Crust – Privacy Policy
This Privacy Policy explains how Smulp AB, a company registered in Sweden (org. no. 559543-3847, registered office at Riddarhuskajen 1, 11128 Stockholm, Sweden) (“Crust”, “we”, “us”) handles your personal data when you use the Crust application and our websites (the “Service”). We are the data controller for this data.
We follow the EU General Data Protection Regulation (GDPR) and Swedish data protection law.
Plain-language summary: We collect what we need to run your account, process the AI work you ask for, take payment, fix bugs, and see which features are used so we can improve Crust. We don’t sell your data, and we only run AI models under terms that exclude training on your content, with the exceptions listed on our models page. Your files and our database are stored in the EU. You have strong rights over your data: see Section 8.
1. The data we collect
Account and contact data: your name, email, company/role, and (for beta) what you applied to use Crust for. Collected when you apply, create an account, or contact us.
Subscription and payment data: your plan, billing records, and the limited payment details handled by our payment processor Stripe.
Your Content and prompts: the inputs and outputs you create. Work that runs locally stays on your device. Work that uses cloud models is sent through our servers to the service hosting the model you chose, and the result is returned to you (see Section 4). Uploaded files and generated results are stored in Google Cloud in the EU while your account exists. We don’t store your prompts or the original names of your files in our database.
Usage statistics: on our servers, we record which models and features are run, whether they succeed, how long they take, how many credits they use and which app version is used. These records carry no user, account or request identifiers and no IP address. We use PostHog (EU cloud) for this. The app itself does not send usage analytics.
Error and diagnostic data: crash reports and error logs from the app and our servers, collected with Sentry (EU region) to detect and fix problems. App reports contain the app version, operating system, device model and technical error details, and are filtered to exclude IP addresses, names, email addresses and your content. You can turn app error reports off in Settings → Privacy.
Website data: basic logs and cookies when you visit our websites (see Section 9).
2. Why we use your data, and our legal basis
| What | Why | Legal basis (GDPR Art. 6) |
| Account and content processing | To provide the Service you asked for | Performance of a contract |
| Subscriptions and payment | To bill you and keep records | Contract / legal obligation |
| Error and diagnostic monitoring (Sentry) | To keep the Service secure and working | Legitimate interest |
| Usage analytics (PostHog) | To understand which features are used and improve Crust | Legitimate interest |
| Fraud and abuse prevention | To protect the Service and other users | Legitimate interest / legal obligation |
| Legal compliance | Tax, accounting, responding to authorities | Legal obligation |
| Non-essential website cookies | To understand how our websites are used | Consent |
3. Usage statistics and error reports
We rely on our legitimate interest in keeping Crust stable and improving it, and we keep the data minimal so that it weighs lightly on your privacy:
- the app sends no usage analytics;
- usage statistics on our servers carry no user identifiers;
- error reports are filtered to exclude personal data and your content.
You can turn app error reports off at any time in Settings → Privacy without losing access to the Service. You can also object to this processing by contacting privacy@crustsystem.com.
4. Who we share data with
We don’t sell your personal data. We share it only with:
Third-party AI model providers: when you run a cloud node, your input is sent to the service hosting the model you chose: Anthropic, Google, OpenAI, SpaceXAI, ElevenLabs, fal.ai or Alibaba Cloud Model Studio. We only run models under terms that exclude training on your content, except the models listed as exceptions on our models page. The models page lists every service, what we run there and what its terms allow.
Business customers: when a business uses Crust, we process the personal data in its content as a processor on the business’s behalf, under our Data Processing Agreement. This Policy covers the data we handle as controller.
Processors that run the Service on our behalf, including:
- Stripe: billing;
- PostHog: usage statistics (EU);
- Sentry: error monitoring (EU);
- Google Cloud and Firebase: hosting, file storage and database (EU);
- Cloudways and Netcup (Germany): running our servers;
- Postmark: transactional email;
- Twigeo AB: engineering support for our backend (Sweden, Portugal).
We have or will put in place Data Processing Agreements with each of these.
Authorities or advisors where required by law, or to establish or defend legal claims.
5. Where data is stored, and international transfers
Uploaded files, generated results and our database are stored in Google Cloud in the EU. Usage statistics and error reports are processed in the EU, and our account backend runs in Germany.
Some AI providers process data outside the EU/EEA, mainly in the United States. Our models page and our Data Processing Agreement show where. For those transfers we rely on an adequacy decision, including the EU-U.S. Data Privacy Framework where the recipient is certified under it, or on the EU Standard Contractual Clauses.
6. How long we keep data
We keep personal data only as long as needed for the purposes above, then delete or anonymise it:
- Account data and Your Content: while your account exists. When your account is deleted, we delete this data within 14 days. Copies in backups are deleted when the backups expire, within a further 7 days.
- Billing records: as required by Swedish accounting law (7 years).
- Usage statistics: 1 year.
- Error logs: 1 year.
7. How we protect data
We use appropriate technical and organisational measures, including encryption in transit (TLS 1.2 or higher) and at rest, storage in the EU, access limited to the people who need it and protected with two-step verification, and time-limited links for accessing uploaded files. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
8. Your rights
Under the GDPR you can ask to: access your data; correct it; delete it; restrict or object to processing; receive a portable copy; and withdraw consent at any time (without affecting prior processing). To exercise these, contact privacy@crustsystem.com.
You also have the right to complain to your supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY), imy.se.
9. Cookies and the website
Our websites use cookies. Non-essential cookies are only set if you accept them in our cookie banner, and you can change your choice at any time.
10. Children
Crust isn’t directed at people under 18, and we don’t knowingly collect their data.
11. Changes
We may update this Policy. We’ll post the new version with a new “Last updated” date and, for material changes, notify you via a notification within the app.
12. Contact
Smulp AB, Riddarhuskajen 1, 111 28 Stockholm, Sweden
privacy@crustsystem.com