Crevyro
Privacy Policy — previous version
Crevyro for Creators is operated by Sahil Yadav in India. This policy describes the production configuration supplied with the service. Actual third-party settings and retention must continue to match this notice.
1. Scope and operator
This policy explains how Crevyro for Creators (“Crevyro”, “we”, “us” or “our”) processes personal data when a creator or business visits the website, signs in, purchases a subscription, connects an Instagram professional account, creates automations, uses the shared inbox or contacts support. The data-contact and grievance email is srao2445@gmail.com.
2. Information we process
- Account data: Firebase user ID, account email, sign-in provider, display name, profile image when available, email-verification state, workspace ID, account status and administrator actions.
- Instagram connection data: professional-account IDs, username, profile details, encrypted access tokens, token-expiry information and connection status.
- Interaction data: comments, messages, Instagram-scoped user IDs, timestamps, media IDs, reply content, captured email addresses, follow-verification status and conversation history needed to run customer-configured automations.
- Automation and operations data: rules, keywords, actions, execution results, retry attempts, webhook identifiers, rate-limit counters, usage totals, monitoring incidents, security logs and support tickets.
- Billing data: subscription state, billing-cycle dates, amount, currency, invoices, refunds, failed-payment status and Razorpay customer, subscription, payment and refund identifiers. Crevyro does not store complete card, bank or UPI credentials.
- Technical data: request time, endpoint, browser-provided metadata and limited network/security information used to prevent abuse and diagnose failures.
3. Why we process data
We process data to provide and secure the service; authenticate users; isolate workspaces; connect Instagram accounts; receive and de-duplicate webhooks; deliver requested replies; verify configured follow actions; capture requested email submissions; run delayed follow-ups; enforce per-minute and per-hour fair-use limits; manage subscriptions; provide customer support; detect failures; prevent fraud; satisfy legal obligations; and establish, exercise or defend legal claims.
4. Workspace architecture and access
Customer records are stored in a shared Cloudflare D1 database and logically isolated using a unique workspace_id. A separate physical database is not created for each customer. Authenticated APIs derive workspace access from the verified Firebase identity. The operator may access limited account, usage, billing, support and incident information where required to operate or secure the service.
5. Service providers and international processing
Data may be processed by Google Firebase for authentication and hosting, Cloudflare for Workers, D1 and Queues, Meta/Instagram for account authorisation and messaging APIs, Razorpay for payments and subscriptions, and Resend or an operator-configured webhook for optional operational notifications. These providers may process information outside the customer’s state or country under their own terms and safeguards. We do not sell Instagram conversation data or use it to build unrelated advertising profiles.
6. Security
Production controls include encrypted Instagram tokens and protected platform credentials, webhook-signature validation, tenant-aware authorisation, idempotent event claiming, durable queues, retry and dead-letter handling, rate limiting, audit records and owner-only administration. No internet service is completely secure, so customers must protect their Google and Meta accounts and report suspected compromise promptly.
7. Retention
- Instagram inbox conversations and messages stored by Crevyro are retained for the most recent 30 days. The inbox is not capped to 20 conversations; it can paginate through all retained conversations.
- Only the newest 20 notifications and newest 20 activity-log entries are retained for each workspace.
- Support tickets are retained while open. Tickets shown as closed, including legacy resolved tickets, and their threaded messages are automatically deleted after 2 days.
- Active workspace, automation and contact data required to operate the service is retained while the account is active, unless the customer deletes it sooner or a longer period is required for security, dispute resolution or law.
- Completed webhook inbox and event-deduplication records are ordinarily removed after 30 days.
- Temporary failed jobs and dead-letter payloads are ordinarily removed after resolution or within 90 days.
- Usage, security and audit records may be retained for up to 18 months.
- Billing, refund, tax and transaction records may be retained for the period required by applicable accounting, tax, payment and legal obligations.
- After account deletion, active application records are deleted promptly. Encrypted backups or provider logs may persist for up to 90 days before normal rotation, unless preservation is legally required.
8. Your controls and rights
Workspace owners can disconnect Instagram and permanently delete the workspace and Firebase identity from Account & data. Account deletion first cancels any active Razorpay subscription to prevent a later renewal. Depending on applicable law, a person may also request access, correction, completion, erasure, withdrawal of consent or grievance resolution by emailing srao2445@gmail.com. We may request reasonable verification and will normally acknowledge a grievance within 48 hours and aim to resolve it within 30 days.
9. Instagram users
An Instagram user may ask the connected creator/business to remove their interaction data or contact us directly with the relevant Instagram username, business account and approximate interaction date. Never send a password or access token. We may coordinate with the workspace owner and retain only the minimum record needed to document the request or comply with law.
10. Children
Crevyro is intended for businesses and creators who can lawfully enter a contract. It is not directed to children. Customers must not knowingly use automations to collect children’s personal data without all permissions and safeguards required by applicable law and platform rules.
11. Changes
We may update this policy when the service, providers or legal requirements change. Material changes will be published here and, where appropriate, notified in the workspace.
12. Contact
Crevyro for Creators
Operated by Sahil Yadav, India
Privacy, grievance and support contact: srao2445@gmail.com