Privacy Policy

We collect information you provide directly, information we collect automatically when you use the Service, and information from third-party integrations you choose to connect.

Account and profile data

• Name, email address, company name, and profile photo
• Billing address, tax identification, and payment-method metadata (handled by our payment processor)
• Password (stored as a salted hash; never stored or transmitted in plain text)
• Communications preferences and notification settings

Service usage data

• Subscriber lists, segments, templates, and campaign content you create
• Delivery, open, click, and engagement metrics for messages you send
• Automation workflow definitions and execution history
• API requests and feature usage patterns within the dashboard

Device and log data

• IP address, browser type and version, operating system, and referring URL
• Pages visited, features used, and timestamps of your activity
• Crash reports and performance diagnostics from the client and server

We use the information we collect to operate the Service, process payments, provide support, and improve our products. We do not sell your personal information to third parties.

• To provide, maintain, and improve the Service and its features
• To process subscription payments and prevent fraudulent transactions
• To send transactional notifications about your account, billing, and the Service
• To respond to support requests and communicate with you about your account
• To detect, prevent, and address security incidents and abuse
• To analyze usage patterns and develop new features and products
• To comply with legal obligations and enforce our Terms of Service

We share information with subprocessors that help us operate the Service, with your consent for integrations you connect, and when required by law. A current list of subprocessors is maintained at our Subprocessors page.

• Subprocessors: cloud hosting, payment processing, transactional email, analytics, and customer support vendors — each bound by data-processing terms
• Integrations: when you connect a third-party integration, you authorize us to exchange data with that provider in accordance with your configuration
• Legal: when we believe in good faith that disclosure is necessary to comply with a law, regulation, court order, or valid legal process
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with appropriate confidentiality protections
• With your consent: for any other purpose disclosed at the time of collection

Crownvo is headquartered in [TODO: jurisdiction]. Your information may be transferred to, stored, and processed in countries other than your own. When we transfer personal data from the EEA, UK, or Switzerland to a country with different data-protection laws, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Enterprise customers can request data-residency options for primary storage. Contact sales for details.

We retain personal data for as long as your account is active or as needed to provide the Service. Specific retention periods include:

• Account and billing data: for the life of the account plus 7 years for tax and accounting records
• Subscriber lists, campaigns, and engagement data: for the life of the account, with the ability to delete individual records or entire lists at any time
• Server logs: typically 90 days, unless required for security investigations
• Backups: encrypted backups are retained for up to 35 days on a rolling basis

When you close your account, we delete or anonymize your personal data within 30 days, except where retention is required by law.

Subject to applicable law (including the GDPR and CCPA), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data (the right to be forgotten)
• Restrict or object to certain processing activities
• Receive a portable copy of your data in a machine-readable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at the address below. We respond to verified requests within 30 days.

We take the security of your data seriously. Crownvo implements administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and destruction.

For a detailed overview of our security practices, certifications, and infrastructure, see our Security page.

The Service is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe we have collected information from a child, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects when the policy was last revised.

If you have questions about this Privacy Policy or our data practices, contact us at privacy@crownvo.com or by mail at [TODO: mailing address].

Our Data Protection Officer can be reached at dpo@crownvo.com.