Privacy Policy

This Privacy Policy explains what data CRTV DEI LLC ("we") collects when you use CRTV Signatures (the "Service"), how we use it, who we share it with, and what your rights are. We've tried to write this in plain English. Where the law uses specific words ("controller," "processor," "personal data"), we use them too.

1. The short version

• We collect what we need to run the Service: your name, work email, profile photo, signature details, your Workspace's brand kit, and basic billing metadata.
• We don't sell your data. We don't show ads. We don't train AI models on your data.
• We use specific subprocessors (Stripe, Supabase, AWS, Google, Postmark) to operate the Service. They're listed below.
• You can request a copy of your data or have it deleted by emailing hello@crtvdei.com.

2. Who is responsible

The data controller for the Service is CRTV DEI LLC, Virginia Beach, Virginia, USA. You can reach us at hello@crtvdei.com.

For Workspaces with multiple users, your Workspace owner is also a controller of the data their members provide through the Workspace.

3. What we collect

From Google OAuth (when you sign in)

• Your name
• Your email address
• Your profile photo URL
• A unique Google user identifier

From you (when you build your signature)

• Job title
• Phone number
• An optional custom photo you upload
• Any signature fields you complete

From your Workspace owner (applied across your Workspace)

• Workspace name and domain
• Logo, banner image, primary/secondary colors, font choice
• Social media URLs, disclaimer text

From Stripe (when you subscribe)

• Stripe customer ID and subscription state
• Plan, seat count, billing period, payment status
• We do not see or store your card details. Stripe handles payment processing directly.

Automatically (when you use the Service)

• IP address, user agent, request timestamps (in standard server logs)
• Authentication session tokens (stored in your browser's local storage; first-party only)

We do not currently use third-party analytics, advertising trackers, or behavioral cookies. If we add analytics in the future, we will update this Policy and notify Workspace owners.

4. How we use it

• To provide the Service: authenticate you, render your signature, apply your brand kit, and let admins manage their Workspace.
• To bill you: create Stripe customers and subscriptions, process payments, send receipts.
• To send transactional email: invitations, member-approval notifications, and account-related messages.
• To debug and improve: server logs help us diagnose errors and security incidents.
• To comply with law: respond to lawful legal process.

We do not use your data for marketing emails to third parties, advertising, or training AI models.

5. Who we share it with — subprocessors

We use the following subprocessors to operate the Service. Each processes a subset of your data for a specific purpose:

We do not sell personal data. We do not share it with third parties for their independent marketing purposes.

6. Legal bases for processing (EEA/UK users)

Under the GDPR, we process your personal data on the following legal bases:

• Contract performance — to deliver the Service you signed up for.
• Legitimate interests — to operate, secure, and improve the Service.
• Consent — for any processing where we ask for it specifically.
• Legal obligation — to respond to lawful requests and meet legal requirements.

7. Your rights

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to erasure").
• Restrict or object to certain processing.
• Port your data in a machine-readable format.

To exercise any of these rights, email hello@crtvdei.com. We will respond within 30 days.

If you're in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you're a California resident, you have rights under the CCPA — which we honor for all users.

8. Data retention

• While your account is active: we retain Your Content to provide the Service.
• After cancellation: we retain Your Content for a reasonable period (typically 30 days) in case you reactivate, then delete it.
• Billing records: we may retain Stripe customer and subscription records for tax, audit, and legal compliance for up to seven (7) years.
• Server logs: retained for up to 90 days, then rotated.

To request earlier deletion, email hello@crtvdei.com. Note that we do not currently offer self-serve account deletion.

9. Security

We take reasonable steps to protect your data:

• All traffic uses HTTPS / TLS.
• Workspaces are isolated using Postgres row-level security.
• Card details are handled directly by Stripe — we never see or store them.
• We use limited-scope credentials for our cloud services.

No system is perfectly secure. If we discover a security incident affecting your data, we will notify affected Workspace owners by email as required by applicable law.

10. International transfers

We are based in the United States, and our subprocessors are primarily US-based. If you access the Service from outside the US, your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

11. Children

The Service is intended for business use by adults. It is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. For material changes, we will notify Workspace owners by email at least 14 days before the changes take effect.

13. Contact

For any privacy questions, to exercise your rights, or to report a concern:

CRTV DEI LLC
Virginia Beach, Virginia, USA
hello@crtvdei.com