Last Updated: February 12, 2025
Cruva LLC (“Cruva”, “we”, “us”, or “our”) operates cruva.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. This policy applies to all users of our Service, including individual users, business accounts, and enterprise clients.
For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and the California Consumer Privacy Act (“CCPA”):
Cruva as Data Controller: We act as the data controller for personal data we collect directly from you for the purposes of account management, billing, communications, and improving our Service.
Cruva as Data Processor: When you use our Service to manage affiliate marketing campaigns, creator relationships, or other business activities, we act as a data processor on your behalf. In this capacity, we process data only according to your instructions and the terms of our Data Processing Agreement (DPA), which is available upon request and incorporated by reference into our Terms of Service for enterprise clients.
We collect personally identifiable information such as your name, email address, company name, billing address, and contact details when you register for our services, subscribe to a plan, or communicate with us.
We automatically collect information about your interactions with our services, including your IP address, browser type, operating system, device information, pages viewed, features used, and the dates/times of your visits. We use this data to improve the Service and diagnose technical issues.
When you use the Service, you may upload or generate business data including creator lists, campaign configurations, affiliate performance metrics, sales data, and outreach content. This data is processed solely to provide the Service and remains your property as described in our Terms of Service.
We use cookies and similar tracking technologies to maintain your session, remember your preferences, and analyze usage patterns. We use the following categories of cookies:
You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.
When you connect a Google account for our email campaign services, we collect only the necessary credentials – such as the app token and refresh token – required to send, manage, and track your outgoing emails. This data is collected solely to facilitate your email campaigns and is not used for any other purpose.
We process your information on the following legal bases and for the following purposes:
We use your Google OAuth data solely for sending and managing outgoing emails on your behalf and will not use it for any other purposes.
We do not sell your personal data. We may share your information only in the following circumstances:
We use the following categories of sub-processors to deliver the Service. All sub-processors are reviewed for security and compliance before integration and are contractually obligated to protect your data:
A complete, up-to-date list of sub-processors is available upon request. Enterprise clients under a Data Processing Agreement will be notified of any changes to our sub-processor list at least thirty (30) days before a new sub-processor begins processing data, providing an opportunity to object.
Cruva is based in the United States, and your data may be transferred to, stored, and processed in the United States or other countries where our service providers maintain facilities. These countries may have data protection laws that differ from those in your jurisdiction.
For transfers of personal data from the European Economic Area (EEA) or the United Kingdom to the United States, we rely on appropriate safeguards, including the EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK International Data Transfer Agreement or Addendum, as applicable. Copies of these safeguards are available upon request.
We are committed to ensuring that your data is handled securely and in compliance with relevant data protection laws. Our security measures include:
In the event of a confirmed data breach affecting your personal information, we will notify affected users without undue delay and within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR Article 33 and applicable UK GDPR requirements. Notification will include: (a) the nature of the breach; (b) the categories and approximate number of data subjects affected; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach and mitigate its effects. Where required, we will also notify the relevant supervisory authority within the same timeframe.
Depending on your location, you may have the following rights regarding your personal data. We will respond to all legitimate requests within thirty (30) days (or the applicable statutory period):
Additional Rights for California Residents (CCPA): California residents have the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise any of these rights, contact us at info@cruva.com.
Additional Rights for UK & EEA Residents: If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local supervisory authority. For UK residents, this is the Information Commissioner’s Office (ICO) at ico.org.uk.
We retain your personal information only as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Specific retention periods include:
Upon request, we will securely delete or anonymize your personal data within thirty (30) days, subject to any legal obligations to retain it. For enterprise clients, data export and deletion procedures may be specified in the applicable Data Processing Agreement.
For enterprise clients and any users who require a formal Data Processing Agreement (DPA) to comply with GDPR, UK GDPR, or other applicable data protection regulations, Cruva offers a DPA that covers: the scope and purpose of data processing, the categories of data processed, sub-processor management and notification, data subject rights assistance, audit rights, data breach notification procedures, cross-border transfer mechanisms, and data return and deletion upon termination. To request a copy of our DPA, please contact us at info@cruva.com.
We may update this Privacy Policy from time to time. For material changes, we will notify you by posting a prominent notice on our website or by sending an email to the address associated with your account at least thirty (30) days before the changes take effect. The “Last Updated” date at the top of this page indicates when this policy was most recently revised. We encourage you to review this Privacy Policy periodically.
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or need to request a Data Processing Agreement, please contact us at:
Cruva LLC
Email: info@cruva.com
For data protection inquiries specifically, you may also reach our data protection contact at privacy@cruva.com.