Effective November 9, 2026
This policy explains how Abram Toy ("we", "us") handles personal information in connection with RevCrumb (the "Service"). It covers two groups of people: our customers (agencies and businesses who create RevCrumb accounts) and visitors to our customers' websites, whose information our customers collect using the Service.
When you create an account we collect your name, email address, password (stored only as a one-way hash), workspace name, and branding settings. When you subscribe, our payment processor, Stripe, collects your payment details. We do not store full card numbers. We keep basic logs (such as IP address and request times) to operate and secure the Service.
We use this information to provide and secure the Service, process payments, send service-related messages, and respond to support requests. We do not sell it.
Customers place our script on their websites. For each visitor, it records how they arrived (for example the referring site, campaign parameters such as utm_source, and ad click identifiers), the landing page, and a random visitor identifier stored in a first-party cookie and local storage. When a visitor submits a form, the script sends only the email address and name fields to us. Other form fields are not collected. Customers may also send us records of closed deals (email, deal value, and date).
For this information, our customer is the controller and we act as their processor: we process it only to provide the Service to that customer, following their instructions. Visitors who want to access, correct, or delete their information should contact the business whose website they visited. We will help our customers respond to such requests.
Customers can configure the script to wait for the visitor's consent before storing anything. Customers are responsible for providing any notices and obtaining any consents required by law on their websites.
On our own site we use a strictly necessary session cookie (rc_sess) to keep you signed in. On customers' websites, the script sets a first-party cookie (rc_vid) containing a random identifier, used to connect a visitor's visits so leads can be attributed to the right marketing channel.
We share information only with service providers who help us run the Service, under contracts that protect it: our hosting provider (where data is stored) and Stripe (payments). We may disclose information if required by law, or as part of a merger or acquisition, in which case this policy will continue to apply. Client report links created by our customers show aggregated data with personal details masked.
We keep customer account information while your account is active. Website visitor and lead data is kept for as long as our customer keeps their account, or until they ask us to delete it. When an account is closed, we delete or anonymize its data within 90 days, except where we must keep records for legal, tax, or accounting reasons.
We use encryption in transit (HTTPS), hashed passwords, access controls that separate each customer's data, and the principle of least privilege. No system is perfectly secure; if we learn of a breach affecting your information we will notify you as required by law.
Depending on where you live (for example under the GDPR or the California Consumer Privacy Act), you may have rights to access, correct, delete, or export your personal information, and to object to certain processing. Customers can exercise these rights by contacting us. Website visitors should contact the business whose site they visited (see section 2).
We are based in the United States and process data there. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers from the EU, UK, or Switzerland.
The Service is for businesses and is not directed to children under 16.
We may update this policy. If changes are material, we will notify customers by email or in the Service before they take effect.
Abram Toy, Kentucky, USA. Email: abramtoy@revcrumb.com