Privacy policy

This Privacy Policy describes how CRAIM ("we", "us") collects, uses, and shares information when you use our websites, applications, and related services (the "Services").

By using the Services, you agree to this policy. If you do not agree, do not use the Services.

Account and profile data: name, work email, company name, role, and authentication identifiers you provide when you register or are invited to a workspace.

Service data: deals, contacts, messages, files, and configuration you upload or generate while using CRAIM, including content processed to provide CRM and AI features.

Technical data: device and browser type, IP address, approximate location derived from IP, timestamps, and diagnostic logs needed to operate and secure the Services.

Communications: messages you send to support, sales, or security teams, including metadata needed to respond.

Payment data: when you purchase paid plans, our payment processor handles card details; we receive limited billing status and receipt information.

Our own cookies: craim_consent remembers your answer to the cookie banner for 180 days; craim_attr records which campaign, search, or link brought you to our marketing site, keeping the first and the last visit for 90 days so that we can tell which advertising actually works.

Measurement providers: Google Analytics 4 and Yandex Metrica measure traffic and behaviour on our public marketing site. They are not loaded inside the signed-in application, where your workspace data lives. What you type into the knowledge base search box is sent to them as a search term, so that we can see which documentation is missing; the contents of other fields are not.

Session recording: Yandex Metrica records interactions with marketing pages, such as mouse movement, clicks, and scrolling, so that we can see where a page confuses people. What you type into the sign-up, sign-in, and password reset fields is replaced with asterisks in your browser before anything is sent, and password fields are never recorded at all.

Consent: nothing beyond strictly necessary cookies runs until you accept it. Google's tags start with advertising and analytics storage denied; Yandex Metrica and any advertising pixel are not loaded until you accept.

You can withdraw consent at any time by deleting the craim_consent cookie, and you can block or delete cookies in your browser settings.

Provide and improve the Services, including AI features that summarize threads, suggest next steps, and draft messages according to your workspace settings.

Operate security monitoring, abuse prevention, and fraud detection.

Send transactional notices, product updates (where permitted), and respond to requests.

Meet legal obligations and enforce our Terms.

Analyze aggregated or de-identified usage to understand feature adoption; we do not sell personal data as traditionally defined in U.S. state privacy laws.

Certain features send prompts and relevant context to third-party AI model providers that process them on our behalf. We configure retention and logging consistent with your plan and agreements.

You control what data is indexed for retrieval-style features and which actions require human approval before customer-facing delivery.

This section applies when a member of a CRAIM workspace connects a Gmail mailbox or a Google Calendar by signing in with Google. CRAIM asks only for the access each feature needs, and the person connecting sees it on Google's consent screen before granting it.

Gmail, read access (gmail.readonly): CRAIM reads the messages that arrive in the Inbox of the connected mailbox after it is connected: sender, recipients, subject, text and attachments. They appear in CRAIM as the conversation with that client, so the team and the workspace's AI employees can answer it. CRAIM does not read messages that arrived before the mailbox was connected or messages outside the Inbox.

Gmail, sending (gmail.send): CRAIM sends the emails that the user, or an AI employee acting under the workspace's settings, writes to a client from the connected address: replies in the client's thread, first messages and commercial offers with their attachments. In the default settings an AI employee's email waits for a person's approval before it is sent. For a store connected through the CRAIM app for Shopify, CRAIM also sends from the connected mailbox a one-time code to the email address on an order, to confirm that the person asking about the order owns it.

Google Calendar (calendar.events, calendar.events.freebusy, calendar.calendarlist.readonly): CRAIM lists the user's calendars so they can choose the one CRAIM uses; reads the events of that calendar and shows them in the CRAIM calendar of the projects the user chooses; adds, changes and cancels the meetings created in CRAIM in that calendar, and Google sends invitations to the guests the user adds; and checks when the user is busy so that clients are offered only free times.

How we use it: only to provide these features to the user who connected their account and to their workspace. We do not sell Google user data, do not use it for advertising, and do not use it to develop, improve or train generalized artificial intelligence or machine learning models. People at CRAIM do not read it, except with the user's permission, when it is needed for security or to investigate abuse, or when the law requires it.

AI processing: when an AI employee answers a client or prepares a draft, the content of the conversation and the relevant context are sent to AI model providers that process them on our behalf to produce that answer. They are not permitted to use this data to train their models.

Storage and security: access tokens are stored encrypted. Messages and meetings are stored as part of the workspace's conversation history and calendar and are visible to its members according to their roles.

Disconnecting and deletion: disconnecting a mailbox or a calendar in CRAIM revokes CRAIM's access at Google and deletes the stored tokens; access can also be revoked at any time on the Google Account permissions page. Messages and meetings already in CRAIM remain part of the workspace's history until the workspace owner deletes them or closes the workspace, or until we delete them on request.

CRAIM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To ask us to delete Google user data or for any question about it, write to support@craim.ltd.

This section applies when a merchant installs the CRAIM app from the Shopify App Store and connects a store to a CRAIM workspace. The merchant decides how their customers' data is used; CRAIM processes it on the merchant's behalf to provide the app.

What we access: the app has read-only access to orders and reads them only when a customer asks about an order in a channel the merchant connected, such as Gmail, WhatsApp or Telegram. For the matching orders it reads the order number and dates, the email address and phone number on the order, payment and fulfillment status, cancellation and refunds, the order total, item names, quantities and SKUs, shipment status with carrier and tracking number, the order status page link, and the shipping address lines without the recipient's name. We also store the store's domain and an encrypted access token. The app cannot change orders, issue refunds or charge customers.

How we use it: only to answer that customer's question. We confirm that the person asking owns the order, by matching the email address or WhatsApp number they write from with the one on the order or by sending a one-time code to the email address on the order; prepare a reply with the order's status; and show the merchant the question and the reply in the Shopify admin. We do not sell this data or use it for advertising.

AI processing: to prepare a reply, the customer's question and the relevant order details are sent to third-party AI model providers that process them on our behalf. They may process data outside the customer's country, including outside the European Economic Area.

Retention: order details the app reads are kept in the record of the AI run that answered the question, and the text and order details in those records are removed after a limited retention period. Verification codes expire after 10 minutes. Messages customers send in the merchant's channels remain part of the merchant's conversation history in CRAIM until the merchant deletes them or closes the workspace.

Privacy requests: we act on Shopify's privacy webhooks. When Shopify asks us to erase a customer's data, we remove the order details about that customer from AI run records. When a store uninstalls the app, Shopify asks us 48 hours later to erase the store's data, and we remove its order details from AI run records and delete the store connection. If the store has installed the app again by then, its new connection stays and nothing is erased; we only record the request. Requests for a copy of a customer's data are recorded so we can provide it to the merchant.

Merchants and their customers can reach us at support@craim.ltd.

This section applies when a member of a CRAIM workspace connects an AI app, such as Claude, Claude Code, ChatGPT, Codex or Cursor, to CRAIM through the Model Context Protocol (MCP).

How it is connected: the person signs in to CRAIM, sees which app asks for access and chooses the projects it may work in. The app then acts as that person: it sees and changes only what the person's role in each chosen project allows.

What the app can do: find and read clients, deals, tasks and notes; read business reports, the calendar, the catalog, the company's AI profile and knowledge, AI employees' instructions and what waits for approval, automation rules and their runs, and marketing campaigns; create and update clients, deals, tasks and notes; create automation rules, which are saved switched off; give CRAIM's AI company materials and try how an AI employee answers. Trying an AI employee, reading materials and checking knowledge spend the project's AI balance.

What the app cannot do: read conversations with clients or messages sent to them, send anything to clients, delete data, hire AI employees, or switch AI employees or automation rules on or off. These stay with people in CRAIM.

Where the data goes: what CRAIM returns to the app is processed by the app's provider (for example Anthropic, OpenAI or Anysphere) under the person's own agreement with that provider and its privacy policy. CRAIM does not control how the provider processes or keeps it.

What we keep: the connection itself (which app, which projects, when it was last used) and the credentials the app signs in with. A connection not used for a month closes by itself, and any connection lasts at most a year, after which the person connects the app again.

Disconnecting: any time in CRAIM, under Settings, MCP, Disconnect. Access ends at once, and the app's next request is refused. The workspace's data in CRAIM is not affected.

CRAIM is not designed to store health information, payment card numbers or government identification numbers, and we do not sign business associate agreements under HIPAA. Please do not put such information into CRAIM records, notes or materials.

Service providers who host infrastructure, deliver email, process payments, or support analytics, bound by confidentiality and processing terms.

Professional advisers when required for audits, legal compliance, or corporate transactions.

Authorities when required by law or to protect the rights, safety, and security of users and the public.

With your direction, such as integrations you enable between CRAIM and third-party systems you control.

We retain account and service data for as long as your workspace is active and for a reasonable period afterward to recover from accidental deletion, resolve disputes, and meet legal duties.

Backup copies may persist for a limited period consistent with our disaster recovery program.

You may request deletion subject to exceptions (for example, legal holds or unresolved bills) described in your agreement.

We implement administrative, technical, and organizational measures designed to protect data, including encryption in transit, access controls, and least-privilege engineering practices.

No method of transmission or storage is completely secure; we encourage strong passwords, SSO where available, and prompt reporting of suspected incidents.

Depending on your location, you may have rights to access, correct, delete, or export personal data, and to object to or restrict certain processing.

Workspace administrators may exercise many controls on behalf of their organization. Individuals can contact us to exercise rights that apply to their personal data.

Marketing emails include an unsubscribe mechanism where required; transactional and security notices may continue.

If we transfer personal data across borders, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms required by applicable law.

The Services are not directed to children under 16. We do not knowingly collect personal data from children. Contact us if you believe we have collected such data.

We may update this policy from time to time. We will post the new version with an updated date and, where changes are material, provide additional notice as required by law.

Questions about this Privacy Policy or our privacy practices: contact CRAIM support.

You can also email support@craim.ltd.