Crittiks Privacy Policy

Last updated: 3 November 2026

1. Who we are

Crittiks is operated by Crittiks Group Pty Ltd (ABN 55 654 097 784) (“Crittiks”, “we”, “us”). We provide the Crittiks business platform at os.crittiks.com and the website at crittiks.com. Crittiks serves businesses globally, including in Australia, the European Union, the United Kingdom, and other regions.

You can contact us about privacy at support@crittiks.com or at Suite 073, 44 Lakeview Dr, Scoresby VIC 3179, Australia.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

EU/UK representatives. Crittiks’ processing of personal data from individuals in the EU and UK is, at this stage, occasional, limited in scale, and unlikely to result in a risk to the rights and freedoms of those individuals. On this basis, Crittiks relies on the exemption in Article 27(2) GDPR (and the equivalent UK GDPR provision) and has not appointed a formal EU or UK representative at this time. We keep this position under regular review as our EU/UK customer base grows, and will appoint representatives if our processing ceases to qualify for this exemption.

2. Two kinds of information

Information about our customers and users. When a business signs up for Crittiks, or a person uses Crittiks, we collect information about them to run the service. For this information we decide how it is used, and this policy applies in full.

Information our customers put into Crittiks. Our customers store their own business information in Crittiks, including personal information about their contacts, their clients, their team and the people they send agreements to. We hold and process that information on our customer’s behalf and on their instructions. Our customer decides what goes in, why, and how long it stays, and is responsible for their own privacy obligations to those people, including under GDPR/UK GDPR if their contacts are located there. If you are a contact of one of our customers and want to access or correct your information, please contact that business first; we will help them respond.

3. What we collect

Customer content can include contact and company records, deals, quotes, invoices and payment records, documents and files, agreements and signatures, messages and attachments, meeting details, calendar events, meeting transcripts and notes, tasks and projects, and the emails of a connected mailbox (including emails with people who are not contacts, which are private to the team member who connected it).

Electronic signatures. When someone signs a document through Crittiks, we record the evidence needed for the signature’s audit trail: the signer’s name, email address, signature image, optional phone number and job title, the time, their IP address, their browser and device, and, only if they allow it, their approximate location. This evidence is printed on the Certificate of Completion attached to the signed document and is kept with it.

Sensitive information. Crittiks is not designed to collect sensitive information such as health information, and our Terms of Service require customers not to store it unless they have a lawful basis and appropriate consent.

4. Legal basis for processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on the following legal bases to process account information and to operate the service:

• Contractual necessity — processing needed to provide the Crittiks service you’ve signed up for (account creation, billing, service delivery).
• Legitimate interests — security, fraud prevention, service improvement, and the ordinary operation of the business, balanced against your rights and interests.
• Consent — where required, for example for marketing communications you can opt out of at any time.
• Legal obligation — where processing is required to comply with a legal or regulatory requirement.

For customer content, Crittiks acts as a processor. The customer, as controller, is responsible for identifying the correct legal basis for the personal data they store in Crittiks about their own contacts and clients.

5. How we use information

We use information about our customers and users to: - provide, operate, secure and support Crittiks, including signing in, sending the emails the service sends, and running connected integrations you choose to turn on; - process payments for Crittiks subscriptions and manage billing; - keep the service secure, including detecting misuse, fraud and security incidents, and keeping audit records; - improve and fix the service, using usage and error information; - communicate with you about your account, changes to the service or these terms, and, where permitted, product news you can opt out of; - meet legal obligations and enforce our terms.

We use customer content only to provide the service to that customer and as they instruct, for example to send their invoices, sync their accounting system or deliver their messages. We do not sell personal information, and we do not use customer content to train artificial intelligence models.

6. AI features

Some Crittiks features use artificial intelligence, for example drafting task lists from a brief or writing a description. When you use these features, the text you provide and the related workspace information needed for the request are sent to our AI provider, Anthropic, to generate the result. Anthropic processes the request on our behalf under our commercial agreement with them and does not use your data to train its models under those terms. Workspace owners can control which team members can use AI features.

Meeting recordings (AI Notetaker). A team member can record a meeting from their own browser: the microphone and, where the browser allows it, the meeting tab’s audio. Crittiks does not join meetings as a bot. Before a recording starts, the person recording must confirm that they have told everyone in the meeting it is being recorded and transcribed and that they agree (a workspace owner or admin can turn this confirmation off; the person recording remains responsible for consent). The audio is sent to a speech-to-text provider, Groq or AssemblyAI, to produce a transcript, and the transcript is sent to Anthropic to produce a summary and suggested tasks. By default the audio is deleted as soon as the transcript is saved; a workspace owner or admin can choose to keep recordings for between 1 and 365 days. Recording other people is regulated by surveillance and listening-device laws, which differ between places, and some of them require everyone’s consent. The person recording and their organisation are responsible for complying with them.

7. Connected services and Google user data

Customers and users can connect third-party services. When you connect one, we receive and store (encrypted) only what is needed to run that feature:

• Email mailboxes (Gmail, Outlook and Microsoft 365, or another mailbox over IMAP): Gmail, and Outlook where available, are connected through our provider Unipile; Outlook can also be connected directly through Microsoft; other mailboxes connect directly to your mail server. We store every message of the connected mailbox, including emails with people who are not contacts in your Crittiks workspace and emails with your own colleagues, so the team member can read them in their Crittiks inbox, and we send the emails they send from Crittiks. Drafts, spam and deleted items are not stored, nor are messages whose only other party is an address the team member has asked Crittiks never to log. When a mailbox is connected we import its recent history (the last 30 days). Every email is private to the person who connected the mailbox: no one else in the workspace, including its owners and administrators, can see it. An email with a person who matches a contact appears on that contact’s record for the person who connected the mailbox, and only that person can choose to share it with colleagues who can see that contact; emails with people who are not contacts can never be shared. We track opens, clicks and replies on emails sent from Crittiks where you use that feature.
• Calendars and video meetings (Google Calendar and Google Meet, Microsoft Outlook and Teams, Zoom): we read your primary calendar’s events so they appear on your Crittiks calendar (visible only to you), and create, update and cancel meetings you schedule in Crittiks.
• Accounting (Xero, QuickBooks): we send your customers, invoices and payments to the accounting organisation you connect, and read back payments recorded there.
• Payments (your own Stripe account): your customers pay your invoices through your Stripe account; we record the payment against the invoice.

You can disconnect any of these at any time from Crittiks, which stops our access and deletes the stored access tokens. When you disconnect a mailbox linked through Unipile, we also ask Unipile to delete the connection. Disconnecting a mailbox always deletes its emails with people who are not contacts; you can choose to delete its other private emails too.

Google API Services. Crittiks’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing calendar and meeting features you request; we do not use it for advertising, we do not sell it, we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where the data is aggregated and anonymised; and we do not use it to train AI models.

8. Who we share information with

We share personal information only: - with service providers that host and run Crittiks for us, listed in our Sub-processors document, under contracts that require them to protect it and use it only for our purposes, and, where the GDPR or UK GDPR requires a transfer safeguard, a recognised mechanism such as the Standard Contractual Clauses or the UK International Data Transfer Addendum; - with services you choose to connect, as described in Section 7; - within a customer’s workspace, according to the access settings the workspace owner chooses, and with a customer’s own clients where the customer shares information through the client portal; - where required by law, a court or a government authority, or to protect the rights, safety or property of Crittiks, our customers or others; - in connection with a sale, merger or restructure of our business, subject to this policy.

9. Storing and sending information overseas

Crittiks’ main database and application run in India (DigitalOcean, Bangalore). Uploaded files are stored in Singapore (DigitalOcean). Some of our service providers process information in the United States, Japan and other countries, as listed in our Sub-processors document.

For EU/UK personal data, where the GDPR or UK GDPR requires a safeguard for a transfer to these locations, we rely on a recognised mechanism, such as the Standard Contractual Clauses (EU) or the International Data Transfer Addendum (UK).

For all other customers, we take reasonable steps, including contractual terms, to make sure these providers handle personal information consistently with the Australian Privacy Principles.

10. Security

We protect information with measures including: encryption in transit (HTTPS); encryption at rest of stored secrets, access tokens and integration credentials; passwords stored only as secure hashes; one-time links (such as signing and invoice links) stored only in hashed form and set to expire; strict separation of each customer’s data at the database level; role-based and feature-level access controls set by each workspace owner; optional two-factor authentication; audit records of security-relevant actions; and restricted access to production systems.

No system is perfectly secure. If we become aware of a personal data breach: - for individuals and regulators in Australia, we will notify as required by the Notifiable Data Breaches scheme; - for individuals and regulators in the EU/UK, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where required by GDPR/UK GDPR, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

11. How long we keep information

• Account information is kept for as long as the account is active. When you delete your account we remove your sign-in credentials and sessions and replace your name and email address with anonymous values straight away.
• Billing and tax records are kept for 7 years, to meet tax and accounting record-keeping obligations.
• Meeting audio is deleted as soon as its transcript is saved, unless the workspace chooses to keep recordings (1 to 365 days); audio that could not be processed is deleted after 30 days. Transcripts and summaries are kept until deleted by a user or with the meeting or workspace.
• Emails from a connected mailbox stay with the contact records they belong to until deleted. Emails with people who are not contacts are kept only while the mailbox stays connected.
• Customer content is kept for as long as the customer keeps it in Crittiks. When a workspace owner deletes the workspace, it enters a 14-day grace period during which it can be restored, after which we delete its data and files, except where the law requires us to keep something.
• Signed agreements and their audit evidence are kept with the customer’s workspace so the record remains complete; they are deleted with the workspace.
• Activity and audit logs are kept for 365 days and then deleted.
• Backups are overwritten on a rolling basis and are not restored except to recover the service.

12. Your choices and rights

You can access and update your profile, change your email address and password, see and end your active sessions, and turn two-factor authentication on or off from your account settings. A workspace owner can export all of the workspace’s data and delete the workspace. You can delete your own account unless you are the only owner of a workspace.

If GDPR or UK GDPR applies to you, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and the right to lodge a complaint with your local supervisory authority.

You can ask us to exercise any of these rights, or the equivalent rights under the Australian Privacy Principles, by contacting support@crittiks.com. We will respond within 30 days. If your request concerns customer content held by one of our customers, we will refer you to that customer, as they control it.

You can opt out of marketing emails at any time using the link in the email. Service emails, such as security and billing notices, are part of the service and cannot be opted out of while your account is active.

13. Complaints

If you have a concern about how we handle personal information, contact us first at support@crittiks.com. We will investigate and respond within 30 days.

• If you are in Australia and not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
• If you are in the EU, you can complain to your local data protection authority.
• If you are in the UK, you can complain to the Information Commissioner’s Office (ico.org.uk).

14. Data Processing Addendum

For business customers processing personal data through Crittiks on behalf of their own clients — including EU/UK-governed processing — a Data Processing Addendum incorporating Standard Contractual Clauses (EU) or the International Data Transfer Addendum (UK) is available. Contact support@crittiks.com to request and execute one, or see our standard DPA document.

15. Cookies

Crittiks (the platform, at os.crittiks.com) uses only essential cookies, to keep you signed in and to protect the service. We do not use advertising cookies in the platform. Our marketing website, crittiks.com, may use analytics cookies to understand how visitors use the site — see our Cookie Policy for details, and to manage your preferences (including a cookie consent banner for EU/UK visitors, where required).

16. Children

Crittiks is a business service and is not intended for anyone under 18.

17. Changes

We will update this policy when our practices change and post the new version here with a new date. If a change is significant, we will notify workspace owners by email or in the service before it takes effect.

Contact: support@crittiks.com, Crittiks Group Pty Ltd, Suite 073, 44 Lakeview Dr, Scoresby VIC 3179, Australia.