Privacy Policy

1. Scope of this policy

This Privacy Policy explains how Crazinerd ("we," "us," "our") collects, uses, discloses, and protects personal information in connection with Workpool (the "Service") — whether you are a workspace member, a visitor to our public pages, or someone whose contact details appear in a workspace's data because a Workpool user corresponded with you or added you as a contact. It should be read together with our Terms of Service. If you are a workspace member, your workspace's Owner and Admins are separately responsible for how that workspace uses the Service to process the personal information of its own contacts and customers.

2. Information we collect

2.1 Account and workspace information

Your name, email address, a securely hashed password (never stored or logged in plain text), job title, phone number, timezone, working hours, avatar, and any other profile detail you choose to add. For each workspace: its name, slug, members, role assignments, and administrative/security settings. If you sign in with Apple or Google, we receive your name (where provided), email address, and an account identifier from that provider to create and sign in to your account.

2.2 Connected mailbox information

If you connect a mailbox, we store the IMAP/SMTP server details and credentials, or the access tokens issued by Google or Microsoft when you connect through their sign-in, needed to synchronize it. Credentials and tokens are encrypted at rest using AES-256-GCM and are never displayed in plain text once saved. We synchronize the email metadata and content necessary to display your inbox and, where you enable them, to power AI classification, drafting, summarization, and related features.

2.3 AI provider connections

If you connect a third-party AI provider account, we store what is necessary to route your requests to that provider and to display connection status. That connection is isolated to the workspace that created it and is never shared with or accessible from another workspace.

2.4 Content you create

Projects, tasks, messages and channels, files you upload, documents, calendar events, contacts and companies, forms and their submissions, templates, comments, time entries, and any other content you or your workspace create within the Service.

2.5 Payment information

Subscription and AI credit payments made on the web or from the Android app are handled by PayFast in your browser. Subscriptions and AI credit packs bought in the iOS app are processed by Apple (App Store) and managed through RevenueCat (revenuecat.com), a subscription-management service that receives an anonymous app user identifier (your workspace's ID) and the purchase receipt and transaction details from the App Store. We receive and store confirmation that a payment occurred — amount, plan or credit pack, status, and a payment or transaction reference — but we do not receive or store your full card or bank account details; those are collected and stored directly by PayFast or Apple under their own privacy policies, and RevenueCat does not receive them either.

2.6 Usage, security, and audit information

Login and logout events, administrative actions (such as role changes or member removal), automation activity, and — for platform administrators — impersonation actions, are recorded in an audit log for security, accountability, and abuse prevention. We also record operational data such as request timing, rate-limit counters, and error logs to keep the Service reliable and secure; these logs are not used to build advertising profiles.

2.7 Cookies, local storage, and device information

The web application stores your session's access token in your browser's local storage and, for browser-based sign-in, a refresh token in an HttpOnly cookie scoped strictly to authentication endpoints. We also process standard technical information sent by your browser (such as IP address and user agent) for security, rate-limiting, and diagnostic purposes. We do not use third-party advertising trackers, and we do not sell personal information to data brokers.

2.8 Support and AI-assistant communications

If you email us for support, or use the in-app "Ask AI support" feature, we — and, for that feature, the platform AI provider described in Section 2.9 — receive the content of your message in order to respond to it.

2.9 Content processed by AI features

When an AI feature runs, the content that feature processes — for example, the email being classified, summarized, or replied to, the task or document being drafted or analyzed, or the question you asked — is sent to an AI provider to generate the result. AI features run when you or another workspace member trigger them, and automatically when a connected mailbox syncs new email (to classify it and, if your workspace's AI task setting allows it, to extract tasks from it). If your workspace has connected its own AI provider (Section 2.3), that provider is used. If it has not, or none of its connections is working, we use a platform AI provider that we configure and pay for, which may be Anthropic, OpenAI, Google (Gemini), or Xkiro (xkiro.com), or another AI service we connect through an OpenAI-compatible gateway; usage is then counted against your workspace's AI credits. Each provider handles that content under its own terms and privacy policy. The app asks for your consent before you use AI features, and you can withdraw that consent at any time in AI Assistant settings.

2.10 Device and push notification information

If you allow notifications, we store a push token for your device or browser and its platform (iOS, Android, or web) so we can deliver notifications to it. Mobile notifications are sent through Expo's push service, which passes them to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android); browser notifications are sent through your browser vendor's push service. A notification contains its title, a short message, and a link to the item it concerns.

2.11 Content reports

You can report a chat message from within the app. The report, including the reported message and who sent it, is shared with that workspace's Admins and with Crazinerd staff so they can review it and act on it.

3. How we use information

• To provide, operate, secure, and maintain the Service, including workspace isolation between tenants;
• To authenticate you and enforce role-based access within your workspace;
• To process subscription and AI credit payments and manage billing through PayFast, or through Apple, Google, and RevenueCat for purchases made in the mobile apps;
• To power features you explicitly enable, such as mail sync, AI classification/drafting, and AI-powered support answers;
• To send you notifications you have allowed on your devices or browser;
• To review and act on content reported by users;
• To detect, investigate, and prevent fraud, abuse, and security incidents, including through rate limiting and audit logging;
• To provide customer support, including the logged and notified superadmin access described in Section 6;
• To send you service communications (for example, security notices, billing notices, and password-reset emails) and, where you have not opted out, product updates;
• To comply with legal obligations and respond to lawful requests from public authorities; and
• To analyze aggregated, de-identified usage patterns to improve the Service's reliability and features.

We do not use the content of your connected mailbox or other Customer Data to train any AI model, and we do not sell personal information.

4. Legal bases for processing

Where applicable data protection law requires a legal basis for processing (for example, under the GDPR for users in the EU/UK, or the equivalent conditions for lawful processing under South Africa's Protection of Personal Information Act, 2013 ("POPIA")), we rely on one or more of the following: performance of our contract with you (providing the Service you signed up for); our legitimate interests in operating, securing, and improving the Service, provided those interests are not overridden by your rights; compliance with a legal obligation; and, where required, your consent (for example, for optional marketing communications, or for sending content to AI providers as described in Section 2.9), which you may withdraw at any time.

5. Who we share information with

• PayFast — to process your subscription payment, as your payment processor;
• Apple (App Store) — to process subscriptions and AI credit packs bought in the iOS app, under its own terms and privacy policy;
• RevenueCat (revenuecat.com), our subscription-management processor for in-app purchases — an anonymous app user identifier (your workspace's ID) and the purchase receipt and transaction details, but never your card details;
• Your own connected AI provider (currently Anthropic, OpenAI, or Google, depending on what you connect) — only when you configure that connection, and only the content needed to carry out the AI action, as described in Section 2.9;
• Our platform AI provider (Anthropic, OpenAI, Google, Xkiro, or another AI service we connect, as described in Section 2.9) — when your workspace has no working AI connection of its own, and for the "Ask AI support" feature, only the content needed to carry out the AI action;
• Expo, Apple Push Notification service, Firebase Cloud Messaging, and browser push services — your device's push token and the notification content, to deliver notifications you have allowed;
• Your own connected mail server — to send and receive email exactly as you configure;
• Google reCAPTCHA, where enabled on this deployment, subject to Google's privacy policy;
• Infrastructure and hosting providers who host the servers, database, and backups the Service runs on, acting under confidentiality and data-processing obligations, solely to operate the Service on our behalf;
• Authorized platform administrators (superadmins) — for support purposes, as described in Section 6, always logged and with the account holder notified;
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to that successor assuming the commitments in this policy for previously collected data;
• Law enforcement, regulators, or other third parties — only where required by law, to protect our legal rights, or to protect the safety of our users, our systems, or the public.

We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising.

6. Superadmin access

A limited number of authorized platform administrators can search for an account to provide support and, where genuinely necessary to diagnose or resolve an issue, sign in as that user ("impersonation"). Every such action is permanently recorded in an audit log, and the affected account holder is notified that it occurred — this logging and notification cannot be disabled by us or by the superadmin performing the action. Superadmin status itself is never granted through the ordinary product interface; it requires a separate, deliberate administrative action.

7. Data security

We apply technical and organizational measures designed to protect personal information, including: encryption at rest (AES-256-GCM) for mailbox credentials and AI-provider secrets; secure password hashing (bcrypt) rather than plain-text storage; encryption in transit for traffic to the Service; rate limiting on authentication and other sensitive endpoints to resist brute-force and abuse; role-based access control within each workspace; and permanent, non-disableable logging of administrative and superadmin impersonation actions. No method of electronic storage or transmission is completely secure. If we become aware of a security breach affecting your personal information, we will notify you and, where required, the relevant regulator, in accordance with applicable law.

8. Data retention

We retain personal information for as long as your workspace remains active (or until you delete your account, as described in Section 9), and thereafter for a reasonable period to allow data export (see Section 22 of the Terms of Service), meet legal, tax, or accounting obligations, resolve disputes, and enforce our agreements. Database backups are retained on a rolling basis (currently fourteen (14) days by default) and are then deleted in the ordinary course; audit logs of administrative and superadmin actions are retained for a longer period for security and accountability purposes. When retention is no longer necessary, information is deleted or irreversibly anonymized.

9. Your rights

Subject to applicable law, you may have the right to: access the personal information we hold about you; correct inaccurate or incomplete information; request deletion of your information; object to or request restriction of certain processing; receive a portable copy of information you provided to us; and withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before that withdrawal. To exercise any of these rights, contact us at hello@crazinerd.com. Where you are a member of a workspace rather than its Owner or Admin, some requests concerning workspace content (for example, deleting a record a workspace maintains about you) may need to be directed to that workspace, since the workspace administers its own data as set out in Section 1.

You can delete your account yourself, in the mobile app (Settings > Delete account) or on the web (in Settings), or by asking us at hello@crazinerd.com. Deleting your account also deletes any workspace in which you are the only member; if you are the sole Owner of a workspace that has other members, you must first transfer ownership to another member. Deleted information is removed from our active systems and from backups as they roll over, as described in Section 8. More information is available at workpool.crazinerd.com/delete-account.

9.1 South Africa (POPIA)

If POPIA applies to the processing of your personal information, you have the rights described above as a data subject under POPIA, including the right to lodge a complaint with the Information Regulator of South Africa if you believe your information has been processed unlawfully. You can reach our Information Officer at hello@crazinerd.com for any POPIA-related request.

9.2 European Economic Area, UK, and Switzerland (GDPR)

If the GDPR or UK GDPR applies to you, you have the rights described above as a data subject, and you have the right to lodge a complaint with your local data protection supervisory authority. Where required, we act as a data processor on behalf of a workspace for the Customer Data that workspace controls, and as a data controller for account and billing information we hold in our own right.

9.3 Other jurisdictions

If another privacy law grants you specific rights not otherwise described here, we will honor requests made under that law to the extent it applies to you; contact us using the details in Section 13 and we will respond according to the timelines that law requires.

10. Cookies and similar technology

We use local storage and a session cookie strictly for authentication — keeping you signed in and, for browser clients, securely storing your refresh token. We do not use third-party advertising or analytics cookies, and we do not respond differently to browser "Do Not Track" signals because we do not engage in the cross-site tracking those signals are designed to address. If Google reCAPTCHA is enabled on this deployment, Google may set its own cookies when the widget loads, governed by Google's own privacy policy.

11. Automated processing

Where you enable AI classification, drafting, or extraction features, the Service uses automated processing to suggest classifications, draft text, or extracted tasks. A drafted reply is not sent until a person sends it, and a suggested task is not created until a person approves it unless your workspace has chosen an automatic AI task setting, in which case tasks may be created automatically and can be edited or deleted like any other task. These features do not make a decision producing legal or similarly significant effects about you without human involvement.

12. Children's privacy

The Service is intended for business use by adults and organizations and is not directed at children. We do not knowingly collect personal information from children under the age required for consent to data processing in their jurisdiction. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to investigate and delete it.

13. International data transfers

Depending on where the Service is hosted and where you, your workspace, and your contacts are located, your personal information may be processed in a country other than your own, which may have different data protection laws. Where we transfer personal information across borders, we take steps required by applicable law to protect it, which may include contractual safeguards with the recipient.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Service or our practices. We will update the "Last updated" date above and, for material changes, make a reasonable effort to notify you — for example, by email or an in-app notice — before the change takes effect. Your continued use of the Service after a change takes effect constitutes your acceptance of the updated policy.

15. Contact us

For any question about this policy, to exercise a privacy right, or to reach our Information Officer for POPIA purposes, email hello@crazinerd.com.