Your Privacy Rights
GDPR · UK GDPR · CCPA/CPRA · Texas TDPSA · Last updated: June 20, 2026
The short version
You can ask us what we hold about you, get a copy, correct it, delete it, object to how it's used, or withdraw consent, regardless of where you live. One email does it: legal@crutan.com. We respond within the legal deadline, verify requests, and never discriminate for exercising rights. To change cookie/tracking consent instantly, use Cookie settings in the site footer.
Two situations, two paths
- You visited crutan.com or talked to us (lead forms, tools, demo), Crutan LLC is the controller. Exercise rights directly with us as described below.
- You received a page generated by one of our customers, that customer is the controller and Crutan is their processor. We'll forward your request to them within 5 business days, and on their instruction (or where the law requires) act on it directly.
Rights under GDPR / UK GDPR
- Access: a copy of the personal data we hold about you.
- Rectification: correction of inaccurate data.
- Erasure: deletion, where no overriding legal basis applies.
- Portability: machine-readable export of data you provided.
- Restriction & objection: including an absolute right to object to direct marketing.
- Withdraw consent: where processing relies on it (analytics, personalization, identity enrichment), at any time, including via Cookie settings.
- Complain: to your supervisory authority; we'd appreciate the chance to resolve it first.
Our lawful bases: consent for analytics, personalization, and identity enrichment on this site; contract for providing the product; legitimate interest for security, fraud prevention, and B2B relationship management; legal obligation where applicable. International transfers are covered by Standard Contractual Clauses, see the DPA.
Rights under U.S. state laws (CCPA/CPRA, Texas TDPSA, and similar)
- Know / access: categories and specific pieces of personal information collected.
- Delete: subject to statutory exceptions.
- Correct: inaccurate personal information.
- Opt out of sale/share/targeted advertising: we do not sell or share personal information, and do not use it for cross-context behavioral / targeted advertising as those laws define them, so there is nothing to opt out of. We also honor Global Privacy Control signals.
- Limit sensitive PI: we don't collect sensitive personal information on this site for the purpose of inferring characteristics.
- Non-discrimination: same service and pricing whether or not you exercise rights.
Categories we collect (statutory disclosure)
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Identifiers | Name, work email, company, on-device visitor id | You (forms, tools); your browser | Respond, provide service, personalize |
| Commercial info | Plan, billing history | You / Stripe | Billing, support |
| Internet activity | Pages viewed, events (first-party) | Your browser (with consent) | Site improvement, journey personalization |
| Geolocation (coarse) | City/region/country and company from reverse-IP | IPinfo (with identification consent) | Recognize your organization, personalize |
| Professional info | Role, team size, organization domain | You; derived from email/website | Routing, relevance, follow-up |
| Inferences | Journey stage, intent score | Derived from the above (with consent) | Personalization, prioritization |
We disclose these categories to the service providers (subprocessors) listed here for the purposes above. We do not sell or share them.
Retention
Lead and contact records: 24 months from last interaction, then deleted or anonymized. Analytics events and identity-enrichment records: 12 months. Consent logs: up to 24 months. Customer workspace data: lifetime of the contract plus 30 days. Backups roll off within 35 days of deletion.
How to exercise any right
- Email legal@crutan.com from the relevant address (or describe it).
- Tell us which right you're exercising, no special format required.
- We verify your identity, act within the legal deadline (45 days under CCPA, extendable once; 30 days under GDPR, extendable to 60 for complex requests), and confirm in writing. Authorized agents may submit requests with proof of authorization.
- If we decline a request, we'll explain why and tell you how to appeal (where the law provides an appeal, such as the Texas TDPSA).
See also: Privacy Policy · Cookie Policy · DPA · Subprocessors