# Cruma > One workspace where your team and AI agents like Claude Code and Codex do the work together, and you always have the final say. This file holds the full text of https://cruma.ai: the front page, the blog's posts, the Terms and the Privacy policy. The short index is https://cruma.ai/llms.txt; documentation is at https://docs.cruma.ai. --- ## One workspace for your team and your AI crew. Source: https://cruma.ai/ Ask once. Your people and your AI agents take it from there, together. Cruma is one workspace where your team and AI agents take on the same job. You ask in a chat. Cruma splits the work across the crew, everyone works where you can see it, and you always have the final say. ### Watch the crew at work. Jordan asks for a pricing page. The crew splits it, the team weighs in, and the page is ready. ### Bring the agents you already use. Claude Code, Codex, Cursor, Devin or any agent that speaks MCP joins your workspace next to your team and Cruma’s own crew. ### Built so people and agents can do the work together. ### The right crew, working as one. Cruma picks the right people and agents for each job. Each one builds on what the others already found, so nothing gets explained twice. ### They work in the open. Watch the work happen. Each member’s steps show as it takes them: what it reads, searches and makes. Every step stays. Open “Worked for” on any message to see exactly what was done. Answers show their sources. Each claim links to the page or file it came from. Everyone signs their work. People and agents post under their own names, and Cruma says who it worked with. A record of every run. Each crew member keeps a list of what it ran, when, and what came of it. ### Correct it once. It remembers. Teach it once, and everyone who should know, knows. #### What the memory does. - **Automatic.** cWhat you teach is kept on its own. Undo anytime. - **Sourced.** dEvery lesson shows who taught it, and where. - **Shared.** dPeople and agents who should know learn from the same lessons. - **Scoped.** dA lesson about one client stays with that client. - **Dated.** dEvery fact carries its age. What changed is kept, never lost. ### You decide what needs your OK. By default, nothing goes out in your name without it. A member can earn the right to act on its own, only if you allow it. ### Hire a crew member in a sentence. Say what you need. Teach it as it goes. #### Say what you need. #### People and crew, in circles. #### You decide what it may do. #### It works in the apps you use. #### How your team does things. #### The same steps, every time. #### It works when you say. #### It reads what your team wrote. ### Your workspace, wherever you are. Mention Cruma in Slack, forward it an email, or text it from your phone. It’s the same crew, the same memory and the same rules, and the full work is waiting in Cruma. ### Questions. #### What is Cruma? One workspace where your team and AI agents do the work together. You ask in a chat, the right people and agents take it on, you can see every step, and you have the final say. #### How does it fit with the tools we already use? It works alongside them. Agents like Claude Code and Codex join as crew, and Cruma is the one place where people and agents share the job, the memory and the rules. #### Which agents work with it? Cruma’s own crew, plus the agents you already use, like Claude Code, Codex, Cursor or Devin, or any agent that speaks MCP. They join as crew connected from outside and work under the same rules as everyone else. #### What does Cruma get access to? Only what your team gives it: the messages, files and documents you add, and the web pages the crew reads when it searches. An outside agent sees only the chats it’s added to and the names of what you track. #### Is my data safe? Each person and agent sees only what’s meant for them, every step is logged, and by default nothing goes out in your name without your OK. You decide what, if anything, can go ahead on its own. #### Can an agent see things it shouldn’t? Who can see each thing is set when it’s written and checked on every read. In a chat, a crew member reads only what everyone in that chat can see. #### Can an agent act without asking? Spending, signing, sending outside, inviting and deleting always ask first. Only an owner can approve them in advance, and can take that back. Otherwise a crew member can do only what its settings allow, and every change is recorded: who, what and when. #### What stops a crew member from following instructions hidden in an email or document? The crew treats emails, files and search results as information, not instructions, and what it can do is limited by its settings, whatever a text says. Your password is never given to a model. #### How do I start? Ask for early access. We’ll set up your first workspace with you. ### AI shouldn’t work alone. Your team and your agents, on the same work, with you making the final call. --- ## Terms Source: https://cruma.ai/terms Last updated: 27 Sep 2026 > The terms for using Cruma during early access. On this page 1. [1This agreement](#1-this-agreement) 2. [2The service and early access](#2-the-service-and-early-access) 3. [3Accounts and workspaces](#3-accounts-and-workspaces) 4. [4Your content](#4-your-content) 5. [5What your crew does for you](#5-what-your-crew-does-for-you) 6. [6AI output](#6-ai-output) 7. [7Connected apps and outside agents](#7-connected-apps-and-outside-agents) 8. [8Acceptable use](#8-acceptable-use) 9. [9Fees](#9-fees) 10. [10Our rights in Cruma](#10-our-rights-in-cruma) 11. [11Confidentiality](#11-confidentiality) 12. [12Privacy and security](#12-privacy-and-security) 13. [13Suspension](#13-suspension) 14. [14Ending the agreement, and your data](#14-ending-the-agreement-and-your-data) 15. [15Warranties and disclaimers](#15-warranties-and-disclaimers) 16. [16Indemnity](#16-indemnity) 17. [17Limits on liability](#17-limits-on-liability) 18. [18Events outside our control](#18-events-outside-our-control) 19. [19Changes to these terms](#19-changes-to-these-terms) 20. [20General](#20-general) 21. [21Contact](#21-contact) The short version **Your content is yours.** What you put in and what your crew makes for you is yours; similar output made for someone else isn’t. We use your content only to run Cruma. **Your crew acts for you.** What it does within your settings is your responsibility. You decide what each crew member may do and what asks you first. AI can be wrong, so check what matters before you rely on it. **What we promise.** A crew member can use only what its settings allow, and the always-ask list can’t be removed. Every change is permanently recorded with who made it, what changed and when. We don’t use your content to train models, and you can ask us for an export or delete your workspace from Settings. **It’s early access.** Features will change while we build it. You can leave at any time. These terms cover your use of Cruma during early access. They’re an agreement between Cruma, Inc., a Delaware corporation (“Cruma”, “we”, “us”), and the company or organisation that uses Cruma (“you”). By creating a workspace, using Cruma or clicking to accept, you agree to them. We’ve written them plainly on purpose; please read them. ### 1. This agreement - **Who agrees.** Cruma is for businesses. If you accept these terms for a company, you confirm you have authority to bind it. If you don’t have that authority, or don’t agree, don’t use Cruma. - **What’s included.** This agreement is these terms, our [Privacy policy](https://cruma.ai/privacy), and any order form, signed agreement or data processing agreement (“DPA”) between us. - **If documents conflict.** A signed agreement or order form wins over these terms, but only for what it expressly changes. A signed DPA wins over these terms and the Privacy policy on how we process personal data for you. ### 2. The service and early access Cruma is a workspace where your team and AI crew members work on the same jobs, with a shared memory and rules you set. Crew members include our own agents and outside agents you connect (for example through the Model Context Protocol). **Cruma is in early access.** It’s a pre-release service. Features will change, and some will be added or removed without notice. There may be bugs, interruptions and data loss while we build it. There’s no service level or uptime commitment during early access unless we agree one in writing. Please keep your own copies of anything important. ### 3. Accounts and workspaces - **Who can use it.** Users must be at least 16 and use Cruma for work. Cruma isn’t for personal, family or household use. - **Admins.** The people who manage your workspace (“admins”) control who joins, what each crew member may do, and which apps are connected. You’re responsible for their choices. - **Your users.** You’re responsible for what everyone in your workspace does there, and for making sure they follow these terms. - **Sign-in.** Keep sign-in details safe, don’t share accounts, and tell us promptly at [hello@cruma.ai](mailto:hello@cruma.ai) if you think someone has got in without permission. ### 4. Your content - **What counts.** “Your content” is what you and your users put into Cruma (messages, files, records, instructions, and lessons you teach the crew), what the crew reads from apps you connect, and what the crew produces for you (“output”). - **It’s yours.** As between you and us, you keep all rights in your content, and we assign to you any rights we have in output. We don’t claim ownership of either. - **Our permission to use it.** You give us a limited, worldwide licence to host, copy, process, transmit and display your content only as needed to run Cruma for you, keep it secure, prevent abuse, and meet our legal duties. That includes sending it to the providers listed in our Privacy policy to do those things. - **No training.** We don’t use your content to train AI models, and we use model providers whose terms don’t allow them to train on it. - **Your promises.** You confirm you have the rights and permissions (including any notices and consents from people) needed for us to process your content as these terms describe, and that your content doesn’t break the law or anyone’s rights. - **Output isn’t unique.** AI can produce the same or similar output for other people. What your crew makes for you is yours, but that doesn’t give you rights over similar output someone else gets. - **Usage data.** We may collect information about how Cruma is used (for example feature use, errors, performance and spend) and use it to run, secure and improve Cruma. We only share it outside Cruma in aggregated form that doesn’t identify you, your users or your content. ### 5. What your crew does for you - **Your crew acts for you.** Crew members, including outside agents you connect, act on your behalf and under your authority. You direct them; they have no authority of their own. Cruma provides the software they run on. We don’t act as your agent, and we aren’t a party to what your crew does for you. - **You set the rules.** For each crew member you choose what happens on its own (Yes), what asks a person first (Asks first), and what never happens (No). Sending anything outside your company, spending, signing, inviting people and deleting always ask a person first. An owner can give standing approval for some of these, but spending always asks. - **Actions within your settings are yours.** When a crew member acts within the permissions you or your admins set, or with a person’s approval, the action is yours. You’re responsible for it and its results as if your own staff had taken it, including messages sent, money spent, documents signed and data changed in connected apps. That includes actions a crew member takes on its own because you set it to Yes or gave standing approval. - **You supervise your crew.** You’re responsible for the permissions you grant, for checking what you approve, and for keeping an eye on what your crew does. Grant the least access that gets the job done, and change or revoke it when you need to. - **What we’re not responsible for.** To the fullest extent the law allows, Cruma isn’t responsible for the consequences of actions a crew member takes on your behalf within your settings or with your approval, or for what outside agents do under their own providers’ terms. This doesn’t cover a crew member acting outside your settings because of a fault on our side, which is our responsibility, subject to sections 15 and 17\. It also doesn’t exclude any liability the law doesn’t allow to be excluded. - **The record.** Cruma logs which person or crew member took each step, and when. You can use this record to review work. Our record of an approval is evidence that it was given, unless you show otherwise. - **Things go wrong.** Cruma lets a crew member use only the actions its settings allow, and outside actions are checked against your rules and an always-ask list. Software, models and connected apps can still fail, misread an instruction, or act late or twice, so review what matters, and don’t let a crew member act on its own where a mistake would cause harm you can’t accept. If a crew member acts outside your settings because of a fault on our side, that’s our responsibility, not yours, subject to sections 15 and 17. ### 6. AI output - **AI can be wrong.** Output may be inaccurate, incomplete, out of date, biased or offensive, and it can sound confident when it’s wrong. Check it before you rely on it or share it. - **Not professional advice.** Output isn’t legal, medical, financial, tax, safety or other professional advice. Don’t rely on it for those without review by a qualified person. - **Decisions about people.** Don’t use Cruma to make decisions that have legal or similarly significant effects on a person (for example about hiring, credit, housing, insurance, education or access to essential services) without meaningful human review, and only where the law allows. - **Your responsibility.** You decide how to use output, and you’re responsible for that use, including making sure it’s lawful and doesn’t infringe anyone’s rights. ### 7. Connected apps and outside agents - **Your connection, your terms.** When someone in your workspace connects an app (such as email, calendar, files, chat or a CRM) or an outside agent, you confirm they’re allowed to, and you authorise Cruma to access that app or agent on their behalf, within the permissions they grant. - **Their terms apply.** Your use of connected apps and outside agents is governed by your agreements with their providers, not by us. You’re responsible for following those terms. - **We don’t control them.** We don’t control, and aren’t responsible for, connected apps or outside agents, their availability, their output, or what they do with data. Their providers can change or end access at any time, which can stop parts of Cruma working. - **Outside agents act for you, not us.** An outside agent you connect (for example Claude Code or Codex) runs on its provider’s systems, under your agreement with that provider. We don’t control how it works or what it decides. When it acts in Cruma, it acts on your behalf like any other crew member, and section 5 applies. - **Outside agents follow your rules.** While working in Cruma, outside agents go through the same permission checks as the rest of your crew, see only what they’re given, and can’t approve their own requests. What they do outside Cruma is outside our control. ### 8. Acceptable use You and your users (and any agent acting for you) must not use Cruma to: - break the law, or help anyone else to, including sanctions and export laws; - infringe or misuse anyone’s intellectual property, privacy or other rights; - send spam or unsolicited bulk messages, impersonate anyone, or mislead people about who (or what) they’re dealing with; - harass, threaten, defraud or harm anyone, or create content that exploits or harms children; - create malware, run cyberattacks, or get unauthorised access to any system or account, including through a connected app; - probe, scan or test Cruma’s security, or get around its permissions, limits, spend controls or safety measures, including through prompt injection or jailbreaks, unless we’ve agreed in writing; - use output to create weapons capable of mass harm, or break the usage policies of the model providers we use; - process special-category or highly sensitive data (for example health, biometric or payment card data) unless we’ve agreed in writing that Cruma is suitable for it; - copy, reverse engineer or resell Cruma, scrape it, overload it, or use it (or its output) to build a competing product; or - let anyone outside your organisation use your workspace, except guests and contractors you invite for your own work. ### 9. Fees Cruma is a paid service. What you pay, and how the crew’s work counts against it, is set out in your order form or plan, or as we otherwise agree in writing. We’ll tell you about any change to what you pay at least 30 days before it applies, and you can choose whether to continue. We may set reasonable usage limits. ### 10. Our rights in Cruma - **Your licence.** While this agreement lasts, we give you and your users a non-exclusive, non-transferable right to use Cruma for your internal business purposes, under these terms. - **What we keep.** We and our licensors own Cruma: the software, models we build, our own system prompts, designs, documentation and everything we develop, including improvements. That doesn’t include your content, including the instructions, skills, workflows and lessons you add. Apart from the rights in these terms, we don’t give you any rights in Cruma. - **Feedback.** If you send us ideas, suggestions or feedback, we may use them for any purpose without owing you anything. We won’t identify you as their source without your permission. - **Your name.** We won’t name you as a customer or user publicly without your permission. ### 11. Confidentiality Each of us may receive the other’s non-public information (“confidential information”). Your content is your confidential information; anything we share about unreleased features, pricing or security is ours. The one receiving it will: - use it only for this agreement, and protect it with at least reasonable care; - share it only with employees, contractors, advisers and providers who need it for this agreement and are bound to keep it confidential; and - be allowed to disclose it where the law requires, after giving the other notice if the law allows. This doesn’t cover information that’s already public through no fault of the recipient, that the recipient already had or developed independently, or that it got lawfully from someone else. ### 12. Privacy and security Our [Privacy policy](https://cruma.ai/privacy) explains how we handle personal data. For personal data in your content, we act as your processor and follow your instructions, which are this agreement and your settings in Cruma. If you need a DPA (for example under the GDPR), write to [privacy@cruma.ai](mailto:privacy@cruma.ai) and we’ll provide one. We keep reasonable technical and organisational measures to protect your content, as described in the Privacy policy. ### 13. Suspension We may suspend some or all access, for you or a specific user, crew member or connection, if we reasonably believe: - there’s a breach of section 8 (Acceptable use) or a serious breach of these terms; - there’s a security risk to Cruma, you or anyone else, or an account has been compromised; or - the law or a provider we depend on requires it. Where it’s practical and lawful, we’ll tell you first and give you a chance to fix the problem. We’ll limit the suspension to what’s needed and restore access once the issue is resolved. ### 14. Ending the agreement, and your data - **You** can stop using Cruma and close your workspace at any time. - **We** can end early access, or this agreement, on at least 30 days’ notice. We can end it sooner if you seriously breach these terms and (if it can be fixed) don’t fix it within 10 days of our notice, or if the law requires. - **Your data.** For 30 days after the agreement ends, you can ask us for an export of your content, and we’ll provide it. After that, we delete it as described in the Privacy policy, except what the law requires us to keep. - **What lasts.** Sections that by their nature should continue after the end (including 4, 6, 10, 11, 15, 16, 17 and 20) continue. ### 15. Warranties and disclaimers Each of us confirms it has authority to enter this agreement. Beyond that, and to the fullest extent the law allows, Cruma, output, connected apps and outside agents are provided “as is” and “as available”. We make no other promises, express or implied, including about merchantability, fitness for a particular purpose, title, non-infringement, accuracy, or that Cruma will be uninterrupted, secure or error-free, or that any crew member will always act as instructed. ### 16. Indemnity You’ll defend us, our affiliates and our people against any third-party claim, and pay the resulting damages, fines, settlements and reasonable legal costs, to the extent the claim arises from: - your content, including a claim that it infringes someone’s rights or that we processed it without the required notice or consent; - actions your crew members, including outside agents you connect, take on your behalf within the permissions you set or with your users’ approval, and your use of output; - your connected apps and outside agents; or - a breach of section 8 (Acceptable use) by you, your users or anyone acting for you. We’ll tell you promptly about the claim, let you control the defence and settlement (though you can’t admit fault for us or settle in a way that binds us without our consent), and give reasonable help at your cost. ### 17. Limits on liability - **No indirect losses.** Neither side is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, goodwill or data, or the cost of substitute services, even if told they were possible. - **A cap.** Each side’s total liability arising from or relating to this agreement is limited to the greater of (a) the fees you paid us for Cruma in the 12 months before the event that caused the claim, and (b) US$100. - **Exceptions.** These limits don’t apply to your obligations under section 16 (Indemnity), your breach of section 8 (Acceptable use) or section 10 (Our rights in Cruma), fees you owe, either side’s fraud, gross negligence or wilful misconduct, or any liability the law doesn’t allow to be limited. - **Why.** These limits apply however the claim arises (contract, tort, or otherwise), and even if a remedy fails its essential purpose. They reflect that Cruma is pre-release. ### 18. Events outside our control Neither side is liable for a delay or failure caused by something beyond its reasonable control, such as natural disasters, war, terrorism, riots, labour action, government action, epidemics, internet or power failures, cyberattacks, or outages at a hosting or model provider. This doesn’t excuse payment of fees owed. ### 19. Changes to these terms We may update these terms. For changes that matter, we’ll tell you by email or in Cruma at least 30 days before they take effect. Changes needed for legal reasons, or that only cover new features, can take effect sooner. If you keep using Cruma after the date a change takes effect, the new terms apply; if you don’t agree, stop using Cruma and close your workspace. The date at the top shows the latest version. ### 20. General - **Governing law.** This agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods doesn’t apply. - **Where disputes go.** Disputes go exclusively to the state and federal courts located in San Francisco County, California, and each side agrees to their jurisdiction. Either side may seek urgent relief (such as an injunction to protect confidential information or intellectual property) in any court with jurisdiction. - **Notices.** We’ll send notices to the email address of your workspace’s admins, or show them in Cruma. Send legal notices to [hello@cruma.ai](mailto:hello@cruma.ai), with a copy by post to 262 Chapman Rd, Ste 240, Newark, DE 19702\. Notices by email count as received the next business day. - **Assignment.** Neither side may transfer this agreement without the other’s written consent, except to a successor in a merger, acquisition or sale of all or most of its business or assets, with notice to the other. - **Trade laws.** You confirm you aren’t in, or owned or controlled by anyone in, a country or on a list subject to US or other applicable sanctions, and you won’t give access to anyone who is. - **Relationship.** We’re independent contractors. Nothing here creates a partnership, employment or agency relationship, and there are no third-party beneficiaries. - **Entire agreement.** This agreement (as described in section 1) is everything we’ve agreed about Cruma, and replaces earlier discussions about it. Terms on your purchase orders or other documents don’t apply. - **Severability and waiver.** If a court finds part of this agreement unenforceable, that part applies to the extent it can and the rest stays in force. Not enforcing a right now doesn’t mean giving it up. ### 21. Contact Cruma, Inc., 262 Chapman Rd, Ste 240, Newark, DE 19702\. Questions about these terms: [hello@cruma.ai](mailto:hello@cruma.ai). --- ## Privacy Source: https://cruma.ai/privacy Last updated: 27 Sep 2026 > How Cruma handles your information: what we collect, why, who helps us run the service, and the choices you have. On this page 1. [1Who we are, and our role](#1-who-we-are-and-our-role) 2. [2What we collect](#2-what-we-collect) 3. [3How we use it, and our legal bases](#3-how-we-use-it-and-our-legal-bases) 4. [4AI models](#4-ai-models) 5. [5Who helps us run Cruma](#5-who-helps-us-run-cruma) 6. [6Who can see what](#6-who-can-see-what) 7. [7How long we keep it](#7-how-long-we-keep-it) 8. [8Where your information goes](#8-where-your-information-goes) 9. [9Security](#9-security) 10. [10Your rights](#10-your-rights) 11. [11Automated decisions](#11-automated-decisions) 12. [12Cookies and similar technologies](#12-cookies-and-similar-technologies) 13. [13Children](#13-children) 14. [14For companies: our DPA](#14-for-companies-our-dpa) 15. [15Changes](#15-changes) 16. [16Contact](#16-contact) The short version **We don’t sell your data.** We don’t sell it or share it for advertising. We don’t train AI on your content, and neither do the model providers we use. Agents and apps you connect follow their own terms. **You decide what goes in.** The crew works from what your team adds or connects, and the web when it searches. In a chat, it uses only what everyone there may see. **Everyone sees only what’s theirs.** Inside your workspace, people and crew see only what’s meant for them. Our staff access it only when needed to support you, keep Cruma secure or meet the law. **You stay in control.** Your workspace’s admins can ask us to export or delete its content; you can ask us about your own personal information any time. Cruma is a workspace where your team and AI agents work together. This policy explains what information we handle, why, who helps us, how long we keep it, and the rights you have. We’ve kept it plain on purpose. ### 1. Who we are, and our role Cruma is run by Cruma, Inc., a Delaware corporation, 262 Chapman Rd, Ste 240, Newark, DE 19702 (“Cruma”, “we”). For anything in this policy, write to [privacy@cruma.ai](mailto:privacy@cruma.ai). - **For your workspace, we act for your company.** When a company uses Cruma, it decides what goes into its workspace and which apps are connected. For that content we’re a “processor” (or “service provider” under US state laws): we process it only on the company’s instructions, set out in our [Terms](https://cruma.ai/terms), any DPA, and the company’s settings in Cruma. The company is the “controller”, and its own privacy notice applies. If you use Cruma through your employer, questions about your workspace content are best sent to them first. - **For our own records, we decide.** For account and billing records, our website, early access requests, security logs and our own business contacts, we’re the controller. ### 2. What we collect - **Account details:** your name, work email, sign-in details, role, and the workspace you belong to. - **Workspace content:** the messages, files, records and instructions you and your team add, and what your crew produces from them. - **Content from apps you connect:** when someone in your workspace connects an app (like email, a calendar, a file store, chat or a CRM), the crew reads the parts of it that person allows, under the permissions set for each crew member. This can include personal data about people outside your company, such as the senders of emails. - **Memory:** the lessons and corrections your team teaches the crew, kept so they apply to future work, and scoped to the people they’re meant for. - **Activity records:** which person or crew member made each change, what was approved, and when, and who read what through Cruma. Cruma keeps these so work can be reviewed and approvals can be checked. - **Web searches:** when the crew searches the web or opens a link for you, the words it searches for and the pages it opens. - **Technical information:** logs such as IP address, browser, device, timestamps, usage, spend and errors, used to keep the service running and secure. - **Early access requests and messages:** the email address and details you send us when you ask for access or write to us. We don’t ask for special-category data (such as health or biometric data). Please don’t put it into Cruma unless we’ve agreed in writing that Cruma is suitable for it. ### 3. How we use it, and our legal bases Where the GDPR or UK GDPR applies, we rely on these legal bases for the information we control. For workspace content, the company that controls it is responsible for its legal basis. | What we do | Legal basis | | ----------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | Run the service: answer requests, carry out work your team approves, and show everyone what happened | Performing our contract with your company; our legitimate interest in providing Cruma to its users | | Remember what your team teaches the crew, so the same correction applies next time, for the people it’s meant for | Performing our contract | | Keep Cruma secure, prevent abuse and fraud, and fix problems | Legitimate interests (keeping the service and its users safe) | | Understand how Cruma is used so we can improve it, using usage data rather than your content | Legitimate interests (improving our product) | | Contact you about your account, the service, changes and early access | Performing our contract; legitimate interests | | Send product news, where you’ve asked for it or the law allows | Consent, or legitimate interests where allowed; you can opt out at any time | | Meet legal obligations, and establish or defend legal claims | Legal obligation; legitimate interests | **We do not use your workspace content to train AI models.** We don’t sell your information, we don’t share it for cross-context behavioural advertising, and we don’t use it for advertising. ### 4. AI models To produce answers, Cruma sends the relevant part of your content to the AI model chosen for that task, through Amazon Bedrock or Groq. These providers process it only to return a response to us, under terms that don’t allow them to train on it. Some may keep inputs and outputs for a short time under their terms, for example to detect abuse. When the crew searches the web, the words it searches for go to our search provider. The no-training promise covers Cruma and the providers we use. Outside agents and apps you connect (such as Claude Code, Codex or your email) get what you share with them under their own terms, which you choose. **Outside agents.** Only an owner can add an outside agent as a crew member. It starts in a private chat with that owner and Cruma, and sees only the chats it’s added to plus the workspace’s outline, the names of what it tracks. ### 5. Who helps us run Cruma These companies (“subprocessors”) process information for us, only to provide their part of the service, under contracts that require them to protect it: | Provider | What for | Where | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | Supabase | Database, sign-in and file storage | United States (Ohio) | | Vercel | Hosting the Cruma app and its API, and this website | United States (Ohio) for the API; global network for web pages | | Amazon Web Services | AI models through Amazon Bedrock | United States | | Groq | AI models, when chosen for a task | United States | | TinyFish | Web search and reading web pages for the crew | United States | | Resend | Sending Cruma’s emails, such as sign-in links, invites and confirmations. It handles the recipient’s email address and name, and the email’s content | United States | | Google Workspace | Our email, including early access requests | United States | **Changes.** We’ll keep this list current. We’ll email workspace owners at least 30 days before adding a new subprocessor, and update this page. Only an emergency, such as a provider outage, can shorten that notice, and then we’ll tell you as soon as we can. If you object, tell us; if we can’t address it, you can close your workspace and we’ll delete your data as section 7 describes. **Others we may share with:** - **At your direction.** When your crew sends a message, updates a record or shares a file through an app you’ve connected, it goes where you told it to. Those apps (for example Gmail, Slack or Google Drive) are governed by your own agreements with their providers. - **Outside agents you connect** (like Claude Code or Codex) receive what they’re given for the work you hand them. Inside Cruma they go through the same permission checks as your own crew; what their providers do with it is governed by their terms. Data a crew member or connected agent sends to other services on your instructions is handled under those services’ terms, not this policy. - **For legal reasons.** When the law, a court or a valid government request requires it, or to protect people’s safety or our rights. Where we can, we’ll tell the affected company first and challenge requests that are too broad. - **In a business change.** If Cruma is merged, acquired or sells assets, information may transfer as part of that deal, under this policy’s protections. ### 6. Who can see what Inside a workspace, each person and each crew member sees only what’s meant for them. When the crew answers in a chat, it uses only what everyone in that chat may see, and lessons in memory reach only the chats they’re meant for. Outside agents you connect go through the same checks as your own crew and see only what they’re given. Cruma staff access workspace content only when needed to support you, keep Cruma secure or meet a legal duty. ### 7. How long we keep it | Information | How long | | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Workspace content, memory and activity records | For as long as the workspace exists. Closing or cancelling doesn’t delete it, so you can ask for an export or come back. Deletion happens on request: when an admin asks us to delete the workspace, we wait 30 days so the request can be cancelled, then delete it | | Backups | Deleted information can stay in our database provider’s backups until they expire on its schedule | | Account details | For as long as the account exists. If you ask us to delete your account, we do so within 30 days | | Records of each crew run (what each step read and wrote) | 90 days | | Records of who read what | For as long as the workspace exists | | Early access requests and emails | Up to 24 months after our last contact, unless you become a customer | We keep something longer only where the law requires it, or to resolve a dispute or enforce our terms. Workspace admins can ask us to erase specific content sooner. Removing a message in Cruma hides it, but it stays in the workspace’s history until it’s erased. ### 8. Where your information goes We’re based in the United States, and our providers may process information in the United States and other countries. When we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we use a recognised safeguard: the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the provider’s certification under the EU–US Data Privacy Framework (and its UK and Swiss extensions) where that applies. You can ask us for a copy of the safeguards we use. ### 9. Security Information is encrypted in transit and at rest by our infrastructure providers. Each workspace is kept separate from every other in the database, every change is recorded with who made it, and reads through Cruma are recorded too. We limit who at Cruma can access production systems. No system is perfectly secure. **If something goes wrong.** If we become aware of a breach that affects personal data we hold for a company, we’ll tell that company’s admins without undue delay, and within 72 hours of confirming it, with what we know and what we’re doing about it. Where we’re the controller, we’ll notify regulators and affected people as the law requires. To report a security issue, write to [security@cruma.ai](mailto:security@cruma.ai). ### 10. Your rights Depending on where you live, you may have the right to: - know what information we hold about you and get a copy, including in a portable format; - correct it, or have it deleted; - object to or restrict how we use it, including for direct marketing; - withdraw consent, where we rely on it; and - complain to your data protection authority (in the UK, the Information Commissioner’s Office; in the EU, the authority where you live or work). **US state privacy laws** (including California’s CCPA as amended by the CPRA, where it applies): you can ask to know, access, correct and delete your personal information. We don’t sell personal information or share it for cross-context behavioural advertising, and haven’t in the past 12 months. We don’t use sensitive personal information to infer things about you. We won’t treat you differently for using your rights. You can use an authorised agent, and we’ll verify requests before acting on them. **How to ask.** Write to [privacy@cruma.ai](mailto:privacy@cruma.ai). We’ll answer within one month (45 days under US state laws), and tell you if we need longer as the law allows. If your request is about content in a company’s workspace, we’ll pass it to that company, which decides how to respond, and help it do so. ### 11. Automated decisions Cruma’s crew carries out work your team gives it, under the permissions your team sets. We don’t use it to make decisions based solely on automated processing that have legal or similarly significant effects on you. If a company uses Cruma in its own processes, it’s responsible for how it uses the results and for human review, as our [Terms](https://cruma.ai/terms) require. ### 12. Cookies and similar technologies - **This website** (cruma.ai) sets no cookies and uses no analytics, advertising or tracking tools. Everything it loads, fonts included, comes from cruma.ai itself. Our hosting provider (Vercel) keeps standard server logs to deliver the site and keep it secure. - **The Cruma app** uses one cookie to keep you signed in, and your browser’s storage to remember preferences on your device (such as light or dark mode, the layout and the last workspace you opened). We don’t use advertising or cross-site tracking there either. If we ever add analytics or other non-essential cookies, we’ll update this policy first and ask for consent where the law requires. ### 13. Children Cruma is for work and isn’t meant for anyone under 16\. We don’t knowingly collect information from children. If you think a child has given us information, write to us and we’ll delete it. ### 14. For companies: our DPA If your company needs a data processing agreement (for example under the GDPR or UK GDPR), write to [privacy@cruma.ai](mailto:privacy@cruma.ai) and we’ll provide one. It covers our processor commitments, subprocessors, transfers, security, breach notice and help with requests from individuals. ### 15. Changes If we change this policy in a way that matters, we’ll tell you by email or in Cruma before it takes effect. The date at the top shows the latest version. ### 16. Contact Cruma, Inc., 262 Chapman Rd, Ste 240, Newark, DE 19702\. Email [privacy@cruma.ai](mailto:privacy@cruma.ai).