Privacy policy

Updated 27 October 2026

Who we are

crew.bot is made and run by Eikal Limited, a company registered in Kenya, of Nairobi, Kenya ("we"). Eikal Limited is the data controller for the personal data described here. Questions or requests go to [email protected].

What we keep

• Visiting our website: our server records each page request: the page, the time, the IP address and its country, the browser, and the page that linked to ours, to count visitors and stop abuse. We delete these records after eight weeks.
• Your account: your name, email address and a hashed password. We never store the password itself.
• Your workspace: what you and your team put in it and what the crew makes for you, such as chats, tasks, jobs and their steps, files, memory, playbooks and routines.
• Connections: logins, keys and tokens for the systems you connect (servers, routers, databases, apps). These are encrypted with AES-256-GCM.
• Sign-ins to websites: when you sign the crew's browser in to a site, you type the password into the site yourself. We keep the site's cookies so the crew stays signed in. We don't keep the password.
• Usage: which models each job used and what it cost, so we can enforce budgets, plan limits and bill.
• Payments: your plan, what you paid and when, and the receipt. If you pay by card, Paddle takes the card details and we never see or keep them: we get your name, email address, country and what you bought from Paddle. If you pay with M-Pesa, we keep the phone number that paid and the M-Pesa receipt.
• Where you sign in from: the IP address and the country it's in when you sign in, to spot sign-ins that aren't you and to stop abuse.
• Cookies: one sign-in cookie and one that remembers your workspace. No advertising or tracking cookies, and no third-party analytics.

Why we use it

• To provide crew.bot to you (our contract with you): your account, your workspace, the jobs you give the crew, your plan and its payments.
• Our legitimate interests: keeping crew.bot secure, stopping fraud and abuse, and fixing problems. We weigh these against your rights, and you can object.
• Your consent: connecting Gmail, Calendar or another account, and the Mac app's control of your computer. You can withdraw it at any time by disconnecting.
• The law: keeping payment and tax records, and answering lawful requests.

Gmail, Calendar and other Google data

If you connect Gmail, crew.bot asks Google for permission to read, organise and send email on your behalf (the gmail.modify and gmail.send scopes), and for your email address. If you separately connect Calendar, it asks to check availability and manage events (the calendar.freebusy and calendar.events scopes). Calendar can create a Google Meet link as part of a meeting you approve.

• We keep separate encrypted Gmail and Calendar refresh tokens. Short-lived access tokens are cached in server memory. We don't copy your entire mailbox or calendar. Messages and events are fetched from Google when a job you started or scheduled needs them.
• The crew uses your email only to do what you asked: search, read, summarise, draft, send, mark as read or unsubscribe. Sending an email or unsubscribing requires your approval in crew.bot.
• The crew checks Calendar availability and upcoming events when asked. Creating a meeting, inviting attendees or adding a Meet link requires your approval in crew.bot.
• To do that work, relevant email and event content may be sent to the AI model provider your workspace uses (see below). It isn't used for advertising, sold, or used by us to train AI models.
• People can't read your Google content, except where you ask us to for support, it's needed for security, or the law requires it.
• You can disconnect Gmail or Calendar from Apps in crew.bot. This deletes that connection's stored token. You can also remove crew.bot's whole grant in your Google Account settings.

crew.bot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who else handles your data

The crew relies on a few providers to do its work. Each gets only what a job needs:

• AI model providers, such as Anthropic and DeepSeek, and others if your workspace chooses them (OpenAI, xAI, OpenRouter). They receive the instructions and the material a job needs, under their API terms.
• TypeSafe AI, in the United States, answers some of the crew's yes/no and pick-one questions (such as which bot should answer a message) for workspaces on crew bot's own models. It receives the part of the conversation or job the question is about, and doesn't train on it.
• Search providers receive the search terms when the crew searches the web.
• Google or Zoho, if you connect their mail or calendar.
• Paddle.com, our reseller and the Merchant of Record for orders paid by card. Paddle handles the checkout, your card details, tax and receipts under its own privacy notice, and tells us what you bought.
• Safaricom, if you pay with M-Pesa: it receives the phone number and amount to send the payment prompt.
• Our hosting provider, which runs the servers crew.bot lives on, and Cloudflare, which carries traffic to our website and keeps it safe.
• Our professional advisers, such as accountants and lawyers, where they need it, and authorities where the law requires it.
• Systems you connect. When the crew works in one of your systems, that system sees what it does there.

We don't sell personal data, and we don't share it for advertising. We may disclose data if the law requires it.

Your computer

If you install the crew.bot app on your Mac, the crew can see your screen and use the mouse and keyboard while it does a job, after you grant macOS permission. You can watch it work and take back control. It only controls someone else's Mac when that person has agreed.

How long we keep it

We keep your workspace for as long as your account is open. You can delete chats and other items yourself at any time. When you ask us to close your account, we delete your workspace and account data within 30 days, except for anything we must keep by law. Payment records are kept for as long as tax law requires, which in Kenya is at least five years.

Where your data goes

crew.bot's servers, and some of the providers above, may be in a different country from you. When your data leaves your country, we rely on safeguards the law recognises, such as the provider's data protection terms or standard contractual clauses, so it stays protected.

Your rights

Under Kenya's Data Protection Act, 2019, and similar laws elsewhere, such as the GDPR, you can ask to see the personal data we hold about you, to correct it, to delete it, to have a copy to take elsewhere, to limit or object to how we use it, and to withdraw any consent you've given. Email [email protected] and we'll reply within one month. You can also complain to Kenya's Office of the Data Protection Commissioner, or to the data protection authority where you live.

Security

Secrets are encrypted at rest. Connections use HTTPS or SSH. Each workspace's data is kept apart from every other workspace's. No system is perfectly secure. If a breach affects your data, we'll tell you without undue delay.

Children

crew.bot is for businesses and adults. It isn't meant for anyone under 18.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in crew.bot or by email first.