CROOMA

Privacy Policy

Last Updated: August 2026

Crooma GmbH (i.G.), Munich, Germany ("Crooma", "we", "us", or "our") operates the platform crooma.cloud. This Privacy Policy outlines how we collect, process, isolate, and secure personal data in accordance with the European Union's General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Relational Sovereignty: Privacy by Architecture

At Crooma, privacy is not a compliance checkbox—it is a load-bearing architectural invariant. Our platform is engineered to keep your business context and customer data completely secure:

Strict 1:1 Tenant Isolation: Every registered workspace is mapped exactly 1:1 to an independent, path-isolated database directory (~/.continuum/<tenantId>/) on disk. Your search queries, metadata, observations, and transcripts are physically separated from all other customers. Cross-tenant leakage is structurally impossible.
Write-Time Privacy Choke-Point: Crooma implements a global, 11-pattern write-time scrubbing engine. Before any observation, git log, document, or transcript is written to your database, it passes through our filter to redact:

Passwords, JWTs, and API credentials (AWS, GitHub, Slack, Google).
Stripe production live keys.
Guest Personal Identifiable Information (PII) including emails, credit card numbers, phone numbers, passport numbers, and IBANs.
These sensitive values are converted into [REDACTED:<LABEL>] tokens before storage, preventing them from entering our vector embeddings or training paths.

Local-First Sovereignty: The core trust engine operates local-first over SQLite and local embedding generation. No raw files or documents are ever transmitted to third-party AI cloud systems; only specific, highly compressed vector query dimensions are sent on an as-needed basis to execute programmatic rendering.

2. Personal Data We Process

When you interact with the Crooma visual shell, we process the following categories of data:

A. Account and Registration Information

When you create a workspace, we store your name, business email address, company profile, and encrypted authentication credentials (managed via Supabase Auth with Row-Level Security).

Purpose: To manage your account, authenticate your sessions, and secure your workspace.
Legal Basis: Art. 6 (1)(b) GDPR (Performance of a contract).

B. Billing and Payment Telemetry

To process paid subscriptions (Pro and Team tiers), we integrate with Stripe, Inc. We do not store credit card or raw bank information on our servers; Stripe securely manages this data. We store only billing indicators, transaction statuses, and invoice references.

Purpose: To process subscription fees, prevent payment fraud, and fulfill statutory tax retention rules under German commercial law.
Legal Basis: Art. 6 (1)(b) GDPR (Performance of a contract) and Art. 6 (1)(c) GDPR (Compliance with a legal obligation).

C. Creative Assets and Metadata

When you upload shoots, photos, or documents to Crooma, we store the physical files on secure cloud servers (Supabase/Vercel). The associated comments, ranks, and selection logs are written as Observations to your isolated Continuum database.

Purpose: To render proofing galleries, coordinate client selections, and optimize content campaigns.
Legal Basis: Art. 6 (1)(b) GDPR (Performance of a contract).

3. Data Sharing and Third-Party Processors

To deliver our services, we share data with trusted sub-processors under strict Data Processing Agreements (DPA) that guarantee GDPR compliance:

Vercel, Inc. (USA / EU): For hosting our visual shell and frontend console.
Supabase, Inc. (USA / EU): For managing secure user authentication, database states, and physical asset storage (with encrypted PostgreSQL RLS).
Stripe, Inc. (USA / EU): For secure credit card processing and billing management.
Fly.io, Inc. (USA / EU): For hosting our containerized, multi-tenant database engine on isolated persistent volumes.

4. Your Rights Under the GDPR

As a resident of the European Economic Area (EEA), you possess absolute rights regarding your personal data under the GDPR:

Art. 15 GDPR (Right of Access): You have the right to request a copy of the personal data we store about you.
Art. 16 GDPR (Right to Rectification): You can correct incomplete or inaccurate data inside your Crooma dashboard.
Art. 17 GDPR (Right to Erasure / "Right to be Forgotten"): You can request the permanent deletion of your account. Because our multi-tenant filesystem isolation is absolute, running a tenant-deletion command (rm -rf ~/.continuum/<tenantId>/) permanently destroys your database partition; it cannot be recovered, satisfying your right to erasure.
Art. 20 GDPR (Right to Data Portability): You can use our CLI tool (continuum authorship export) or Console UI to export a complete, portable JSON/Markdown log of your entire Authorship Ledger and Observations history.
Art. 21 GDPR (Right to Object): You can object to the processing of your data for analytical or marketing purposes.

To exercise any of these rights, please contact our Data Protection Officer at privacy@crooma.cloud.

5. Security Measures

Crooma employs state-of-the-art administrative and cryptographic safeguards to protect your workspace:

Encrypted Transports: All API calls and SSE streams are encrypted using TLS 1.3 (forced HTTPS).
Secure Tokens: Communication with the engine is gated behind robust RS256 JSON Web Tokens (JWT) verified against our public JWKS.
Physical Separation: Multi-tenant database separation ensures that tenant directories are fully isolated on host storage volumes.

← crooma.cloud