Effective 21 October 2026
Information you provide
Public forms collect your email, optional name and company, role when requesting access, a short description, contact consent and an optional updates choice. Please do not submit passwords, private keys, payment information or confidential customer content in these forms.
An invited account also stores information needed to operate your workspace, including account and permission records, teams, task conversations, outputs, usage and audit records. Tool connections and model providers require their own configuration.
Why it is used
We use access requests to review a workflow and contact the requester, contact messages to respond to questions, and privacy requests to review information rights. Optional product-update consent is recorded separately and can be withdrawn through a contact request. Submitting a public form does not create an account, send an invitation or start a model run.
Workspace information supports the tasks you request, permission enforcement, recovery, source-linked memory, security and service operation. Agents retrieve only information permitted by the configured scope.
Storage and service providers
Public requests are stored encrypted in the service database for manual operator review. Infrastructure may process network and security information such as IP address and request metadata to operate and protect the service. Crewmori uses hosting and delivery infrastructure, including Google Cloud and Cloudflare.
When you run an AI task or connected tool, relevant permitted inputs can be sent to the configured model or integration provider, such as OpenRouter or Composio. The provider and account configuration determine which third parties receive the request. Do not assume that all provider settings or jurisdictions are interchangeable.
Credentials
Configured connection secrets and SSH credentials use encrypted storage and are exposed to approved tools under their scopes. Public marketing forms are not a credential vault. Access controls and encryption reduce exposure; they are not a guarantee against every security incident.
Cookies and optional measurement
Google Analytics is optional on the public marketing site. Its Google tag is blocked until you affirmatively allow analytics; rejecting keeps it blocked. With permission, Google receives controlled public page names and paths, accepted access-request counts and technical/browser analytics information, and can set first-party analytics cookies. We exclude URL query strings and fragments, form contents, email, names, workflow descriptions, submission references and private workspace data from our analytics events. No user ID is configured. We do not load Google Ads or Meta tags, and advertising storage, advertising user data and ad personalization stay denied.
Your browser stores the analytics preference and notice version for up to 180 days. Analytics cookies are configured on the public host for up to 180 days; browser storage settings may shorten that period. A browser-tab receipt prevents repeated accepted submissions from being counted again and is not sent to Google. See cookie settings to accept, reject or withdraw at any time. Withdrawing stops future collection and reloads without the tag; it does not automatically erase earlier data held by Google. Forms work without optional analytics consent. The private application uses necessary authentication/session mechanisms and contains no marketing analytics tag. Google processes consented analytics information under its own privacy policy.
Retention and deletion
Public form requests expire after 90 days. The worker checks for expired requests on its first successful tick and then hourly while it continues running. Outages or stalled worker ticks can delay removal; submission and operator inbox access also trigger expiry cleanup. Authorized operators may remove a request earlier. Encrypted backup copies follow the separately operated backup retention process and may outlast live records.
Workspace content is retained to provide task history, recovery and owner-controlled reuse. Knowledge forgetting and source revocation affect retrieval; completed derived records and audit records can require separate handling. Request an explanation or deletion review if needed rather than assuming a single action removes all copies.
Your requests
Use the privacy request form to ask for access, correction, deletion or withdrawal of optional updates consent. We may need to verify your connection to the information before acting. A form submission does not automatically change or erase an account.
Early access and updates
The service is evolving. Material changes to information handling should be reflected in this notice before the new use begins.