Privacy Policy
The Store Manager App is run by Crowd AB. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have over it. We keep it in plain language on purpose.
It covers our website (thestoremanagerapp.com), the WhatsApp assistant "Chief", and the emails and messages we exchange with you. Together we call these "the service".
Who we are
Crowd AB ("we", "us") is the data controller for the personal data described here. That means we decide why and how it is used, and we are responsible for it under the EU General Data Protection Regulation (GDPR).
- Company: Crowd AB, registration number 556724-9577
- Address: Simrishamnsgatan 34 B, 214 23 Malmö, Sweden
- Email: hello@thestoremanagerapp.com — a person will answer
What we collect
- Account details — your name, WhatsApp phone number, and email address.
- What you tell the assistant — the text and voice messages you send, and everything you choose to share about your store: your team, your manager, your KPIs, your tasks, and your notes. Voice notes are converted to text so the assistant can read them.
- What the assistant remembers — a structured profile it builds from your messages (store, team, boss, KPIs, brand voice, tasks, learnings, and your stated preferences), and the reports it drafts for you.
- Service records — for each reply the assistant produces we keep a technical record: when, how long it took, how many tools it used, what it cost us, and whether it succeeded. It contains none of the content.
- Your email and calendar, only if you connect them — connecting a Google account is optional. If you do, we receive the address of that account, the sign-in tokens Google issues, and what the assistant looks at to answer you: for email, the messages it reads (sender, recipients, subject, date, text, and the names of attachments, never their contents); for calendar, the names of your calendars and the events it reads (title, time, location, calendar name, number of attendees, and, when you ask about one event, its description). What we can reach depends on the permissions you grant on Google's sign-in screen. See "Google user data" below for exactly what we do with it.
- Payment details — handled entirely by Stripe. We never see or store your card number; we only receive confirmation of your subscription status.
- Messages with us — what you write when you email us for help or with a question.
- Website sign-ups — if you submit interest on our site, the email, role, and team size you provide. If you contact us through the form for businesses (HQ), your email, company name, number of stores, and your role, together with any campaign parameters in the page address when you submit (such as which ad brought you there).
- Website visits — when you visit our website, our hosting and network providers handle your IP address and basic browser details to deliver the page and protect it from abuse. The website also uses the Meta pixel, which sets cookies and records how visitors use the site (see "Cookies and advertising" below). This applies to the website only, never to your conversations with the assistant.
Most of this comes straight from you. The rest comes from services you use with us: Stripe tells us whether your subscription is active, and Google gives us the email and calendar data described above if you connect your account.
Why we use it, and our legal basis
The GDPR requires a legal reason ("legal basis") for each way we use your data. Here are ours:
| What we do | Legal basis |
|---|---|
| Run the assistant: remember your context, answer your messages, draft your reports, and, if you connected them, search your email, save drafts and read your calendar | Performance of our contract with you |
| Take payment and manage your subscription | Performance of our contract |
| Keep invoices and payment records | Legal obligation (Swedish accounting law) |
| Answer your support questions and send you service messages | Performance of our contract |
| Keep the service secure and prevent fraud and misuse | Our legitimate interest in a safe, working service |
| Contact people who signed up for interest on our website | Your consent, which you can withdraw at any time |
| Measure our ads with the Meta pixel on our website | Our legitimate interest in knowing whether our ads work |
| Respond to lawful requests from authorities, and protect our legal rights | Legal obligation, or our legitimate interest in defending legal claims |
We do not sell your data, and the content of your messages is never used for advertising or shared with advertising platforms. If we ever want to use your data for a new purpose that doesn't fit the ones above, we will ask for your consent first.
Who we share it with
We use a small number of trusted providers to run the service. Each processes your data only to perform its function, under a data processing agreement with us:
| Provider | What they do |
|---|---|
| Anthropic | Runs the AI that reads your messages and drafts replies. It also carries out the web searches the assistant makes for you: the search words the AI writes go to Anthropic, which passes them to a search provider it does not name |
| Provides the Gmail and Google Calendar connections, only if you choose to connect your email or your calendar (see "Google user data" below) | |
| OpenAI | Receives the audio of your voice notes to turn it into text. It also receives the text of your messages and of the assistant's replies, and the words the assistant searches your memory with, to build the index that lets the assistant find what was said earlier. Replies can quote an email or calendar event you asked about, so that text can reach OpenAI too |
| TypeSafe AI (Jev) | Sorts the web searches the assistant makes into broad categories, so we can see what kinds of questions are asked. It receives only the search words the AI wrote, never your message, your name, or your phone number |
| Twilio | Carries messages between you and the assistant on WhatsApp, which is operated by Meta |
| Stripe | Processes your subscription payment |
| Railway | Hosts the application and database (in the EU) |
| Cloudflare | Provides the DNS for our domain, routes our email, and stores the PDF reports the assistant sends you (in the EU) |
| GitHub | Stores our encrypted database backups |
| Meta | Measures whether our ads work, via the pixel on our website (website visitors only — never your messages) |
Anthropic, OpenAI and TypeSafe each state in their published terms that they do not use data sent to their business APIs to train their models. We do not sell your data to any provider, and we do not send your data to any provider for advertising.
Beyond these providers, we only share personal data in a few specific cases:
- When you ask us to — we share your data with someone else only on your instruction or with your consent.
- With our advisers — such as accountants, auditors, or lawyers, when they need it to advise us, under a duty of confidentiality.
- When the law requires it — for example, a lawful request from a court or authority, or to protect our rights, your safety, or others' safety.
- If the company changes hands — if Crowd AB is merged, sold, or restructured, your data may move to the new owner, who must keep protecting it as this policy describes. We'll tell you before that happens.
Google user data
You can choose to connect one Google account to the assistant, for your email, your calendar, or both. This is optional: the rest of the service works without it, and you can disconnect at any time.
Our commitment. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
What we ask Google for. When you connect your email, Google's sign-in screen asks you to allow:
- Read your email (gmail.readonly), so the assistant can search and read your mail when you ask it to.
- Manage drafts (gmail.compose), so the assistant can save a draft in your Gmail for you to review and send yourself.
- Your email address (openid and email), so we know which account is connected.
When you connect your calendar, it asks you to allow:
- See the list of your calendars (calendar.calendarlist.readonly), so the assistant knows which calendars you have, including ones shared with you such as a store or staff calendar.
- View events on your calendars (calendar.events.readonly), so the assistant can tell you what is on your calendar, give you the details of an event, and find when you are free, when you ask it to.
- Your email address (openid and email), so we know which account is connected.
The assistant can never send an email, delete an email, or change your mailbox settings, and it can never create, change, or delete a calendar event. We do not request those permissions, and the service has no way to do those things.
How we use it. We use your Gmail and Google Calendar data only to provide the features you ask for: answering your questions about your email, saving the drafts you request, and answering your questions about your calendar. We do not use it for advertising, we do not sell it, and we do not use it to build profiles of you or anyone else. We do not use it to develop, improve, or train general AI or machine-learning models.
Who sees it.
- The emails and calendar events you ask about are sent to Anthropic, the AI provider that runs the assistant, to produce the answer. Anthropic states that it does not use them to train models.
- The assistant's reply may quote or summarise what it found. Like all your messages, that reply is sent to OpenAI to be indexed, so that the assistant can search your own history later. OpenAI states that data sent to its API is not used to train its models. The index is used only for your own memory search.
- We share Google data with no one else, except where the law requires it or as part of a company sale described above.
- No person at our company reads your email, your calendar, or your conversations with the assistant, except with your explicit permission to resolve a problem you have reported, or where the law requires it. The tool our team uses to look at conversations is switched off.
How we store it. Your Google sign-in tokens are stored encrypted (AES-256-GCM) and are used only to read your mail, save drafts, and read your calendar on your behalf. Emails and calendar events the assistant looks at, and the replies that quote them, become part of your conversation history and memory index, like any other message, so it can refer back to them.
How to stop it. Tell the assistant "disconnect my email" or "disconnect my calendar", or delete your account. Disconnecting everything you connected, or deleting your account, removes the stored tokens and asks Google to revoke our access. You can also revoke access yourself at any time at myaccount.google.com/permissions. Disconnecting stops all new access; emails and calendar events already in your conversation history stay there until you delete your account or ask us to delete them.
Cookies and advertising
Our website (thestoremanagerapp.com) uses the Meta pixel, a small piece of code from Meta Platforms Ireland. It sets cookies in your browser and tells Meta which pages you visited, whether you clicked "Start now", and whether you completed a sign-up. We use this for one purpose: to measure whether our ads on Facebook and Instagram actually work, and to reach people similar to those who find the product useful. Meta may transfer this data to the United States under Standard Contractual Clauses and its EU–US Data Privacy Framework certification.
To be clear about the boundary: the pixel sees your visit to our website. It never sees your reports or anything you tell the assistant, and none of that is ever shared with Meta or any other platform for advertising.
You can avoid pixel tracking by using a browser or extension that blocks trackers (most modern browsers offer this), and you can control how Meta uses data about you in your Meta ad preferences.
Where your data lives
Our application and database are hosted in the European Union. Some of our providers (Anthropic, Google, OpenAI, Twilio, Stripe, Cloudflare, GitHub, and Meta) are based in the United States, so your data may be processed there when they do their job.
When that happens, the transfer is protected in one of two ways: the provider is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as giving adequate protection, or we have signed the European Commission's Standard Contractual Clauses with them. Email us if you'd like to know which applies to a provider, or want a copy of the safeguards.
How long we keep it
We keep personal data only as long as we need it for the reasons above. In practice:
- Your account, messages, and what the assistant remembers — for as long as you have an account, so the assistant can remember your context. If you cancel your subscription we keep your data, so the assistant still knows you if you come back. If you ask us to delete it, we erase it (see your rights below) and keep only a record that the deletion happened, which contains none of your content.
- Google tokens — until you disconnect everything you connected (email and calendar) or delete your account.
- Pages the assistant writes for you — 30 days from the day you asked for one, or until you ask the assistant to delete it. Anyone who has the link can open the page until then. We send the link to your chat. Messaging providers may retain it in message logs, and hosting providers may record it in access logs. Deleting or expiring the page stops the link working; it does not remove copies of the message or log entries.
- Service records — 13 months, or until you delete your account.
- Invoices and payment records — for as long as Swedish accounting law requires (currently seven years).
- Website sign-ups — 24 months, or sooner if you ask us to remove them.
- Backups — encrypted, and deleted automatically after 30 days. Deleted data stays in a backup only until that backup is overwritten, and is never used in the meantime.
If you stop using the assistant. While you keep writing to the assistant, it keeps what it knows about you. If you send it no message for 12 months, we erase your messages, what the assistant remembers, your files, pages, tasks and reminders. We keep your account and payment records, and you can start again at any time. Separately, we delete the technical record of each reply after 13 months, the log of who accessed your data after 12 months, and website sign-ups, HQ enquiries and waitlist entries 24 months after you sent them. Invoices and payment records are kept for seven years, as Swedish accounting law requires.
Your rights
Under the GDPR you can, at any time:
- Access — ask what data we hold about you and get a copy (you can also just ask the assistant "what do you know about me?").
- Correct — fix anything that's wrong. Tell the assistant, or email us.
- Delete — have your data removed entirely.
- Take it with you — get your data in a portable, machine-readable form.
- Restrict — ask us to pause using your data, for example while we check it is accurate.
- Object — object to uses based on our legitimate interests.
- Withdraw consent — where we rely on your consent, withdraw it at any time. This doesn't affect what we did before.
To exercise any of these, email hello@thestoremanagerapp.com. We may ask you to confirm it's you, for example from the WhatsApp number on your account. We'll answer without undue delay, and within one month at the latest. If we can't do what you ask, we'll tell you why.
Complaints. If you're unhappy with how we handle your data, please tell us first and we'll try to put it right. You also have the right to complain to a data protection authority: in Sweden, that's the Swedish Authority for Privacy Protection (IMY), or the authority where you live or work.
Automated decisions
The assistant uses AI to write drafts and suggestions, but it never makes decisions about you that have legal or similarly significant effects. You decide what to do with what it writes.
Data about other people
The assistant remembers what you tell it about your team and your manager, so it can help you write about them. Please share only what you reasonably need to for your work, keep it factual, and remove anyone who leaves — you can do this by telling the assistant, and it takes effect immediately. Avoid sharing sensitive details such as someone's health, religion, or union membership unless your work truly requires it. If someone you've mentioned asks us to remove their information, contact us and we will.
Security
Your messages travel over WhatsApp's encrypted transport. Our connection to the app is encrypted (HTTPS), sign-in tokens for connected accounts are encrypted in our database, and access to the database is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the authorities of a breach as required by law.
Children
The service is for working adults and is not directed at anyone under 18. If you believe a child has given us personal data, contact us and we'll delete it.
Changes
If we change this policy materially, we'll update the date above and tell you in the app before the change takes effect. The current version always lives on this page.
Contact
For any question about your data or this policy, email hello@thestoremanagerapp.com, or write to Crowd AB, Simrishamnsgatan 34 B, 214 23 Malmö, Sweden.
This is our beta privacy policy, written to be honest and complete for a small, early group of users. As we grow we'll have it formally reviewed. If anything here is unclear, just ask us.
Parts of this policy are adapted from the Privacy Policy (GDPR Enhanced) template prepared by General Legal, PC and released under CC0. General Legal has not reviewed this policy.