Privacy Policy
Last updated: July 26, 2026
Crewio is operated by CherryIT, registered in Serbia. This policy explains what we process, why, where it lives and what your rights are. The short version: your workspace data is yours, it lives in the EU, we don't run ads or analytics trackers, and deleting your workspace deletes its data immediately.
Two roles
For your account data (name, email, billing state) we are the data controller. For the content of your workspace, including conversations mirrored from Telegram, we act as a processor on behalf of the workspace owner: you decide what the mirror sees and why, we store and process it to provide the service.
What we process
- Account data: name, email, password hash or Google sign-in identity.
- Workspace content: companies, contacts, deals, notes, comments, custom fields, files you upload.
- Telegram mirror data: for the chats you choose to include, we store messages, media and chat metadata, plus the encrypted session that keeps the mirror connected. Chats you exclude are not stored. Conversations include messages written by your contacts; you are responsible for having a lawful basis to bring those conversations into your CRM.
- Google Calendar: if you connect it, we store the OAuth token and sync event data both ways. We request only the calendar events scope, use the data solely to provide calendar sync inside your workspace, and never use it for advertising. Crewio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google Calendar at any time, which deletes the stored token.
- AI features: when you use the assistant or MCP, the relevant workspace context is sent to our AI model provider to generate the response. It is not used to train models.
- Billing: handled by Paddle as merchant of record. Card details never touch our servers.
- Technical data: server logs and error reports needed to keep the service running. No advertising trackers, no analytics cookies on this site.
Why we process it
To provide the service you signed up for (contract), to keep it secure and debug failures (legitimate interest), and to meet legal obligations. We do not sell personal data and we do not use workspace content for advertising.
Where it lives
Production servers and object storage run at Hetzner in Falkenstein, Germany (EU). Some subprocessors below operate outside the EU; where that is the case, transfers rely on standard contractual clauses or an equivalent mechanism.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online | Hosting and object storage | Germany (EU) |
| Paddle | Payments, invoicing, tax (merchant of record) | UK / EU |
| Optional sign-in and Calendar sync | EU / US | |
| OpenAI | AI assistant and MCP responses | US |
| Bugsnag (SmartBear) | Error monitoring | US |
Retention and deletion
Workspace content is kept for as long as the workspace exists. Deleting the workspace deletes its content immediately, including mirrored Telegram data; residual copies in encrypted backups expire on a rolling basis shortly after. We keep the minimum account and billing records the law requires us to keep.
Your rights
You can access, correct, export or delete your personal data, object to processing, and complain to a supervisory authority. For anything you cannot do from the app, email hello@crewio.xyz and we will respond within 30 days. If your data appears in someone else's workspace (for example, you messaged a company that uses Crewio), we will route your request to that workspace owner, as the law expects.
Changes
If this policy changes in a way that matters, we will announce it in the app or by email before it takes effect.
Contact
CherryIT, Serbia · hello@crewio.xyz