Privacy policy

What we collect

Account data: name, email, password (stored only as a hash by our authentication provider), language and workspace memberships.

Workspace data: conversations, messages, contacts, articles, settings and usage records that you and your team add.

Billing data: the payment processor handles card details; we receive the customer and subscription identifiers and the plan status, not the card number.

Technical data: IP address and browser details in server logs and in hashed form for abuse limits, and the widget's origin page.

How we use it

To provide and secure DeltaCrab: sign-in, delivering messages and emails, AI answers you turn on, billing, preventing abuse, and support. We do not sell personal data and do not use it for advertising.

We send service emails, such as trial reminders and alerts about new conversations. You can turn alerts off in your notification settings.

Data you collect from your customers

When your customers write through the widget or by email, you are the controller of their data and DeltaCrab processes it on your instructions to provide the service. Answer their requests about it; we will help you export or delete it.

Providers that process data for us

Supabase (database and authentication, hosted in São Paulo, Brazil), Cloudflare (hosting and network), Stripe (payments), Resend (email delivery) and, only for workspaces that turn AI on, the model provider in use (Anthropic, or OpenAI when the workspace brings its own key).

These providers may process data outside your country. They process it under contracts that require protection consistent with applicable data protection law.

Cookies and local storage

DeltaCrab uses only what it needs to work: a session cookie to keep you signed in, and cookies for your language and theme. The widget keeps a visitor token in the browser's local storage so a conversation continues across pages. We use no advertising or third-party analytics cookies.

Retention and deletion

We keep workspace data while the workspace exists. Deleting a workspace removes its data permanently. You can delete your own account in your profile when you no longer own a workspace.

Abuse-limit records are kept for one day. Server logs are kept for a short period by our hosting provider.

Your rights

You can access, correct, export and delete your data. Most of this is available in the app (profile, data export, account and workspace deletion). For anything else, or to object to a use, write to support@deltacrab.com. Under the LGPD and the GDPR you can also complain to your data protection authority.

Security

Data travels over HTTPS. Every workspace is isolated in the database by row-level security. Secrets such as model keys and identity secrets are encrypted at rest.

Contact

Privacy questions and requests: support@deltacrab.com.