Privacy Notice
How Creweng, LLC collects, uses, shares and keeps personal data on this website, in the client account and in its engagements, and the rights you have over it. It is written to the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), with the EU GDPR alongside, because our clients are in the UK, the EU and the US and we are a controller based in the US.
Effective date: 18 October 2026 (draft) · Version 0.1-draft · ICO registration: [TBC]
DRAFT — not yet reviewed
This notice is a draft written without legal advice. It has not been reviewed by a lawyer or a data-protection professional and may be incomplete. A professional review is scheduled before launch; the version number above changes when it is done. Items marked [TBC] are still to be confirmed.
Who we are
The controller of the personal data described here is Creweng, LLC, a limited liability company formed in New Mexico, USA. Contact for anything about personal data: hello@creweng.com. Registered address: [TBC].
- UK Information Commissioner’s Office (ICO) registration: [TBC].
- UK representative under UK GDPR Article 27: [TBC]. EU representative under GDPR Article 27: [TBC].
- Data protection officer: none appointed; the contact above handles every request.
What this notice covers
This notice covers the website at https://creweng.com, the client account, the features the site offers and the personal data we handle when you contact us or we work for you. It does not cover personal data we process for a client under a contract as that client’s processor; the contract and its data-processing terms govern that.
Where we say “UK GDPR” we mean the UK General Data Protection Regulation and the Data Protection Act 2018; the same articles of the EU GDPR apply to people in the EU. US state privacy laws that apply to us, if any: [TBC].
What we collect, and why
Each feature of the site collects only what it needs. Nothing on the site is sold or used for advertising.
| Feature | What we collect | Why |
|---|---|---|
| Client account | Your email address and, if you give them, your name and company. Your password, stored only as a salted PBKDF2-SHA256 hash that cannot be turned back into the password. Passkeys you add: the public key and a device label. The wording and version of the Terms you accepted, and when. Your projects, quotations, invoices and onboarding checklist. | To give you a login, to perform our contract with you and to keep the record of your acceptance of the Terms. |
| Contact and intake | An enquiry: your name, email address, company, what you wrote and the topic you chose. The scoping assistant: your description of the project, your questions and answers, and the scope drawn from them, whether through the contact page or an AI assistant you connect to our MCP endpoint (/connect). A booked call: name, email address, time zone, the time you choose and what you tell us you are deciding; the booking provider tells us when a call is booked, moved or cancelled. | To answer you, to prepare and quote the work, and to hold the call. |
| Newsletter | Your email address, the date you subscribed, the wording you opted in under and when you confirmed it, and the country our network provider associates with your connection at sign-up (the country only; no IP address is kept). | To send you the notes you asked for, and to show that you asked (PECR regulation 22). |
| Support tickets | When you open a ticket while signed in: its reference, the category you choose and your message, sent only if you tick the box to send it, together with the wording of that box as the record of your consent. | To answer the ticket and to keep the record of your request. |
| Boundary test | The address of the AI system you want tested, one authorisation header for it if it needs one, the operator name you want it to give or transcripts you paste, and the token you publish to prove the system is yours. The system’s replies, held briefly to score them. The report: verdicts, hashes of the replies and the system’s host name. | To run the test you asked for against a system you are authorised to test, and to give you the report. |
| The Guide (site assistant) | What you ask, typed or spoken. A spoken question is transcribed and the recording discarded at once. Your question is used to search our published pages and to generate an answer, and is not stored; we keep only which topics are asked about, counted in aggregate by month, and short-lived conversation counters (messages, unanswered questions, time) that end a conversation at the limits the feature states. | To answer questions about our published pages, and to stop abuse of the feature. |
| Analytics | Page views, measured by Plausible without cookies and without storing an IP address or an identifier that persists between days. We cannot tell one visitor from another. | To know which pages are read. |
| Security and logs | Request metadata our network provider processes to serve and protect the site (IP address, headers, timing), and rate-limit counters derived from it. Server logs are not used to identify visitors. | To keep the site up and defend it against abuse. |
We do not collect special-category data (health, beliefs, biometrics and so on) and ask you not to send it to us or to any AI feature. Where you give us personal data about other people, you confirm you may do so.
Lawful bases (UK GDPR Article 6)
| Processing | Lawful basis |
|---|---|
| Client account, projects, quotations, invoices, support tickets | Performance of a contract with you, or steps you ask us to take before one (Article 6(1)(b)). |
| Answering an enquiry, a scoping conversation you have not yet sent, a booked call | Our legitimate interest in answering an enquiry you started (Article 6(1)(f)); contract once a scope or a booking is sent. |
| Sending you a scope, a quote or the newsletter | Your consent, given by the box you tick or the confirmation link you press (Article 6(1)(a)); you can withdraw it at any time. |
| Boundary test | Performance of the service you asked for (Article 6(1)(b)); you confirm you are authorised to test the system named. |
| The Guide and analytics | Our legitimate interest in answering visitors from our published pages and in knowing which pages are read, with nothing stored that identifies you (Article 6(1)(f)). |
| Security, rate limiting, the evidence log | Our legitimate interest in keeping the site and its records secure (Article 6(1)(f)). |
| Accounting and tax records, the record of your acceptance of the Terms | Compliance with legal obligations (Article 6(1)(c)) and establishing or defending legal claims. |
Who receives your data
We use service providers to run the site. Each acts on our instructions under a contract, or under its own published terms where it is itself a controller. The list below is being confirmed against the deployed configuration: [TBC].
| Recipient | What | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage (database, files, key-value and durable storage), the network that serves the site and the AI gateway the features call. Encrypted account, project and session data; the Guide's index of our published pages. | United States, with edge processing worldwide. |
| Google LLC (Gemini) | Answers the Guide and the scoping assistant, on Google’s unpaid tier: Google’s terms for it let Google use what it is sent to improve its products and let people at Google read it. The Guide tells you this before your first question and asks you not to include personal data. | United States and other countries. |
| Booking provider | Call bookings: your name, email address, time zone and the time you choose. Provider: [TBC]. | [TBC] |
| Transactional email provider | Delivery of the emails the site sends (confirmation links, password resets, ticket replies). Provider: [TBC]. | [TBC] |
| Owner alerts (Telegram) | That something arrived, and nothing that identifies you or repeats what you wrote: an enquiry's reference and topic, a scope's reference, a booking's time, a ticket's reference and category. | [TBC] |
| Plausible Analytics | Cookieless page-view counts with no personal identifier. | European Union. |
| Professional advisers, authorities | Where the law requires it or to establish or defend a legal claim. | As required. |
We do not sell personal data and we do not share it with advertisers.
International transfers
We are based in the United States, so personal data from the UK and the EU is transferred to the US when we receive it, and some providers process it there or elsewhere. The US does not have a UK or EU adequacy decision for all transfers; where a provider is certified under the UK Extension to the EU–US Data Privacy Framework or the EU–US Data Privacy Framework we rely on that certification, and otherwise on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, with a transfer risk assessment. The instruments in place for each provider: [TBC].
Questions you ask the Guide or the scoping assistant are sent to Google’s Gemini service to be answered; the feature tells you this before your first message. Do not include personal data in a question.
How long we keep it
We keep personal data only as long as the purpose needs. The periods below are the ones the code enforces; a daily automatic sweep applies them.
- Contact enquiries, project scopes and booked calls: up to 2 years from the last correspondence, unless an ongoing engagement needs longer. A scoping conversation you never send is deleted within an hour of its last message.
- The Guide: your question and the answer are not kept. Monthly topic counts hold no personal data. Conversation counters start afresh 30 minutes after your last question, or 24 hours after a conversation was ended.
- Boundary test runs: the replies of the system you tested are deleted 24 hours after the run; the report (verdicts, reply hashes and the host name) 30 days after the run starts; an authorisation header you gave, when the run ends. A run started from your client account keeps its reference, host name and start time while your login exists, and is deleted with it.
- Newsletter: until you unsubscribe, when the address is deleted rather than kept on a suppression list. An address that is never confirmed is deleted after 7 days and nothing is sent to it.
- Client login: while your login exists. You can delete it yourself at any time from your account page; the login, its sessions, passkeys and unused email links are erased at once and permanently, and we keep only a record that an erasure took place, holding neither your email address nor your name. Sign-ups never confirmed are deleted after 7 days; sign-in sessions expire after 7 days or when you sign out; emailed links expire after 24 hours (confirmation) or 1 hour (password reset) and work only once.
- Support tickets: while your login exists and deleted with it. A closed ticket is deleted 12 months after its last update. Our alerts about tickets hold only the reference and category.
- Projects, checklists and AI access keys: while your login exists and deleted with it. An access key expires one year after you create it and can be revoked at any time.
- Research briefs (company information from public sources, prepared for an engagement): deleted 400 days after they were written; the text of the pages read is never kept.
- Quotations and invoices: kept as accounting and tax records for the period US federal and New Mexico law require: [TBC]. If you delete your login, your email address and the link to your project are removed from them; drafts are deleted outright.
- The record of your acceptance of the Terms: kept while your login exists and, after deletion, only as the anonymous erasure record above.
- Account deletion: associated data is purged from our primary databases and caches within 30 days, when our database provider’s point-in-time history has rolled past it. Encrypted backups are rotated and destroyed within 90 days.
- The evidence log: holds hashes and references that identify no one and stays; it shows that a record existed and when, never what it said or who sent it.
Your rights (UK GDPR Articles 15 to 22)
If you are in the UK or the EU you have these rights, and we extend them to everyone whose data we hold:
- Access (Article 15): a copy of your personal data and the information in this notice as it applies to you.
- Rectification (Article 16): correction of inaccurate or incomplete data.
- Erasure (Article 17): deletion where there is no longer a reason to keep it. Your login, you can delete yourself from your account page.
- Restriction (Article 18): a pause on processing while a dispute about it is resolved.
- Portability (Article 20): the data you gave us, in a machine-readable form.
- Objection (Article 21): to processing based on legitimate interests, and at any time to direct marketing.
- Automated decisions (Article 22): not to be subject to a decision based solely on automated processing with legal or similarly significant effect. We make none (section 9).
- Withdrawing consent: where we rely on consent, you may withdraw it at any time; the unsubscribe link, the account page or an email does it.
How to exercise them
Email hello@creweng.com from the address we hold for you, or write from your account. We answer within one month (Article 12(3)), extendable by two months for complex requests with an explanation. We may ask you to confirm your identity. Requests are free unless manifestly unfounded or excessive.
AI features and automated decisions
The Guide, the scoping assistant and the boundary-test tool generate text with machine-learning models. None of them makes a decision about you: the Guide answers from our published pages, the scoping assistant drafts a scope that a person reads before any quote, and the boundary test reports on a system you named. A conversation may be ended automatically for abuse, repeated off-topic questions or at the limits the feature states; that ends the chat and nothing about you is stored when it happens.
Outputs are information, not advice. The Terms of Service (sections 6 and 7) say what you should check before relying on them.
Cookies (PECR regulation 6)
The site sets one cookie, and only when you sign in:
| Cookie | Purpose | Lifetime |
|---|---|---|
| __Host-cw_session | Your sign-in session: a random value in an HttpOnly, Secure, SameSite=Strict cookie that page scripts cannot read. We store only its SHA-256 hash. | 7 days, or until you sign out. |
This cookie is strictly necessary for a service you asked for, so no consent is needed for it. We set no analytics, advertising or tracking cookies: Plausible measures page views without cookies, and we use no pixels or re-targeting. Because there is nothing to consent to, there is no cookie banner. Browser storage is used only for conveniences such as remembering that you dismissed a notice.
Direct marketing (PECR regulation 22)
The only marketing email we send is the newsletter, and only to people who asked for it: you enter your address, we email you a link, and the subscription starts only when you press the button it opens. Every newsletter carries an unsubscribe link that works in one press and deletes your address. We do not rely on the “soft opt-in” for existing customers; a client receives marketing only if they subscribe.
Follow-ups about an enquiry you sent us are correspondence about your request, not marketing; you can stop them from the link in any of them.
Security
- In transit: all traffic is encrypted with TLS at our network provider’s edge.
- At rest: database records and stored files are held in encrypted storage.
- Passwords and passkeys: passwords are stored only as salted PBKDF2-SHA256 hashes; passkeys use public-key cryptography and the private key never leaves your device.
- Sessions: a random value in an HttpOnly, Secure, SameSite=Strict cookie, stored by us only as a hash, expiring after 7 days or at sign-out.
- Rate limiting: on sign-in, forms and the AI features, to resist brute force and abuse.
- Least data: alerts to us carry references, not content; the Guide stores no questions; analytics hold no identifier.
Children
The site and our services are not directed at anyone under 18, and you must be 18 or older to create a login or contract with us. If you believe a child has given us personal data, email us and we will delete it.
Personal data breaches
If a breach of personal data is likely to result in a risk to your rights and freedoms, we notify the ICO within 72 hours of becoming aware of it (UK GDPR Article 33) and, where the risk is high, tell you without undue delay (Article 34), with what happened, what it means for you and what we are doing. The EU authority we would notify for people in the EU: [TBC].
Complaints
If you are unhappy with how we handle your personal data, please tell us first at hello@creweng.com; we aim to resolve a complaint within one month. You also have the right to complain to a supervisory authority:
- UK: the Information Commissioner’s Office, ico.org.uk/make-a-complaint.
- EU: the data-protection authority of the member state where you live or work, or where the issue arose. Our lead authority, if any: [TBC].
- US: the consumer-protection authority of your state, where a state privacy law applies: [TBC].
Changes to this notice
The version and effective date at the top change whenever this notice does. For a material change, such as a new use of data you have already given us or a new kind of recipient, we give account holders and subscribers at least 14 days’ notice by email or on the account page before it takes effect. Earlier versions are available on request.
Questions about this notice: hello@creweng.com.