Privacy Policy

This Privacy Policy (“Policy”) explains how Talview Inc. (“Crusible”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with the Crusible platform, the macOS app, the website crusible.dev, our documentation and related services (the “Services”), and the rights you have over it. Capitalized terms that this Policy does not define, such as Customer, User, Agent, Output, Your Content and Secrets, have the meanings given in our Terms of Use.

Crusible is a platform for developing software with AI agents, used by organizations (“Customers”) and the individuals they authorize (“Users”). The Services are for business use, not for personal, family or household purposes.

1. OUR ROLE #

Crusible as controller. Crusible is the controller of the personal data it collects to run its business: account and sign-in details, billing records, website and app usage, support requests, and business communications.

Crusible as processor. Customer Content is the code, repositories, prompts, Agent Output, files, conversations and other material that a Customer and its Users place in or create with the Services. For personal data contained in Customer Content, Crusible acts as a processor for the Customer, under the Customer’s instructions and our Data Processing Addendum (“DPA”). The Customer’s own privacy notice governs that data. If you want to access, correct or delete personal data in a Customer’s workspace, contact that Customer; we will help the Customer respond.

2. PERSONAL DATA WE COLLECT #

Information you give us

• Account data: name, email address, username, profile image, organization, role, and the identifiers of the sign-in provider you use, such as GitHub, Google or Microsoft.
• Billing data: for paid plans, billing contact, company details, tax identifiers and payment records. Card details are handled by our payment processor; we do not store full card numbers.
• Customer Content: as described in section 1, including logs of the actions Agents take in a workspace.
• Secrets: credentials, API keys and tokens that you give the Services so that Agents can reach repositories and connected services. We store Secrets encrypted and make them available only to the workspaces and Agents you designate.
• Communications: what you send us by email or through support, and your contact details.

Information we collect automatically

• Usage and telemetry: the features you use, Agent runtime and resource use, errors, crash reports and performance data from the platform and the macOS app.
• Device and log data: IP address, browser and operating system, app version, timestamps, and the pages and endpoints requested. We treat IP addresses and device identifiers as personal data.

Information from third parties

• Sign-in providers: the profile details that GitHub, Google or Microsoft share with us when you sign in with them, as you authorize.
• Third-Party Services you connect: data that a connected service, such as a code host or chat tool, returns to the Services when an Agent or User uses it. That data becomes Customer Content.
• Customers: a Customer that invites you to its workspace gives us your name and email address.

We do not collect special categories of personal data or government identifiers, and we ask Customers not to put them in Customer Content without our written agreement.

3. HOW WE USE PERSONAL DATA, AND OUR LEGAL BASES #

Where the EU or UK General Data Protection Regulation (“GDPR”) applies, we rely on the following legal bases:

Where we rely on consent, you may withdraw it at any time without affecting processing that took place before you withdrew it. Where we rely on legitimate interests, you may object as section 9 describes.

4. AI AND MODEL TRAINING #

Crusible does not use Customer Content, including code, prompts and Agent Output, to train or fine-tune generative AI models unless the Customer gives us its documented consent. Our AI model providers process Customer Content only to return results to the Services and are contractually prohibited from training on it. We may use aggregated or de-identified usage data that contains no Customer Content to operate, secure and improve the Services.

Where you connect your own account with a model provider, that provider receives the data an Agent sends to it under your agreement with that provider, and its terms and privacy policy govern that data.

Crusible does not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated abuse detection may pause a workspace or an Agent; you can ask for human review by contacting us.

5. HOW WE SHARE PERSONAL DATA #

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only as follows:

• Subprocessors: the vendors that host the Services, run AI model inference, send transactional email and perform web search for Agents. They are listed, with their purpose and location, on our subprocessors page.
• Other service providers: vendors that process our own business data for us, such as our DNS and inbound email forwarding provider (Cloudflare, Inc.), our corporate email and productivity provider, and, for paid plans, our payment processor. They may use the data only to provide their services to us.
• Other members of your workspace: your name, profile and activity are visible to the Customer whose workspace you use and to its other Users.
• Third-Party Services you connect: when you or an Agent use a connected service, the Services exchange data with it on your instruction, under its own terms.
• Affiliates: companies under common control with Talview Inc., to provide the Services under this Policy.
• Legal requirements and protection: where we believe in good faith that the law, a court order or other legal process requires it, or that disclosure is needed to protect the rights, property or safety of Crusible, our users or others, or to enforce our agreements.
• Corporate transactions: in connection with a merger, acquisition, financing, sale of assets or similar transaction, subject to this Policy. We will notify you by email or a notice in the Services before your personal data becomes subject to a different privacy policy.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

6. INTERNATIONAL DATA TRANSFERS #

Talview Inc. is based in the United States. We and our subprocessors process personal data in the European Union (Belgium), in India and in the United States: the control plane, databases and backups run in the European Union, the isolated virtual machines in which workspaces and Agents run are in India, and AI model inference and some service providers are in the United States. Our subprocessors page shows where each subprocessor processes data.

For transfers of personal data out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss equivalents, as incorporated in our DPA and in our agreements with subprocessors, together with supplementary measures such as encryption. You can ask us for a copy of the relevant safeguards at the contact address below.

7. DATA RETENTION #

• Customer Content: kept while the Customer’s account is active. After termination, the Customer has 30 days to export it, and we delete it within a further 60 days. Workspaces on an expired trial may be deleted 30 days after the trial ends.
• Backups: residual copies are deleted on our normal backup cycle and stay protected until then.
• Account and billing data: kept while the account is active and afterwards for as long as tax, accounting and other laws require.
• Logs and telemetry: kept for as long as we need them for security, debugging and service improvement, then deleted or de-identified.
• Communications: kept for as long as needed to handle your request and keep a record of it.

We may keep data for longer where the law requires it, or where we need it to resolve disputes, prevent abuse or enforce our agreements, and we delete or de-identify it when that need ends.

8. SECURITY #

We protect personal data with technical and organizational measures that include encryption in transit using TLS 1.3 and at rest using AES-256, isolated virtual machines for each workspace, encrypted storage of Secrets, least-privilege access controls, and monitoring of the Services for unauthorized access. Our information security practices are audited under ISO 27001 and SOC 2 Type II. Our employees and contractors undergo background checks and periodic privacy and security training. A description of our Security Measures is available on request.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for protecting your sign-in credentials and for using Secrets that are scoped, revocable and, where available, short-lived. To report a security vulnerability, contact us at the address below.

9. YOUR RIGHTS #

Depending on where you live, and subject to the limits the law sets, you may have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Correct inaccurate or incomplete personal data;
• Delete your personal data;
• Restrict our processing of it;
• Object to processing based on our legitimate interests, and to direct marketing at any time;
• Port the personal data you gave us, in a structured, commonly used and machine-readable format;
• Withdraw consent where we rely on it; and
• Complain to a data protection authority, such as the authority in your EU member state (listed by the European Data Protection Board) or the UK Information Commissioner’s Office.

These rights also apply under laws such as Brazil’s LGPD, Canada’s PIPEDA and Singapore’s PDPA where they apply to you. For personal data in Customer Content, contact the Customer first (see section 1).

How to make a request. Email privacy@crusible.dev, or use your account settings where they offer the option. We verify a request by confirming that you control the email address on the account, and we may ask for more information where needed. An authorized agent may make a request for you with your signed permission, and we may ask you to confirm that permission directly. We respond within 30 days where the GDPR applies and within 45 days under U.S. state law, and we will tell you if we need more time, as the law allows. If we decline your request, you may appeal by replying to our decision with the word “Appeal”, and we will answer within 60 days.

We will not discriminate against you for exercising your rights.

10. U.S. STATE PRIVACY RIGHTS #

This section applies to residents of California and other U.S. states with comprehensive privacy laws, such as Colorado, Connecticut, Texas and Virginia. In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 2 and 3:

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information, such as account credentials, only to provide the Services and as the law permits, not to infer characteristics about you. We keep each category for the periods described in section 7.

Subject to the law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing and of targeted advertising and profiling, although we do none of these; and to limit the use of sensitive personal information. Make a request as section 9 describes. We treat a Global Privacy Control signal as a request to opt out of sale and sharing.

11. COOKIES AND SIMILAR TECHNOLOGIES #

The crusible.dev website sets no cookies and uses no third-party analytics, advertising pixels or tracking scripts. It stores one value in your browser, your light or dark theme preference, which never leaves your device.

The Services use cookies and similar storage that are strictly necessary to sign you in, keep your session secure and remember your settings. Our product analytics and error reporting run on infrastructure that we operate, do not use advertising cookies, and do not record your sessions. If we introduce non-essential cookies or third-party analytics, we will update this section first and, where the law requires it, ask for your consent.

12. MARKETING COMMUNICATIONS #

We may send marketing emails about Crusible to the email address on your account or to business contacts who have engaged with us. You can opt out at any time with the unsubscribe link in each email or by emailing privacy@crusible.dev. Service and account notices are not marketing and continue while you have an account.

13. CHILDREN #

The Services are not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will delete it. Customers may not put the personal data of children in the Services without our written agreement, as section 6A of the Terms of Use provides.

14. THIRD-PARTY SITES AND SERVICES #

The Services link to, and let you connect, websites and services that third parties operate. Their own privacy policies govern the personal data you give them or that the Services exchange with them on your instruction. We are not responsible for their privacy or security practices.

15. CHANGES TO THIS POLICY #

We may update this Policy. For a material change, we will notify you by email or in the Services at least 30 days before it takes effect. Other changes take effect when we post them, and the date at the top of this Policy shows when it was last updated. Previous versions are available on request.

16. CONTACT INFORMATION #

If you have questions about this Policy or how we handle personal data, or want to exercise your rights, email us at privacy@crusible.dev.

Talview Inc.,
Suite 100, 1300 El Camino Real
Menlo Park
CA 94025,
USA