Privacy Policy

crewkit is operated by:

Karibew Inc. acts in two roles. For account and security data (your account, sign-in, billing, and security records), Karibew is the controller. For the content an organization brings into crewkit (its sessions, cloud jobs, uploaded documents, agent messages, and what is derived from them), the organization is the controller and Karibew is its processor, acting on the organization's instructions and under its own settings, such as its retention period. Questions or requests about that content may also be directed to your organization.

This Privacy Policy describes how we collect, use, and protect your information when you use crewkit services. It applies to our website, dashboard, API, and CLI. By using crewkit, you agree to the practices described in this policy and our Terms of Service.

We collect information you provide directly to us, including:

• Account Information: Email address, name, organization details
• Usage Data: Agent configurations, experiment results, session logs, each session's permission mode
• Technical Data: IP addresses, browser type, device information
• Project Data: Git repository information, project metadata
• Payment Data: Billing details processed securely through Stripe (we do not store full card numbers)

When you use the crewkit CLI, we collect additional data to provide analytics and improve the service:

• Session Telemetry: Token counts (input/output), estimated costs, session duration, agent used, outcome status, the CLI version and launch mode used to start the session, and basic environment details (operating system, architecture, shell, terminal, machine hostname)
• Session Files: JSONL session files may be uploaded to provide session history and analytics features
• Error Reports: Crash reports and error details are sent to our error tracking service (Sentry) to help us fix bugs
• Git Metadata: Repository remote URL and branch information for project detection (not repository contents)

LLM Gateway (Optional): If enabled by your organization, the LLM Gateway feature routes AI requests through our servers. When active, prompts and responses are processed by both crewkit and Anthropic for cost tracking and analytics. This feature is opt-in and disabled by default. When enabled, data is subject to both this Privacy Policy and Anthropic's Privacy Policy.

We process your personal data under the following legal bases (GDPR Article 6):

We use collected information to:

• Provide, maintain, and improve crewkit services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Monitor and analyze usage patterns and trends
• Calculate and display cost analytics and session metrics
• Detect, prevent, and address technical issues and security threats

We use the following third-party services to process your data:

Sign-in with Google or GitHub: If you choose one of these methods, Google or GitHub receives your request to sign in to crewkit. crewkit receives the provider's standard profile and keeps only the fields needed for your account and sign-in link: from Google, your account subject ID, email, and name; from GitHub, your numeric account ID, primary email, and username (used as your display name). Google's profile can also include a picture, given and family names, locale, and hosted domain (hd). We use its email-verified flag and hosted-domain claim to decide whether Google currently hosts your mailbox; we do not keep the remaining profile fields. GitHub also supplies your email verification status, which we read for sign-in. These checks determine whether we need a separate email link to prove mailbox ownership. After the GitHub profile and email reads, the access token is revoked, or at minimum discarded; never stored.

Subprocessor updates: We will update this list when adding or changing subprocessors. Subscribe to subprocessor change notifications by emailing privacy@crewkit.io with the subject line "Subscribe: Subprocessor Updates."

We are finalizing a data processing agreement (DPA) for organizations that use crewkit as their processor. To receive it when it is ready, contact us at privacy@crewkit.io.

crewkit is operated from Quebec, Canada. Our subprocessors are primarily located in the United States, so your data will be transferred to and processed in the United States and other countries where our subprocessors operate.

For transfers of personal data from the European Economic Area (EEA), United Kingdom (UK), or Switzerland to the United States, we rely on standard contractual clauses.

By using crewkit, you consent to the transfer of your information to the United States and other countries as described above.

We do not sell your personal information. We may share information:

• With your consent: When you explicitly authorize sharing
• Within your organization: With team members in your organization as determined by your admin's settings
• Service providers: Third parties listed in our subprocessor list who perform services on our behalf, under contractual obligations to protect your data
• Legal requirements: When required by law, regulation, or legal process, or to protect the rights, safety, or property of crewkit, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users

We implement appropriate technical and organizational measures to protect your information:

• Encryption in transit (TLS)
• Encryption at rest for our database, which runs on DigitalOcean managed PostgreSQL; credentials and tokens crewkit stores (such as connected-service tokens and webhook URLs) are also encrypted by the application
• Human review of every code change, and automated security tests (tenant isolation, token scope, webhook signatures) and static analysis that run on every change
• Access controls and authentication requirements

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

You have control over what data is collected by crewkit:

• Privacy Mode: Enable privacy mode in your organization settings to prevent logging of prompts and responses. Metrics like token counts, costs, and session duration are still collected to power analytics features.
• LLM Gateway: This feature is opt-in and must be explicitly enabled by your organization admin. When disabled, no prompts or responses are routed through crewkit servers.

Note: These settings only affect data collected by crewkit. Claude Code has its own telemetry which is governed by Anthropic's privacy policy.

We use cookies and similar technologies to:

• Essential cookies: Maintain your session and authentication state (required for service functionality)
• Preference cookies: Remember your settings and preferences
• Analytics cookies: Analyze site traffic and usage patterns to improve the service

You can control non-essential cookies through your browser settings. Disabling essential cookies may prevent you from using the service. We do not use third-party advertising cookies.

We retain your information for as long as your account is active or as needed to provide services:

• Session telemetry: Retained for 365 days by default, configurable per organization down to a 7-day minimum
• Error reports (Sentry): Retained for 90 days
• Account data: Retained until account deletion
• Acceptable-use policy consent: The record that you accepted our acceptable-use policy is kept for 3 years after your account is deleted. It holds the policy version, the language you read it in, a fingerprint of the exact wording shown, the time you accepted, and the machine name, crewkit version and IP address recorded at that moment. Your name, email address and user account are not part of the retained record.
• Code-host job-credential audit: Each time crewkit issues a short-lived credential for a cloud job (a GitHub App token, or a GitLab deploy token or deploy key) and each time it revokes one, we record the code host, the connection and repository ids it covered, what it was for and with which permissions, when it expires, the code host's id for it, the job it served, the orchestrator worker it was issued to, the internal id of the account that requested it, and a one-way fingerprint of the token. The record never holds the token or key, a login, email address, name or IP address. We keep it as a security audit, so that a leaked or misused credential can be traced to the mint that issued it. It is kept for 13 months, then deleted; if you delete your account, the record stays with your organization and your account id is removed from it.
• Payment records: Retained as required by applicable tax and financial regulations

You may request deletion of your data by contacting us. We will process deletion requests within 30 days. Some information may be retained where required by law or for legitimate business purposes (e.g., fraud prevention, financial records).

What survives an account deletion, and why. When you delete your account, your organization keeps the work records created while you were a member — they are that organization's business records, and your name is removed from them. Because those records remain, we also keep the evidence that they were created under an accepted acceptable-use policy: the consent record described above. We rely on this only to establish, exercise or defend legal claims (GDPR Art. 17(3)(e); Loi 25). It is not used for any other purpose, it is never used to contact you, and it is deleted automatically 3 years after your account is.

crewkit is designed for professional use by software developers and engineering teams. Our services are not directed at individuals under 18 years of age, and we do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@crewkit.io.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data. One record is kept after deletion — your acceptable-use policy consent — for the reason and the period set out in section 12. A merge request crewkit opened on gitlab.com for your cloud job, and the text it carries (including your display name), lives in your organization's GitLab project: erasure does not recall it from gitlab.com, and your organization's GitLab administrators can edit or delete it there.
• Restriction: Request that we limit processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise your rights: Contact privacy@crewkit.io with your request. We will respond within 30 days. We may need to verify your identity before processing your request.

Right to lodge a complaint: If you are located in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed in violation of applicable data protection laws.

California residents: Under the CCPA, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by GDPR
• Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms
• Provide details of the breach, its likely consequences, and the measures taken to address it

Where an organization has signed a data processing agreement (DPA) with us, breach notification for that organization's content follows the terms of that agreement.

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by posting the updated policy on this page, through in-app notification, or by email. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of crewkit after changes take effect constitutes acceptance of the updated policy.

October 18, 2026: Corrections so this policy states only what crewkit does. Section 1 now states both of our roles (controller for account and security data, processor for organization content). Section 6 adds Vercel, SendGrid, ElevenLabs, Slack, and Google, updates the Sentry and Cloudflare entries, and says our DPA is being finalized rather than available now. Section 7 states that transfers rely on standard contractual clauses. Section 9 no longer claims regular security audits, and states which data is encrypted at rest.

October 22-23, 2026: Section 6 discloses Slack discussions: what crewkit posts in a Slack thread and what it keeps, for how long, and erasure by Slack id. It names the sessions a discussion joins as Claude AI sessions (Anthropic's Claude).

October 23, 2026: Section 6's Slack discussions part now states that a member's session joins a discussion only when that member allows it, and that a session run in a mode that asks nothing joins and posts without asking, and what crewkit keeps of how each join was allowed, who can see it and for how long. It also states that when crewkit cannot confirm its opening post reached Slack, it reads that channel's messages from about the minute the discussion was created, at a limited pace, to find its own post and keeps only that post's timestamp.

October 24, 2026: Section 6's Slack discussions part now states that, while crewkit looks for its opening post, it keeps Slack's paging cursor between pages and discards it when the lookup ends.

October 26, 2026: Section 6 discloses the Feedback panel: what it sends to the crewkit API, that it sends nothing where it is not enabled, and the launcher corner it keeps in the visitor's browser.

If you have questions about this Privacy Policy or our data practices, contact us: