Privacy Policy

1 Who We Are

Tireless Crew ("we", "us", "our") operates the AI agent platform available at https://app.tirelesscrew.com. We are the data controller for personal data collected through the Service.

This Privacy Policy describes how we collect, use, store, and share your personal data when you use our website and platform. It applies to all users of the Service, including customers, trial users, and visitors.

2 Data We Collect

2.1 Account and Identity Data

When you register for an account, we collect:

• Name and email address
• Password (stored as a one-way bcrypt hash — never in plain text)
• Account role and status
• Social login identifiers (if you register via Google, Facebook, or Microsoft OAuth)

2.2 Billing and Payment Data

We do not store your full credit card numbers. Payment processing is handled by Stripe, which provides us with:

• A Stripe Customer ID linked to your account
• Subscription plan, status, and renewal dates
• Last 4 digits of card and billing email (for display purposes only)

Stripe's privacy practices are governed by Stripe's Privacy Policy.

2.3 WooCommerce Store Data

When you connect your WooCommerce store, we receive data necessary for agent operation, which may include:

• Store URL, consumer key, and consumer secret (stored encrypted)
• Order data, product information, and customer records accessed via the WooCommerce API
• Webhook event payloads sent from your store

We access your WooCommerce data only to execute the agent tasks you configure. We do not aggregate or analyze your store data across accounts.

2.4 Agent Configuration Data

• Agent names, system prompts, and instructions you write
• Tool integrations and credential mappings you configure
• Agent run history, including inputs, outputs, token usage, and feedback
• Agent memory entries created during runs

2.5 Technical and Usage Data

• IP addresses and browser/device metadata (for security and rate limiting)
• HTTP request logs (retained for 30 days)
• Session tokens (stored in Redis, expire after 120 minutes of inactivity)
• Queue job metadata and execution timestamps

2.6 Third-Party Credentials

API keys and OAuth tokens you provide for connected tools (e.g., Google, Slack, Yelp) are encrypted at rest using AES-256 and stored in our database. They are decrypted transiently in memory only during agent execution.

3 How We Use Your Data

We do not use your data for behavioral advertising, do not build advertising profiles, and do not sell or rent personal data to third parties.

4 Legal Basis for Processing

If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases under GDPR:

• Contract performance — processing necessary to provide the Service you subscribed to
• Legitimate interests — security monitoring, fraud prevention, service analytics
• Legal obligation — retaining records required by tax or regulatory law
• Consent — for optional marketing communications, where applicable

5 Data Sharing and Sub-Processors

We share personal data only with the sub-processors necessary to deliver the Service. All sub-processors are contractually bound to appropriate data protection standards.

We do not share your data with analytics advertisers, data brokers, or marketing platforms. We may disclose data to law enforcement or government authorities if required by applicable law, court order, or to protect our legal rights.

6 AI Model Data

When your agents execute, we send prompts and tool call results to the configured AI provider (Anthropic Claude or OpenAI GPT). This may include content from your WooCommerce store, your agent instructions, and tool outputs.

Important: We use the API-only access tier with both Anthropic and OpenAI. Under their API terms, prompt data submitted via API is not used to train their models by default. We do not opt in to any data training programs on your behalf.

You should not configure agents to process or transmit highly sensitive personal data (such as payment card numbers, government IDs, or medical records) through the AI models, as those providers' data handling policies apply to content sent to their APIs.

7 Security

We implement industry-standard technical and organizational measures to protect your data:

• Passwords hashed with bcrypt (cost factor 12)
• Third-party credentials encrypted at rest with AES-256
• All data in transit encrypted via TLS 1.2+
• API access rate-limited and authenticated via bearer token
• Stripe webhook signature verification for all payment events
• HTTP security headers (HSTS, CSP, X-Frame-Options) applied to all responses
• Role-based access controls preventing support staff from accessing credentials

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to [email protected].

8 Data Retention

9 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit processing of your data
• Objection — object to processing based on legitimate interest
• Withdrawal of consent — where processing is based on consent

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete, correct, and opt out of sale of personal information. We do not sell personal information. To exercise your rights, contact us at the address below.

How to Exercise Your Rights

Submit your request by emailing [email protected]. We will respond within 30 days. We may request identity verification before processing sensitive requests.

10 Cookies and Tracking

We use a minimal set of cookies required for Service functionality:

We do not use third-party advertising cookies, tracking pixels, or analytics SDKs that report to external services.

11 Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it promptly.

12 International Data Transfers

Our servers are located in the United States. If you are accessing the Service from outside the US, your data will be transferred to and processed in the US.

For transfers of personal data from the EEA or UK, we rely on standard contractual clauses (SCCs) approved by the European Commission, or other appropriate safeguards as required by applicable law.

13 Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email or by posting a notice in the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Continued use of the Service after the effective date constitutes acceptance of the revised Privacy Policy.

14 Contact Us

For privacy-related questions, data subject requests, or to report a concern, please contact our privacy team:

If you are an EEA resident and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local supervisory authority (data protection regulator).