Privacy Notice

Crux AI Inc. (“Crux,” “we,” “us”) is a Delaware corporation. We build an AI evaluation product for teams running AI agents. We operate entirely in the United States.

Questions about this notice, or to exercise a privacy right described below: security@crux-labs.ai. This is the same address we use for security reports; a person reads and responds to it.

Crux plays two different roles depending on whose data it is, and what applies depends on which one:

1. Data our customers ask us to process (conversation data, and accounts for people a customer invites to their workspace). Here, our customer is responsible for that data and for responding to privacy requests about it — we process it on their instructions, under a data processing agreement with them. If you contact us directly about this kind of data, we will forward your request to the relevant customer within 2 business days.

2. Data we collect directly (site visitors who sign up to be notified, job applicants, personnel, business contacts, investors/advisors). For this data, Crux is responsible, and the rest of this notice describes what we do with it.

Email address, if you sign up for updates on our site — used only to notify you about Crux; not sold, not used for ads.

Job applicant information, if you apply to work with us — used to evaluate your application.

Business contact details (name, email, company), if you reach out to us or we reach out to you.

How you use Crux, including which app pages and features you use. Used to support you and improve the service; not sold and not used for ads.

We collect only what we need for these purposes, and we don’t use this data to build advertising profiles.

Sign-up list: until you unsubscribe or ask us to delete it.

Job applicant data: for the hiring process and a reasonable period after, per standard hiring-records practice.

Business contact data: while the relationship is active, or until you ask us to delete it.

Product usage: page views and other in-app activity for 90 days; sign-ins and sign-outs while the workspace exists.

You can ask us to: tell you what data we hold about you, correct it, delete it, or stop using it for a stated purpose. Email security@crux-labs.ai to make a request. We verify who you are before acting on it, and respond within 30 calendar days. If your request is actually about data a Crux customer holds about you (for example, you’re a user inside a company’s Crux workspace), we’ll identify the right company and forward your request to them within 2 business days, since they control that data.

Use this form to request deletion. Every request is logged (date, requester, what was requested, what we did, when it closed) and tracked to completion.

We use industry-standard measures to protect data we hold, including encryption at rest and in transit, access controls limited to named personnel, and monitoring of our production systems.

We use a small number of infrastructure vendors to run our service: Render (hosting, database), Cloudflare (network), Amazon Web Services (storage), Google Workspace (business email/docs), Anthropic (AI model provider), Slack. Each is bound by its own data protection terms with us.

If we make a material change to this notice, we’ll update the effective date above and, where required, notify affected individuals.