Privacy Policy

1. Who We Are

theKrew.ai ("theKrew," "we," "us," or "our") is an AI-powered sales and marketing platform operated by Tuple Technologies. Our website is https://thekrew.ai and our app is https://app.thekrew.ai. For privacy-related questions, contact hello@thekrew.ai.

2. What Data We Collect

Information you provide directly:

• Account info — name, email, company name, role.
• Business profile — ICP description, brand voice, industry, target geography, services and offers.
• Uploaded files — brand documents, logos, product imagery, customer case-study material.
• Campaign data — recipient lists, message templates, send schedules, replies, opens, clicks, bounces.
• Payment data — collected and processed by Stripe. We do not store card numbers; we receive only a tokenized reference and the last four digits for display.

Information collected automatically:

• Usage data — features you use, when, from what device and browser.
• IP address and approximate location (city/region) derived from IP.
• Pages visited, time spent, referring URL, UTM parameters.
• Cookies and similar storage (see Section 7).

3. How We Use It

• Operate the Services — run AI agents, send campaigns, generate landing pages, deliver reports.
• Improve the Services — anonymized usage analytics. We do not train AI models on your private content (your prospect lists, your business documents, your campaigns) without explicit opt-in.
• Communicate with you — transactional notifications, service updates, security alerts, billing, and support replies.
• Comply with law — respond to subpoenas, prevent fraud, conduct audits, protect against abuse.

4. Subprocessors

We share data with the following subprocessors solely to deliver the Services. Each subprocessor is bound by a Data Processing Agreement (DPA) or equivalent contractual safeguards. We update this list when we add or change subprocessors.

For Tier-1 providers (Stripe, Clerk, Vercel, Supabase, Anthropic, OpenAI, Google), the standard DPA published on each provider's website applies. We will provide a copy of any DPA on request.

5. How We Share Your Information

We do not sell your personal information. We share data only with:

• Subprocessors listed above, under DPA terms, only as necessary to deliver the Services.
• Advertising platforms — when you authorize us to manage paid campaigns, we share necessary data with Meta (Facebook/Instagram), Google Ads, LinkedIn, X, or TikTok via your own ad accounts using OAuth-delegated access. Your pixels, audiences, and conversion data remain in your ad accounts.
• Law enforcement and regulators — when required by valid subpoena, court order, or other legal process, or to investigate fraud or abuse.
• Successors — in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to this Privacy Policy or a more protective successor policy.

6. How Long We Keep It

• Active accounts — retained while your account is active.
• Closed accounts — deleted within 30 days of closure, except where retention is required by law (for example, financial records under tax law).
• Backups — retained for up to 90 days, then permanently overwritten.
• Transactional logs at subprocessors (Stripe, EmailJS, etc.) follow each provider's policy — typically up to 7 years for tax and audit compliance.
• Aggregated, anonymized analytics may be retained indefinitely.

7. Cookies

We use a small number of cookies and similar technologies. Essential cookies (session, authentication, CSRF) do not require consent because they are strictly necessary to operate the Services. Non-essential cookies (Google Analytics 4, Google Ads, Ahrefs Analytics) load only after you accept them in our cookie banner. We use Google Consent Mode v2 — until you accept, no persistent analytics or advertising cookies are set.

Manage cookie preferences

8. Data Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 at our hosting providers). Authentication is handled by Clerk. Access to production systems is restricted to designated personnel and logged. We do not share your leads, content, or business information with other customers. We follow industry-standard security practices but no system is perfectly secure; report any suspected vulnerability to hello@thekrew.ai.

9. Your Rights (GDPR & CCPA)

If you are in the EU, UK, or California, you have the following rights with respect to your personal data:

• Access — receive a copy of the personal data we hold about you. We will respond within 30 days.
• Rectification — correct inaccurate data. You can edit your profile in the app or email us.
• Erasure (right to be forgotten) — delete your account from Settings → Account, or email us. Subject to legal retention requirements (Section 6).
• Portability — export your data in a machine-readable JSON format on request.
• Object / restrict — object to certain processing or request restriction by emailing us.
• Withdraw consent — for processing based on consent (e.g., non-essential cookies), withdraw at any time via our cookie banner.
• Non-discrimination (CCPA) — we will not deny service, charge a different price, or provide a different level of service if you exercise these rights.
• Lodge a complaint — EU/UK residents may complain to a national supervisory authority; California residents may complain to the California Privacy Protection Agency.

To exercise any of these rights, email hello@thekrew.ai. We may verify your identity before responding.

10. International Data Transfers

theKrew.ai is operated from the United States and currently serves customers in the United States and Canada. If you access the Services from the EU, UK, or another region, your data may be transferred to and processed in the United States or other countries where our subprocessors operate. Where required, we rely on Standard Contractual Clauses (SCCs) or other recognized transfer mechanisms to safeguard your data.

11. Children's Privacy

The Services are not directed to individuals under 18, and we do not knowingly collect personal data from children. If we learn we have collected data from a child, we delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we update the "Effective date" at the top of this page and notify you by email and in-dashboard banner at least 14 days before the new version takes effect.

13. Contact Us

theKrew (a product of Tuple Technologies)

Privacy questions: hello@thekrew.ai

Mailing address: Demarest, 1337-9 Lincoln Ave, Holbrook, NY 11741, USA

Website: https://thekrew.ai

Last updated: April 29, 2026