing

Where AI features are enabled, we send the relevant workspace content — for example the contact record, the conversation, or the question asked — to third-party AI providers (OpenAI and Anthropic) so they can return a response. Under those providers’ API terms, content submitted this way is not used to train their models.

Where a workspace supplies its own AI provider key, that provider contracts directly with the workspace and that agreement governs the processing instead.

Automated replies. A business may enable an AI receptionist that answers inbound messages automatically, without a person reviewing each reply. If you are messaging a business using the Service, some replies you receive may be generated this way. You can ask to speak to a person at any time, and replying STOP to a text message stops it.

AI features do not make decisions that produce legal or similarly significant effects about you without human involvement.

Third-Party AI Connectors

A user may connect an outside AI client — for example Claude or ChatGPT — to their workspace. When they do, that client can read and change workspace data as that user, limited to their permissions and to the scopes they approved.

A connected AI client is not our subprocessor. The user chose it, and once data reaches it, that provider’s own privacy policy governs what happens to it. We do not control it and cannot retrieve or delete data it has received. Access is revocable at any time from the Service’s settings, which stops further access but does not undo what has already been shared.

Service Providers and Subprocessors

We use the following categories of provider to operate the Service. Each processes personal information only on our instructions and under confidentiality obligations.

• Telephony and messaging (Twilio) — SMS/MMS delivery, voice calls, and call recording storage.
• Transactional email (Resend) — system email such as invitations and verification.
• Database, storage, and hosting (Supabase, Amazon Web Services) — storage of workspace data and uploaded files.
• Payments (Stripe) — subscription billing and payment processing.
• AI providers (OpenAI, Anthropic) — AI assistance, automated replies, and speech features.
• Platform integrations (Google, Microsoft, Meta) — mailbox, calendar, and messaging-channel connections you authorize.

The providers named above are our current subprocessors. Where we add or replace a subprocessor that processes personal information, we will give business customers at least 30 days’ notice by email to workspace administrators before the change takes effect, so that there is an opportunity to object. A Data Processing Addendum is available to business customers on request at support@tristanahumada.com.

How We Share Information

We do not sell your personal information. We share information only as described in this policy: with the service providers above, with a third-party AI client a user has connected, when required by law or legal process, or to protect the rights, safety, and security of our users and the public. In the event of a merger or acquisition, information may be transferred as part of that transaction.

Do Not Sell or Share

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We have not done so in the preceding twelve months.

Data Retention

We retain personal information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.

Some records are aged out on a schedule: inbound webhook payloads are emptied after a retention window and the log entry deleted later, while the workspace records they created are kept. Deleting a record in the Service is usually a soft delete that hides it and makes it restorable for a period before it is removed.

The periods we commit to are:

• Call recordings are deleted 24 months after the call.
• Message content and workspace records are retained for the life of the workspace.
• A record you delete in the Service is restorable for 30 days, then permanently removed.
• A terminated workspace remains available for export for 30 days, after which its data is permanently deleted.
• Encrypted backups rotate on their own schedule and are fully overwritten within 35 days, so deleted data may persist in a backup for up to that long.

International Data Transfers

We and our providers may process information in countries other than the one you live in, including the United States, where data-protection laws may differ.

Where personal information is transferred out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum for United Kingdom data, in our agreements with the providers named above.

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR. If we appoint one, we will name them here.

Security

We use reasonable administrative, technical, and organizational measures to protect information against unauthorized access, loss, or misuse. Access to workspace data is restricted by account and by role, credentials and integration tokens are stored hashed or encrypted, and traffic is encrypted in transit.

Uploaded files — note and email attachments and profile images — are served from object storage at long, unguessable URLs rather than behind a per-request permission check. Anyone who obtains such a URL can open the file, so treat those links as confidential and avoid uploading material that would be harmful if the link were forwarded.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach Notification

If we become aware of a breach affecting personal information, we will notify affected business customers without undue delay and provide the information they need to meet their own notification obligations, and will notify regulators and individuals where the law requires it.

Where we act as processor for a business customer, we will notify that customer within 72 hours of becoming aware of a breach affecting personal information, by email to the workspace administrators on the account.

Your Choices and Rights

Depending on where you live, you may have the right to know what personal information we hold about you, to access a copy of it, to correct it, to delete it, to limit or object to certain processing, to withdraw a consent you gave, and not to be discriminated against for exercising these rights.

To exercise a right, contact us at support@tristanahumada.com. We will verify your request before acting on it, and we will respond within the time the applicable law allows. If we decline a request, you may ask us to reconsider by replying to our response. You may also opt out of text messages at any time as described above.

If your information is in a business customer’s workspace, that business controls it and we will pass your request to them. An authorized agent may make a request on your behalf with proof of authorization.

Children’s Privacy

The Service is not directed to children under 13 (or the age required by applicable law), and we do not knowingly collect personal information from them.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.

Contact Us

If you have questions about this Privacy Policy, contact us at support@tristanahumada.com.