Crittiks Privacy Policy

Last updated: Pending legal review: [DATE OF PUBLICATION]

2.1 Who we are

Crittiks is operated by Crittiks Group Pty Ltd (ABN 55 654 097 784) ("Crittiks", "we", "us"). We provide the Crittiks business platform at os.crittiks.com and the website at crittiks.com. You can contact us about privacy at Pending legal review: [[email protected]] or at Pending legal review: [POSTAL ADDRESS]. Pending legal review: [ASH: confirm the contact email and postal address.]

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Pending legal review: [LAWYER: confirm APP entity status or voluntary compliance.]

2.2 Two kinds of information

Information about our customers and users. When a business signs up for Crittiks, or a person uses Crittiks, we collect information about them to run the service. For this information we decide how it is used, and this policy applies in full.

Information our customers put into Crittiks. Our customers store their own business information in Crittiks, including personal information about their contacts, their clients, their team and the people they send agreements to. We hold and process that information on our customer's behalf and on their instructions. Our customer decides what goes in, why, and how long it stays, and is responsible for their own privacy obligations to those people. If you are a contact of one of our customers and want to access or correct your information, please contact that business first; we will help them respond.

2.3 What we collect

Customer content can include contact and company records, deals, quotes, invoices and payment records, documents and files, agreements and signatures, messages and attachments, meeting details, calendar events, tasks and projects, and emails synced from a connected mailbox that relate to the customer's contacts.

Electronic signatures. When someone signs a document through Crittiks, we record the evidence needed for the signature's audit trail: the signer's name, email address, signature image, optional phone number and job title, the time, their IP address, their browser and device, and, only if they allow it, their approximate location. This evidence is printed on the Certificate of Completion attached to the signed document and is kept with it.

Sensitive information. Crittiks is not designed to collect sensitive information such as health information. Customers should not store it in Crittiks unless they have a lawful basis and appropriate consent. Pending legal review: [LAWYER: consider whether to prohibit certain categories in the Terms.]

2.4 How we use information

We use information about our customers and users to:

• provide, operate, secure and support Crittiks, including signing in, sending the emails the service sends, and running connected integrations you choose to turn on;
• process payments for Crittiks subscriptions and manage billing;
• keep the service secure, including detecting misuse, fraud and security incidents, and keeping audit records;
• improve and fix the service, using usage and error information;
• communicate with you about your account, changes to the service or these terms, and, where permitted, product news you can opt out of;
• meet legal obligations and enforce our terms.

We use customer content only to provide the service to that customer and as they instruct, for example to send their invoices, sync their accounting system or deliver their messages. We do not sell personal information, and we do not use customer content to train artificial intelligence models.

2.5 AI features

Some Crittiks features use artificial intelligence, for example drafting task lists from a brief or writing a description. When you use these features, the text you provide and the related workspace information needed for the request are sent to our AI provider, Anthropic, to generate the result. Anthropic processes the request on our behalf and does not use it to train its models under our commercial terms. Pending legal review: [LAWYER: confirm against Anthropic's current commercial terms.] Workspace owners can control which team members can use AI features.

2.6 Connected services and Google user data

Customers and users can connect third-party services. When you connect one, we receive and store (encrypted) only what is needed to run that feature:

• Email mailboxes (for example Gmail, Outlook or other IMAP mailboxes), through our provider Nylas: we read messages exchanged with the contacts in your Crittiks workspace, so they appear on those contacts' records, and we send the emails you send from Crittiks. We track opens, clicks and replies on emails sent from Crittiks where you use that feature. Messages with people who are not your contacts are not stored.
• Calendars and video meetings (Google Calendar and Google Meet, Microsoft Outlook and Teams, Zoom): we read your primary calendar's events so they appear on your Crittiks calendar (visible only to you), and create, update and cancel meetings you schedule in Crittiks.
• Accounting (Xero, QuickBooks): we send your customers, invoices and payments to the accounting organisation you connect, and read back payments recorded there.
• Payments (your own Stripe account): your customers pay your invoices through your Stripe account; we record the payment against the invoice.

You can disconnect any of these at any time from Crittiks, which stops our access and deletes the stored access tokens.

Google API Services. Crittiks' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing calendar and meeting features you request; we do not use it for advertising, we do not sell it, we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where the data is aggregated and anonymised; and we do not use it to train AI models. Pending legal review: [LAWYER: this paragraph is required by Google for verification; keep it substantively intact.]

2.7 Who we share information with

We share personal information only:

• with service providers that host and run Crittiks for us, listed in Section 4 (sub-processors), under contracts that require them to protect it and use it only for our purposes;
• with services you choose to connect, as described in Section 2.6;
• within a customer's workspace, according to the access settings the workspace owner chooses, and with a customer's own clients where the customer shares information through the client portal;
• where required by law, a court or a government authority, or to protect the rights, safety or property of Crittiks, our customers or others;
• in connection with a sale, merger or restructure of our business, subject to this policy.

2.8 Storing and sending information overseas

Crittiks' main database and application run in India (DigitalOcean, Bangalore). Uploaded files are stored in Singapore (DigitalOcean). Some of our service providers process information in the United States, Japan and other countries, as listed in Section 4. We take reasonable steps, including contractual terms, to make sure these providers handle personal information consistently with the Australian Privacy Principles. By using Crittiks you acknowledge that your information will be stored and processed outside Australia. Pending legal review: [LAWYER: check whether reliance on consent under APP 8.2(b) is appropriate, or whether to rely on the accountability approach alone.]

2.9 Security

We protect information with measures including: encryption in transit (HTTPS); encryption at rest of stored secrets, access tokens and integration credentials; passwords stored only as secure hashes; one-time links (such as signing and invoice links) stored only in hashed form and set to expire; strict separation of each customer's data at the database level; role-based and feature-level access controls set by each workspace owner; optional two-factor authentication; audit records of security-relevant actions; and restricted access to production systems. No system is perfectly secure; if we become aware of an eligible data breach we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will notify affected customers without undue delay.

2.10 How long we keep information

• Account information for as long as the account is active and for a reasonable period afterwards to meet legal, tax and accounting obligations Pending legal review: [LAWYER: set periods, for example seven years for billing records].
• Customer content for as long as the customer keeps it in Crittiks. When a workspace owner deletes the workspace, it enters a 14-day grace period in which it can be restored, after which we delete its data and files, except where the law requires us to keep something.
• Signed agreements and their audit evidence are kept with the customer's workspace so the record remains complete; they are deleted with the workspace.
• Activity and audit logs are kept for Pending legal review: [365] days and then deleted. Pending legal review: [ASH/LAWYER: confirm.]
• Backups are overwritten on a rolling basis and are not restored except to recover the service.

2.11 Your choices and rights

You can access and update your profile, change your email address and password, see and end your active sessions, and turn two-factor authentication on or off from your account settings. A workspace owner can export all of the workspace's data and delete the workspace. You can delete your own account unless you are the only owner of a workspace.

You can ask us to access or correct personal information we hold about you by contacting Pending legal review: [[email protected]]. We will respond within a reasonable time, usually 30 days. If your request concerns customer content held by one of our customers, we will refer you to that customer, as they control it.

You can opt out of marketing emails at any time using the link in the email. Service emails, such as security and billing notices, are part of the service.

2.12 Complaints

If you have a concern about how we handle personal information, contact us first at Pending legal review: [[email protected]]. We will investigate and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

2.13 Customers outside Australia

Pending legal review: [LAWYER: if Crittiks will accept customers in the European Union or United Kingdom, add a section covering the legal bases for processing, data subject rights, international transfer mechanisms (for example standard contractual clauses) and a data processing agreement. If not, consider stating that the service is intended for businesses in Australia and the Asia-Pacific.]

2.14 Cookies

Crittiks uses essential cookies to keep you signed in and to protect the service. We do not use advertising cookies in the platform. Pending legal review: [ASH: if the marketing website crittiks.com uses analytics or advertising cookies, list them here.]

2.15 Children

Crittiks is a business service and is not intended for anyone under 18.

2.16 Changes

We will update this policy when our practices change and post the new version here with a new date. If a change is significant, we will notify workspace owners by email or in the service before it takes effect.