Skip to content
NewMCP server for AI agents — plan and launch campaigns from Claude
croud

Legal · Updated October 1, 2026

Privacy Policy

This policy explains what personal data Croud processes when you use our website, app, API and MCP server, why we process it, and the choices you have.

1. Scope

Croud, Inc. (“Croud”) is the controller of personal data described here. Where we process data inside a workspace on behalf of a customer (for example, campaign briefs or team members' activity), we act as a processor under our data processing terms, and the customer's own privacy notice applies.

2. Information we collect

You provide

  • Account details: name, email, password (stored as a salted hash), profile photo, timezone and two-factor settings.
  • Workspace details: business name, website, industry, country, team members and roles.
  • Marketplace content: ad policies, rate cards, campaigns, creatives, personas, messages and approval decisions.
  • Billing details: plan, invoices and billing contact. Card details are collected and stored by Stripe, not by Croud.

From connected platforms

  • Instagram (via Meta's APIs, with your authorization): account ID, username, profile, follower counts, audience and post insights, and publishing permissions. Access tokens are encrypted at rest.

Automatically

  • Usage and device data: IP address, browser, pages viewed, API and MCP requests, and security events such as sign-ins.
  • Attribution data: referral code and UTM parameters from the link that brought you to Croud.

3. How we use information

  • Provide the marketplace: matching campaigns to eligible accounts, approvals, publishing, reporting, escrow and payouts.
  • Run AI features you request, and meter AI credits and API usage.
  • Bill subscriptions and credit packs, apply promo codes, and pay referral rewards.
  • Secure the service: authentication, fraud prevention, rate limiting and audit logs.
  • Communicate with you about your account, and — if you subscribe — product updates. You can unsubscribe at any time.
  • Improve Croud using aggregated and de-identified usage statistics.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you; our legitimate interests in operating, securing and improving the service; your consent (for example, the newsletter and optional cookies), which you can withdraw at any time; and compliance with legal obligations such as tax and anti-fraud requirements.

5. How we share information

  • Marketplace counterparties. Advertisers see creator account profiles, rate cards and performance; creators see campaign briefs and advertiser profiles.
  • Service providers. Hosting, email delivery, payments (Stripe), AI model providers (such as OpenRouter, Anthropic, OpenAI and Google) and error monitoring, under contracts that restrict their use of data.
  • Your integrations. Webhook endpoints, API clients and MCP agents you configure receive the data you direct to them.
  • Legal and safety. When required by law or to protect rights, safety and the integrity of the marketplace.
  • Business transfers. As part of a merger, acquisition or asset sale, subject to this policy.

We do not sell personal data or share it for cross-context behavioral advertising.

6. AI processing

When you use AI features, the prompt, persona and relevant campaign context are sent to the selected AI provider to generate a response. We do not allow providers to train models on your data under our agreements. If you connect your own provider key, the request is made under your account with that provider and its terms apply.

7. Cookies

  • Essential: session cookie for sign-in, CSRF and security protections.
  • Attribution: a referral cookie (60 days) and a UTM cookie (30 days) to credit the person or campaign that referred you.
  • Preferences: theme and sidebar state, and your cookie choice (croud_consent, 12 months).
  • Analytics: only if you choose “Accept all” in the cookie banner.

We do not use third-party advertising cookies on the Croud website. To change your choice, clear the croud_consent cookie (and site data) in your browser and pick again from the banner.

8. International transfers

We are based in the United States and process data there and wherever our providers operate. For transfers from the EEA, UK or Switzerland we rely on Standard Contractual Clauses or other approved mechanisms.

9. Retention

We keep account and workspace data for as long as your account is active. Audit logs are retained according to your plan. Billing and payout records are kept as required by tax and accounting law (typically seven years). When you delete your workspace or account, we delete or de-identify personal data within 30 days, except where we must keep it longer.

10. Security

We use encryption in transit and at rest for sensitive data (including OAuth tokens and API provider keys), hashed passwords, optional two-factor authentication, role-based access, signed webhooks and audit logging. No system is perfectly secure; tell us about vulnerabilities at support@croud.ai.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and to not be discriminated against for exercising these rights. Email support@croud.ai to make a request; we'll verify your identity and respond within the time required by law. You may also complain to your local data protection authority.

12. Children

Croud is not directed to children and we do not knowingly collect data from anyone under 18.

13. Changes

We will post updates here and, for material changes, notify account owners by email or in the app before they take effect. See also our Terms of Service.

14. Contact

Croud, Inc. — support@croud.ai