Privacy Policy

This Privacy Policy explains how Nuvael Labs LLC, publisher of CrowdNod (“we”, “us”), collects, uses, and protects your personal information when you use the CrowdNod testimonial collection platform at crowdnod.com (the “Service”).

1. Information We Collect

We collect the following categories of information:

• Account data: name, email address, password hash, organization name.
• Billing data: billing address and payment metadata (card details are handled by Stripe; we never see or store them).
• Customer-submitted testimonials: text, video, name, email, company, avatar, rating, source URLs, and any optional fields submitted through your forms. We may also store evidence that testimonial-use consent or another usage-rights basis was recorded, including the applicable wording/version and timestamp.
• Usage data: IP address, browser type, pages visited, widget impressions and clicks, and other analytics events.
• Cookies: essential session cookies for authentication and optional preference cookies (e.g., theme). We do not use third-party advertising cookies.

2. How We Use Your Information

• To provide, maintain, and improve the Service.
• To process payments and manage subscriptions via Stripe.
• To send transactional emails (account, billing, security).
• To send product updates if you have opted in.
• To respond to support requests at support@crowdnod.com.
• To enforce our Terms of Service and prevent abuse.

3. AI Processing

We do not use AI to rewrite, edit, or otherwise alter the text of a submitted testimonial. AI is used only in limited, opt-in ways that you trigger yourself: (1) suggesting collection questions when you're building a form, (2) parsing a LinkedIn recommendation you paste in to pre-fill name, title, and company fields, and (3) generating separate marketing copy (e.g. a social post or pull-quote) from a testimonial, at your request — this does not change the testimonial itself. In each case, the relevant text is sent to our AI provider (OpenRouter, using OpenAI's gpt-4o-mini by default) for processing. We do not intentionally use your testimonial content to train CrowdNod models. Provider handling and retention are governed by the provider terms and settings applicable to the service at the time of processing.

4. Data Sharing

We share data only with the following processors:

• Supabase — database, authentication, and file storage hosting (EU/US regions).
• Stripe — payment processing.
• Resend — transactional and campaign email delivery.
• OpenRouter — AI processing for collection-question suggestions, LinkedIn recommendation parsing, and marketing-asset generation.
• Vercel — application hosting and CDN.
• X — when automatic X/Twitter URL import is enabled and you request it, CrowdNod uses the official X API to retrieve the public post and author information needed for that import.

We do not sell your personal data to third parties. We do not share data with advertising networks.

5. Data Retention

We retain account and workspace data while your CrowdNod account remains active, including if a paid subscription is cancelled and the workspace continues on the Free plan. Cancelling a paid subscription does not itself delete testimonials or other workspace content. When you request account deletion, a 30-day recovery period is scheduled before removal of your account and workspace data from active systems. Limited records may be retained where necessary for applicable tax, accounting, fraud prevention, security, disputes or legal obligations, with access restricted and retention reviewed. Backups may persist until their verified rotation or expiration schedules complete. A valid request from a testimonial submitter to remove their published material is handled separately from an account-owner deletion request. Contact support@crowdnod.com for privacy requests.

6. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (right to be forgotten).
• Export your data in CSV or JSON format from the dashboard.
• Object to or restrict processing.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@crowdnod.com or use the data export and deletion tools in your dashboard settings. See also our GDPR Statement.

7. Security

We use industry-standard practices including TLS encryption in transit, encrypted storage at rest, row-level security policies, and least-privilege access controls. No system is perfectly secure. If we discover a personal-data breach, we will investigate, take appropriate mitigation steps, and notify relevant authorities and affected individuals when required by applicable law and within applicable deadlines.

8. International Transfers

CrowdNod and its subprocessors may process data in multiple countries according to the infrastructure locations and agreements in use. We do not currently offer a customer-selected data residency guarantee. Where international transfer safeguards are legally required, we evaluate and use appropriate contractual or other legal mechanisms. Contact support@crowdnod.com for details of applicable subprocessors and transfer arrangements.

9. Children

The Service is not intended for users under 18. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email to account owners at least 14 days in advance. The latest version will always be available at this URL.

11. Contact

Questions about this Privacy Policy? Email support@crowdnod.com.