In short
- We collect what we need to run your account and your list builds, and nothing more.
- We never ask for, store or use your LinkedIn login or cookies.
- We don't sell your account data.
- Anyone whose business details appear in a Crwl list can ask to be removed, and we'll stop collecting them.
The data controller is Crwl, Suite 112, 970 Burrard Street, Vancouver, BC V6Z 2R4, Canada.
Data about our customers
| What | Why |
|---|---|
| Name, work email, password (hashed with scrypt), company | To create and secure your account |
| Billing details (card handled by Stripe; we never see the number) | To charge for plans and credits |
| Prompts, uploaded CSVs and lists | To run your searches and deliver lists |
| Usage and device data, cookies | To keep the app working, secure and improving |
API keys are stored only as SHA-256 hashes, so a database leak doesn't expose a working key.
Data about people in lead lists
When a customer runs a search, Crwl collects publicly available business information about professionals and businesses: names, job titles, employers, business locations, public profile URLs, business phone numbers and work email addresses (which we find and verify). We don't collect sensitive categories of data.
Our lawful basis is legitimate interests: helping businesses find relevant professional contacts. We are the controller for account data and a processor for the contact data your lists contain; our customers are responsible for their own lawful basis when they contact people.
How we use data
- Run searches, verify emails and deliver lists.
- Bill accurately, including not charging for invalid emails or empty runs.
- Prevent abuse and keep the Service secure, including rate limits and per-workspace spend caps.
- Send account and product emails. You can opt out of marketing anytime.
Who we share it with
Service providers that help us run Crwl (hosting, scraping and enrichment vendors, email delivery, error reporting, payments) under contracts that limit their use of the data. A current list, with purpose, data seen and region for each, is on our Subprocessors page. We may disclose data when the law requires it.
How long we keep it
- Account data: while your account is open, then deleted within 30 days of closure.
- Lists and their rows: until you delete them or your account closes.
- Job records and search cache: 24 hours. Result files: 72 hours. Uploaded CSVs: 30 minutes in memory.
- Email-verification records: 30 days. Cost ledgers: 24 months, minimised rather than rewritten.
- Records of removal requests: kept so we don't collect that person again.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict processing, and complain to your data protection authority. Email help@crwl.aiand we answer within 30 days. California residents have the rights described in the CCPA/CPRA; we do not sell or share personal information for cross-context behavioral advertising.
Remove yourself from Crwl
Security
TLS 1.2+ in transit, passwords and API keys hashed at rest, plus per-workspace access controls, rate limits and spend caps. See our Security page.
International transfers
Our application servers and Postgres database run in the EU (Falkenstein, Germany). Nightly backups are encrypted and replicated off-box. Where data leaves the EEA or UK, we use the Standard Contractual Clauses or another approved safeguard.
Contact
privacy@crwl.ai · Crwl, Suite 112, 970 Burrard Street, Vancouver, BC V6Z 2R4, Canada. We answer data-protection questions within 30 days.