Privacy Policy

CrewOn AI Inc. (CEO Ho Chul Song) processes personal information required for CrewAI.Work accounts, sign-in, workspaces and shared service access under this policy.

When an organization manages its members, that organization’s policies and contract may also apply. If an individual service asks for a separate connection permission, review the notice shown in that connection flow.

Account and sign-in

• Google sign-in: Google account identifier, email address and verification status, name and basic profile information
• Direct sign-up: email or username, password-verification result, optional recovery email and email-verification status
• Security sessions: sign-in time, session identifier, access history, IP address, browser and device information

Workspace settings and use

• Name, optional phone number, language, time zone and optional profile image
• Personal or organization workspace selection, organization name and type, username, invitations and membership
• Policy versions and timestamps for terms, privacy and security consent
• Work content, settings and access, change and approval history for services selected by the user

Sales inquiries

• Required: company, contact name and company email
• Optional: phone number, services of interest and implementation notes
• Purpose: receive and follow up on a CrewAI.Work consultation request
• Retention: up to two years while consultation is active and 90 days after it ends
• Consent version and time, requested products and intake receipt

Public sales inquiries are stored with their source in the unified sales-inquiry ledger operated by CrewOn AI Inc. to prevent duplicates and manage follow-up and handling history.

Billing-open notice requests

• Required: email and the plan you want to hear about
• Optional: organization name
• Purpose: one email announcing that billing for that paid plan has opened (no advertising or marketing email)
• Retention: deleted right after the notice is sent, or 12 months after you agree if billing has not opened
• Version and time of your consent to the notice email, and the language of the request page

We collect this through "Notify me when billing opens" on the public pricing page. Requesting the same plan again with the same email does not create a new record; it only refreshes the consent time and retention period. No other information, such as your IP address, is stored with the request.

We do not arbitrarily request information that is unnecessary for sign-up or operation. Optional fields do not affect basic account creation.

Google sign-in

Basic profile data identifies the selected Google account, locates or creates the CrewAI.Work account and maintains the sign-in session. Sign-in consent alone does not grant access to Gmail, Calendar, Tasks or Drive data.

Optional Gmail connection

When a user selects “Connect Google Mail” in Mail, we request https://mail.google.com/. CrewAI.Work uses IMAP/SMTP OAuth to read and search folders, messages and attachments; change read and starred state; send, reply and save drafts; move messages to archive, spam or Trash; and permanently delete a user-confirmed message from Trash. If enabled, selected mail is also used for that user’s AI briefing.

Gmail IMAP and SMTP cannot authenticate with narrower Gmail REST scopes, and the product supports permanent deletion, so this connection uses https://mail.google.com/.

Optional Google Calendar connection

Calendar requests https://www.googleapis.com/auth/calendar.calendarlist.readonly to list calendars and https://www.googleapis.com/auth/calendar.events to read, create, edit and delete events. It does not create or delete calendars or change sharing or ACLs, so it does not request the full https://www.googleapis.com/auth/calendar scope.

Optional AI Crew Google Workspace connection

Depending on the feature selected, AI Crew may request https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.send, https://www.googleapis.com/auth/calendar.events.readonly, https://www.googleapis.com/auth/calendar.calendarlist.readonly, https://www.googleapis.com/auth/calendar.events, https://www.googleapis.com/auth/tasks, https://www.googleapis.com/auth/drive.file or https://www.googleapis.com/auth/drive.metadata.readonly.

• Gmail: read and search the selected mail range, or send a user-confirmed message.
• Calendar and Tasks: read selected events or create, edit and delete events and tasks.
• Drive: search, create and share files created by or explicitly used with the app; personal read connections access only metadata such as file name, type and modification time.

drive.metadata.readonly does not grant file-content access, and the current public flow does not request drive.readonly. Organization user provisioning uses a separately approved service-account administrator flow; user OAuth consent does not request admin.directory.user or contacts.

Storage, disconnection and limits

• OAuth access and refresh credentials are protected while needed and are not shown in screens, logs or ordinary work events.
• Synced mail, calendar, task and Drive data is processed only for requested connection functions, user-selected AI briefings, security and incident response.
• Users can disconnect in each service’s settings. We discard stored connection credentials and stop later synchronization. Retained synchronized data is deleted under an account-deletion request or the applicable retention policy.
• Access can also be revoked in Google Account “Third-party apps and services.”

CrewAI.Work’s use and transfer of Google API data complies with the Google API Services User Data Policy, including Limited Use. We do not use it for advertising, sell personal information, use it for credit or lending decisions, or allow human reading except to provide requested features, protect the service or meet legal obligations.

See the Google Privacy Policy for Google’s own processing.

• Identity verification, account creation, sign-in, recovery and session security
• Personal and organization workspace creation, membership, permissions and service delivery
• Customer support, incident response and service-quality and security improvements
• Prevention of unauthorized access, audit trails, legal obligations and disputes

Processing relies on user consent, performance of the service agreement, legitimate security interests or applicable legal obligations. Refusing required information may limit account creation or sign-in.

We do not sell personal information. We do not disclose it to independent third parties except when required by law, requested by the user or necessary to provide the service.

Google sign-in operates between Google and CrewAI.Work when the user chooses Google as an identity provider. Where cloud, email or monitoring processors are needed, contracts restrict purpose, access, security and deletion.

For dedicated regions, on-premises or isolated deployments, data location and processors follow the relevant contract and deployment. New processors or material international-processing changes will be reflected in this policy or a separate notice before they apply.

• Account, profile and workspace data: while the account and contract remain active
• Policy-consent, security and audit records: as needed for legal duties, security investigations and disputes
• Inquiry records: until handling and follow-up end, or longer when legally required

When the purpose ends, information is deleted in a manner designed to prevent recovery or is de-identified. Backup copies remain isolated during the defined backup cycle and are not used for another purpose.

Account-deletion requests are currently received by email under the account deletion guide and handled after identity verification. If organization-owned data or a legal hold applies, we explain the deletion scope and reason for retention.

You may request access, correction, restriction, withdrawal of consent, account deletion, or an objection to or explanation of automated decisions. A legal representative or properly authorized agent may act for you.

Information managed by an organization administrator may also require that administrator’s confirmation. AI summaries and recommendations do not replace important decisions; users may request evidence and human review.

Email hello@crewai.work with the account email, request type and enough information to verify the request. Do not send passwords, verification codes or OAuth tokens.

Essential cookies

We use essential cookies for sign-in sessions, request-forgery protection and secure organization access. The current public sign-in flow does not use advertising-targeting cookies. Blocking essential cookies may prevent sign-in and workspace use.

Children under 14

CrewAI.Work is not primarily directed to children under 14 and does not intentionally collect their personal information without legal-guardian consent. An organization that needs a child account must establish valid guardian consent and an organization policy before sign-up.

A legal guardian may request access, correction or deletion through the privacy contact.

Contact CrewAI.Work first for prompt review. In Korea, additional advice or dispute resolution is available through:

• Privacy infringement report: 118 (without an area code)
• Personal Information Dispute Mediation Committee: 1833-6972
• Privacy Portal
• Personal Information Protection Commission

We use encryption in transit, a central identity provider, short-lived sessions, OAuth state, nonce and PKCE checks, organization-scoped access and audit records. Requests are denied when access is unclear or verification fails.

For privacy questions and rights requests, email hello@crewai.work. For vulnerabilities, use the security reporting guide.

Material changes will be published here with a new version and effective date before they apply, and prior versions will be retained as change history.