Last Update: April 29, 2026
This Cruva Privacy Policy explains our use of personal information made available to us when you log into and use our application, knowledge materials, support channels, websites, and other services we make available (the “Platform”).
Welcome
We designed the Cruva Platform with privacy in mind. Surgify Inc. and our related entities (“we,” “us,” “our,” or “Cruva”) respect privacy rights. This Policy describes how we and the Platform collect, use, disclose, retain, and protect information. Capitalized terms used but not defined in this Policy are defined in our Terms of Service (“Terms”).
Cruva helps Brands design campaigns and message templates for creator outreach, message Affiliates on Stores through Cruva, and track outreach and campaign results on Stores through Cruva APIs and analytics online. Among other Stores, Cruva supports the TikTok Shop.
Please read this Policy before you use the Platform. By logging into and using the Platform, you acknowledge this Policy applies to you and accept our Terms of Service.
If you do not agree to this Policy and the Terms, you must not access or use the Platform.
The Basics
At the outset, you should know that:
- We collect and process limited personal information, such as information in your user account, profile, campaign settings, message templates, Affiliate outreach messages, support requests, and usage of the Platform.
- We collect and process business information you or your organization provide or generate through the Platform.
- We do not sell personal information.
- We do not share personal information for cross-context behavioral advertising through the Platform.
- If you connect TikTok Shop, we process information from that connection only as needed to provide the TikTok Shop integration and related Cruva analytics online.
Updates to This Policy
As the Platform changes, we may update this Policy. If we materially change how we use personal information, we will provide notice before the changes take effect, typically by email, Platform notice, or other means required by law.
You are responsible for reviewing the Last Update date periodically and staying aware of the current Policy.
Contact Us
You may contact us regarding the Platform or this Policy through support@cruva.com">support@cruva.com and any other channels designated in your applicable Order Form.
Info We Collect and How We Use It
This table describes the information we collect, how we collect it, why we use it, the legal bases and purposes for our use, and general retention periods. We may also deidentify and aggregate information, which we may use to improve the Platform, develop services, operate analytics, and support business reporting.
Type and Description | How We Collect It | Why We Use It | Retention |
|---|---|---|---|
Account information: name, business email, company, role, user settings, authentication details, and account status. | Directly from you, your organization, or sign-in providers you choose to use. | To create accounts, authenticate users, administer the Platform, provide support, send service notices, and maintain security. | For the account term and for a reasonable period after closure, or longer where needed for legal, tax, accounting, security, or dispute purposes. |
Campaign information: campaign names, campaign settings, selected products or shop context, Affiliate lists, Affiliate handles, Affiliate contact details, outreach statuses, tags, and notes. | Directly from users and from Platform activity. | To help you design and manage Affiliate outreach campaigns and track campaign activity. | For the account term and for a reasonable period after closure, unless earlier deletion is required by law or contract. |
Message template and outreach information: message templates, drafts, sent messages, replies, delivery status, user notes, and related communications through Cruva. | Directly from users, recipients, and Platform communications. | To send and manage Affiliate outreach through Cruva, maintain communication history, provide support, and improve message workflows. | For the account term and for a reasonable period after closure, or as needed for dispute, security, legal, or compliance purposes. |
TikTok Shop integration information: shop identifiers, product listing context, Affiliate outreach context, campaign status, campaign performance signals, order-related campaign context, and data needed to show results in Cruva analytics online. | From your enabled TikTok Shop connection and related Platform activity. | To provide the TikTok Shop integration, connect campaign activity to relevant shop context, troubleshoot integration issues, and display analytics online. | For as long as the integration is active and for a reasonable period afterward, or longer where needed for legal, tax, accounting, security, or dispute purposes. |
Analytics and results information: outreach activity, Affiliate responses, campaign status, engagement events, performance summaries, dashboard views, and reporting outputs. | From Platform activity, user inputs, Affiliate communications, and enabled TikTok Shop integration data. | To provide Cruva analytics online, show campaign results, measure outreach performance, and improve reporting. | For the account term and for a reasonable period after closure, or as otherwise required by law or contract. |
Billing and order information: order form details, plan, fees, invoices, payment status, tax information, billing contacts, and payment-provider tokens or records. | Directly from you, your organization, and payment providers. | To administer order forms, process payments, manage renewals, maintain accounting records, and enforce payment terms. | As required for tax, accounting, audit, legal, and contract purposes. |
Support information: support requests, troubleshooting details, feedback, call notes, and correspondence. | Directly from you, your organization, and Platform support interactions. | To respond to requests, troubleshoot issues, improve the Platform, and maintain customer records. | For the time needed to provide support and maintain business records, or longer where needed for legal, security, or dispute purposes. |
Usage, device, and log information: IP address, browser and device information, approximate location from IP address, feature usage, timestamps, error logs, audit logs, and security events. | Automatically when users access the Platform or related websites. | To operate, secure, monitor, debug, and improve the Platform; prevent fraud and abuse; and maintain audit records. | For a limited period appropriate to security, operations, and audit needs, or longer where required for investigation, legal, or compliance purposes. |
Website and cookie information: website visits, cookie identifiers, preferences, and similar technical information. | Through cookies, pixels, local storage, server logs, and similar technologies. | To operate websites, remember preferences, measure performance, understand usage, and improve visitor experiences. | Based on cookie duration, browser settings, and operational need. |
Google OAuth Data for Email Campaigns | Directly from users through an Oauth consent form | We use your Google OAuth data solely for sending and managing outgoing emails on your behalf and will not use it for any other purposes. | We collect the app token and refresh token to send, manage, and track your outgoing emails. Solely to facilitate your email campaigns and is not used for any other purpose. Deleted immediately upon disconnection of your Google account or termination of your Cruva account. |
Information Storage and Security
We use commercially reasonable security technologies and procedures to help protect personal information from unauthorized access, use, or disclosure. However, no system is completely secure, and you provide information at your own risk.
We receive, store, and process information in the United States. Where we use service providers, they may process information in other locations consistent with this Policy and applicable law.
Our Disclosures of Information
This section describes the ways Cruva discloses information.
We do not sell, trade, rent, or share personal information for cross-context behavioral advertising through the Platform.
We may disclose personal information with your consent or at your request.
We rely on service providers to operate the Platform. These service providers may process information only to provide services to Cruva. They may include hosting providers, security providers, analytics providers, payment providers, customer support providers, email and messaging infrastructure providers, and professional advisors.
If you enable the TikTok Shop integration, information may be exchanged through that connection as needed to provide the integration and related analytics.
If you use the Platform on behalf of an organization, information in your account may be visible to that organization and its authorized users according to account settings and permissions.
We may disclose information where required or appropriate for legal, tax, regulatory, accounting, security, anti-fraud, or rights-protection purposes, including in response to lawful requests by public authorities.
In connection with a reorganization, merger, financing, acquisition, sale of assets, or similar transaction involving Cruva, we may transfer personal information to the buyer, surviving entity, or assignee.
How Long We Keep Your Information
We maintain information for the time necessary to fulfill the purpose for which it was collected, as generally described in this Policy. Longer retention may be required for legal, tax, accounting, regulatory, security, contract, or dispute purposes.
Our retention determinations consider the amount, nature, and sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; and whether we can achieve the purpose for which it was collected without continuing to use the information.
No Children
Only adults are eligible to use the Platform, as described in our Terms. We do not knowingly collect personal information about anyone under the age of 18. If we learn that we collected personal information from a child, we will promptly delete it.
How to Control Your Privacy
You have certain choices regarding how we treat personal information.
You may review and request changes to account information by using Platform settings or contacting us.
You may opt out of promotional marketing communications by using unsubscribe instructions or contacting us. We may still send non-promotional communications, such as messages about your account, security, billing, legal notices, or ongoing business.
If you have rights under local privacy laws, follow the instructions below to exercise them.
International Data Transfers
We receive and process information in the United States. By providing information to us, you acknowledge that we may process it in the United States and other locations where we or our service providers operate.
If we transfer personal data subject to GDPR or similar law outside the originating jurisdiction, we use appropriate transfer mechanisms where required.
Requesting Information
To exercise any rights described in this Policy, contact us through the contact information made available in the Platform or your applicable order form. Your request should provide enough information to identify you and the law that applies to you, such as your name, email address, mailing address, or other information we maintain.
Do not include social security numbers, driver’s license numbers, third-party account numbers, credit or debit card numbers, health information, or other sensitive information in a privacy request unless we specifically ask for it.
We verify requests by confirming the source of the request and matching submitted information to information we maintain. If your request is unclear or we cannot verify your identity, we may ask for more information or deny the request in whole or in part.
We will respond as quickly as reasonably possible and in accordance with applicable law. We may be unable to provide or delete information where disclosure would create security risk, where retention is required or permitted by law, or where information is needed for legal, security, accounting, dispute, or contract purposes.
Where applicable law provides an appeal right, you may appeal our decision by contacting us.
Information About Local Privacy Laws
The Platform operates from the United States, but this Policy applies worldwide. Your rights and choices depend in part on the law where you live. If a local privacy law applies to you, that law controls over contrary descriptions in this Policy.
Information for EU, UK, and Swiss Residents
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may have rights under applicable law regarding personal data. We process personal data when we have a legitimate interest, when processing is necessary to perform a contract, when processing is necessary to comply with law, or when you give consent. You may withdraw consent at any time where consent is the basis for processing.
Your rights may include access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You may also have the right to lodge a complaint with your local data protection authority.
Information for Users in Canada
Canadian users may have rights under applicable Canadian privacy laws, including rights to access, correct, and withdraw consent where applicable. You may exercise those rights by contacting us.
Information for Users in Certain U.S. States
If you are a resident of California, Colorado, Connecticut, Utah, Virginia, or another state with a similar privacy law, you may have additional rights that you or your authorized agent can exercise by contacting us. These rights may include the right to know, access, correct, delete, receive a copy of certain information, opt out of certain processing, appeal decisions, and not be discriminated against for exercising privacy rights.
We do not sell or share personal information as those terms are defined under California privacy law. We do not use or disclose sensitive personal information for purposes that would require a right to limit under California privacy law.
We collect the categories of personal information described in this Policy for the business and commercial purposes described in this Policy. We disclose information to service providers and other recipients as described in Our Disclosures of Information. We retain information as described in How Long We Keep Your Information.