Privacy Policy

This Privacy Policy explains what personal data Crowflow collects, why we collect it, what we do with it, who we share it with, and what rights you have. If anything is unclear, please email privacy@crowflow.io and we’ll explain.

1 Who we are

Crowflow is a software service operated by Crowbit Limited, a company registered in England and Wales (company number 17234377; registered office Flat 33, Hartington Court, London, W4 3TT). In this policy, “we”, “us” and “our” refer to Crowbit Limited; “you” and “your” refer to the individual or organisation using Crowflow. We are the controller of the personal data described below.

2 Scope

This policy applies to the Crowflow website at crowflow.io, the Crowflow web application, and any related services we provide. It does not apply to third-party services that we integrate with (including Google Ads, Microsoft Advertising, Meta Ads, TikTok Ads, Snapchat Ads, Reddit Ads, Pinterest Ads, Taboola, HubSpot, Salesforce and Google Sheets), which are governed by their own privacy policies.

3 The personal data we collect

3.1 Data you give us directly

• Account data: your name and email address. Authentication is handled by our provider Clerk. We never see or store your password.
• Workspace data: company or workspace name, time zone, billing contact details.
• Communications: the contents of emails or support messages you send to us.

3.2 Data we collect when you connect a platform

• OAuth tokens (or API credentials) issued by the platforms you connect (Google, Microsoft, Meta, TikTok, Snapchat, Reddit, Pinterest, Taboola, HubSpot, Salesforce or Google Sheets) when you authorise Crowflow. These are stored encrypted at rest and are the minimum scope necessary to read your campaign data and write to your chosen Sheet.
• Platform metadata: the names and identifiers of the ad accounts and campaigns you select. We use these to display and label your data.

3.3 Data we receive from your ad platforms and CRM

When Crowflow syncs your accounts, we receive aggregated campaign-performance figures (date, platform, account, campaign, impressions, clicks, conversions, spend). This is your business data and is generally not personal data. We process it on your behalf in order to provide the service.

If you connect HubSpot or Salesforce, Crowflow also receives records from your CRM: contacts and leads, and deals (called opportunities in Salesforce). For each record we store its identifier in your CRM, when it was created, its status or stage, its source, the team member who owns it and, for deals, the amount and close date. For HubSpot we also store when each contact reached each stage, the first web page they visited, and which contacts each deal is linked to. We also store any additional fields you choose to sync. By default Crowflow does not request your contacts’ names, email addresses or phone numbers, and a HubSpot connection cannot be set up to sync them.

When you connect HubSpot on a plan with sales reporting, Crowflow also stores metadata about calls your team logs: when a call happened, how long it lasted, its direction and outcome, which team member made it and which contact record it is linked to. Crowflow never stores call recordings, call notes, transcripts or phone numbers.

These CRM records can include personal data about your contacts and your team. You are the controller of that data. We process it as your processor, on your instructions and only to provide the service.

3.4 Payment data

Payments are processed by Stripe. We do not receive or store your full card details. Stripe shares with us metadata such as the last four digits of your card, your billing country, and your subscription status. See Stripe’s privacy policy for how it handles your payment data.

3.5 Usage and technical data

• Usage data: pages and features you use, button clicks and sync timings, collected via our product analytics provider.
• Technical data: IP address, browser type and version, operating system and timestamps, collected via server logs and analytics.

3.6 Data from the Crowflow iOS app

• Device details: a name for each device you pair with your account (the app sends the name iOS reports, such as “iPhone”), when you paired it and when it was last used.
• Push token: the token Apple issues so we can send notifications to your device. We use it to refresh the app’s widget when your data syncs and, if you turn alerts on, to alert you to changes in your numbers (for example, spend rising or a connected source that has stopped reporting). Apple delivers these notifications and receives the push token and the text of each alert.
• Signing out and revoking: when you sign out of the app, or revoke a device in your Crowflow settings, we stop sending notifications to that device and delete its push token. We keep the device’s name and the dates it was paired, last used and revoked as part of your account history until your account is deleted.

The app itself contains no analytics, advertising or crash-reporting software. The requests it makes to our servers are handled like any other request to Crowflow, as described in 3.5.

4 Google user data

Crowflow accesses Google user data through Google APIs when you connect your accounts: the Google Ads API (to read your campaign performance data) and the Google Sheets API (to write synced data to the spreadsheet you choose).

Crowflow’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only use Google user data to provide and improve the user-facing features described in this policy: syncing your ad data and delivering it to your chosen Sheet.
• We do not transfer Google user data to third parties except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data for advertising, and we do not sell it.
• We do not allow humans to read this data unless you have given explicit permission, it is necessary for security or to comply with the law, or it has been aggregated and anonymised.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.

5 How we use your personal data

• To provide and operate Crowflow, including syncing your data and delivering it to your chosen Google Sheet.
• To send service-related communications (sync failures, billing notices, security alerts).
• To refresh the Crowflow iOS app’s widget when your data syncs and, if you turn alerts on, to notify you about changes in your numbers.
• To process payments and manage subscriptions.
• To debug, secure and improve the service.
• To send occasional product updates, with your consent (or via soft opt-in for existing customers, in line with PECR).
• To meet legal, tax, accounting and fraud-prevention obligations.
• To enforce our Terms of Service.

6 Lawful bases for processing (UK GDPR / EU GDPR)

We rely on the following lawful bases, depending on the activity:

• Contract: where processing is necessary to provide the service you’ve signed up for.
• Legitimate interests: to run and improve our business safely (e.g. analytics, debugging, security, fraud prevention). We balance these interests against your rights and freedoms.
• Consent: where required by law (e.g. non-essential cookies, marketing to prospects).
• Legal obligation: where we must process data to comply with the law (e.g. retaining invoices under UK tax legislation).

7 Who we share your data with

We share personal data with the following categories of recipients, each contractually bound to handle it appropriately:

We keep this table up to date and will update this policy before adding a new sub-processor. We do not sell your personal data.

We may also share data:

• With professional advisers (lawyers, accountants, auditors) bound by confidentiality.
• With law enforcement or regulators where required by law.
• With a successor entity in the event of a merger, acquisition or asset sale, subject to equivalent privacy protections.

8 International data transfers

Some of our sub-processors are based outside the UK and EEA, primarily in the United States. Where this is the case, the transfer is protected by an appropriate safeguard recognised under UK GDPR and EU GDPR. The safeguard is most commonly the EU Standard Contractual Clauses combined with the UK Addendum, or the UK International Data Transfer Agreement, or a relevant adequacy decision. Copies are available on request.

9 How long we keep your data

• Account data: kept while your account is active. Deleted within 30 days of account closure, except where retention is required by law (e.g. invoices retained for 7 years under UK tax law).
• Marketing data synced into Crowflow: kept while your subscription is active. Deleted on account closure.
• Paired devices: a device’s push token is deleted when you sign out of the app or revoke the device. Its name and the dates it was paired, last used and revoked are kept until your account is deleted.
• Server logs: retained for up to 90 days.
• Backups: rotated on a rolling 30-day schedule.

10 Your rights (UK GDPR / EU GDPR)

You have the right to:

• Access a copy of the personal data we hold about you.
• Rectification of any inaccurate or incomplete data.
• Erasure (the “right to be forgotten”) in certain circumstances.
• Restriction of processing in certain circumstances.
• Portability (to receive your data in a structured, machine-readable format).
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email privacy@crowflow.io. We respond within one calendar month, and may need to verify your identity first.

11 California residents (CCPA / CPRA)

If you are a California resident, you have additional rights to know what personal information we collect, to request deletion, to opt out of any “sale” or “sharing” of your personal information, and not to be discriminated against for exercising those rights. Crowflow does not sell or share your personal information as those terms are defined under the CCPA. To exercise any California right, email privacy@crowflow.io.

12 Cookies and similar technologies

• Strictly necessary cookies: required for the application to function (e.g. your authentication session). These are set without consent.
• Analytics: our product analytics currently runs cookielessly. It stores nothing on your device. If we introduce analytics cookies in future, we will ask for your consent first via a cookie banner.

13 How we protect your data

OAuth tokens are encrypted at rest using a key managed by our hosting provider’s KMS. All data in transit is encrypted with TLS 1.2 or higher. Sign-in is handled by Clerk, so we never store passwords ourselves. We scan dependencies for known vulnerabilities, maintain access controls based on least privilege, and follow a documented incident-response plan. If a personal-data breach occurs, we will notify the ICO within 72 hours of becoming aware of it where required (UK GDPR Article 33), and will inform affected users without undue delay where the breach is likely to result in a high risk to them (Article 34).

14 Children

Crowflow is a business tool and is not intended for individuals under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, contact us and we will delete it.

15 Changes to this policy

We may update this policy from time to time. If we make material changes (changes that meaningfully expand how we use your data), we will notify you by email and/or in-app notice at least 30 days before they take effect. Non-material changes (clarifications, formatting) will be posted with an updated “Last updated” date.

16 Complaints

If you have a concern about how we handle your data, please contact us first. We’d like the chance to resolve it. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local data protection authority if you are based in the EEA.

17 Contact us

Crowbit Limited
Flat 33, Hartington Court, London, W4 3TT
Email: privacy@crowflow.io
General: hello@crowflow.io