Privacy Policy

2 Scope & Applicability

This Privacy Policy governs the processing of personal data collected through:

• Our public marketing website and documentation at https://crdpay.com.
• Account creation, onboarding, and workspace administration.
• Agency portals, client access portals, team dashboards, and associated software features.
• Direct customer support communications, inquiry forms, and billing transactions.

This policy does not cover the independent privacy practices of our customer agencies with respect to their own end-clients outside the direct technical boundaries of CRDPay.

3 Information We Collect Directly

We collect personal information directly when you interact with CRDPay:

• Account & Profile Information: Full name, professional email address, workspace name, account password (cryptographically hashed), and optional avatar images.
• Communication & Inquiries: Messages, feedback, contact requests, and correspondence sent to hello@crdpay.com.
• Billing & Commercial Data: Company name, tax identification number, billing address, and transaction identifiers associated with SaaS subscriptions.

4 Information Collected Automatically

When accessing CRDPay, technical information is logged automatically for security, performance, and operational integrity:

• Device & Connection Data: IP address, browser user-agent, operating system, network routing details, and requested resource URLs.
• Session & Usage Metrics: Timestamps of logins, feature utilization, error logs, and session durations necessary to preserve system stability and rate-limiting defenses.

5 Workspace & Customer Content Data

Within agency workspaces, subscribers upload and manage business data, including client profiles, project milestones, task descriptions, deliverables, uploaded files, timesheets, and internal messages.

Customer Content remains the proprietary property of the customer agency. CRDPay processes this data exclusively as an infrastructure provider to deliver the SaaS service and does not mine Customer Content for advertising or resale.

6 Controller vs. Processor Roles

Under European and international data protection laws, roles are delineated as follows:

• CRDPay as Data Controller: We act as the Controller for account registration details, direct subscriber communications, and commercial billing records.
• CRDPay as Data Processor: For all Customer Content stored within agency workspaces (including client portal records, team tasks, and files), the subscribing agency acts as the Data Controller, and CRDPay acts strictly as the Data Processor.

7 Legal Bases for Processing

We process personal data based on the following lawful grounds under GDPR Article 6:

• Performance of a Contract: Providing access to the CRDPay platform, managing user credentials, and delivering subscribed software features.
• Legitimate Interests: Protecting the infrastructure from cyberattacks, enforcing rate limits, ensuring software reliability, and preventing fraudulent activity.
• Legal Obligations: Compliance with applicable tax, financial accounting, and regulatory reporting mandates.
• Consent: Where explicitly requested for optional features or direct marketing communications.

8 How We Use Personal Data

Collected data is used strictly for legitimate business operations:

• Authenticating subscribers, team members, and authorized clients.
• Facilitating task assignments, milestone approvals, and file sharing within designated workspaces.
• Delivering automated transactional notifications, password resets, and email verifications.
• Processing subscription renewals and generating invoices.
• Providing dedicated technical support through hello@crdpay.com.

9 Cookies, Local Storage & Tracking Technologies

CRDPay utilizes strictly necessary and functional cookies to ensure secure platform operation:

• Authentication Cookies: WordPress authentication cookies (wordpress_logged_in_*, wordpress_sec_*) to maintain secure administrative and workspace sessions.
• Commerce Session Cookies: WooCommerce cart and session identification cookies (woocommerce_items_in_cart, wp_woocommerce_session_*) to preserve checkout and subscription state.
• UI State & Preferences: Browser LocalStorage utilized to store collapsed sidebar states and interface theme preferences.

We do not install behavioral advertising cookies, cross-site trackers, or third-party ad retargeting pixels on CRDPay.

10 WooCommerce & E-Commerce Data Processing

CRDPay utilizes WooCommerce as part of its commercial billing and order-management framework. When you initiate a subscription, WooCommerce records order metadata, including your account ID, billing contact details, plan selection, and transaction status.

These records are securely retained within our isolated database to fulfill statutory accounting and financial compliance obligations.

11 Payment Processing & Billing Infrastructure

Where enabled, subscription payments are processed through the authorized payment provider identified during checkout.

The authorized payment provider handles payment card authorization, transaction processing, statutory tax calculation, and fraud mitigation under its applicable terms.

12 Email Communications & SMTP Infrastructure

All platform transactional emails—such as registration verifications, password reset links, invite tokens, and workspace alerts—are delivered via authenticated SMTP originating from hello@crdpay.com.

Domain-level authentication protocols, including SPF, DKIM, and DMARC, are configured to protect email integrity and prevent address spoofing.

13 Data Sharing & Third-Party Disclosures

We do not sell, rent, lease, or monetize customer data. Personal data is shared strictly under the following limited conditions:

• Authorized Subprocessors: With certified cloud infrastructure providers who assist in operating CRDPay under strict confidentiality agreements.
• Legal & Regulatory Compliance: When compelled by valid legal summons, court order, or binding law enforcement request.
• Business Transitions: In the event of a merger, corporate restructuring, or asset acquisition, subject to the recipient adhering to this Privacy Policy.

14 Authorized Subprocessors & Infrastructure

CRDPay engages the following verified subprocessors for platform operations:

15 International Data Transfers

Where data is transferred across international borders, CRDPay implements approved transfer mechanisms, including Standard Contractual Clauses (SCCs) adopted by the European Commission and relevant UK adequacy frameworks, ensuring an equivalent level of personal data protection.

16 Data Security Measures

We employ defense-in-depth security standards to protect platform data:

• Encryption: Enforced TLS/HTTPS encryption for all data in transit across modern cryptographic ciphers.
• Authentication: Secure salted password hashing and role-based workspace authorization.
• Multi-Tenant Isolation: Strict data layer tenant isolation ensuring client portals cannot access neighbor agency data.
• Continuous Backups: Automated daily database and file snapshots maintained with restricted access controls.

17 Data Retention Schedule

We retain personal information only as long as necessary to fulfill the operational purposes described herein:

• Active User Accounts: Maintained for the duration of an active workspace subscription.
• Workspace Content: Preserved during active tenancy and for a 30-day grace period post-cancellation before scheduled deletion.
• Financial & Order Records: Retained for 7 years to satisfy mandatory tax and accounting statutory regulations.
• Server Security Logs: Rotated and purged automatically within 90 days.

18 Account Deletion & Purge Procedures

Account holders may request complete deletion of their account and associated workspaces at any time by contacting hello@crdpay.com.

Upon identity verification, customer accounts and active workspace content are scheduled for permanent purge, except for records required by statutory law.

19 Your Privacy Rights (GDPR & Global Standards)

Under applicable data protection legislation, you possess the following individual rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data where statutory grounds are satisfied.
• Right to Restriction: Request restriction of processing under certain legal conditions.
• Right to Data Portability: Request export of your account data in a structured, machine-readable format.
• Right to Object: Object to processing carried out under our legitimate interests.

To exercise any of these rights, email hello@crdpay.com. We respond to verified requests within thirty (30) days without charge.

20 California Privacy Rights (CCPA / CPRA)

For California residents, the California Consumer Privacy Act as amended by the CPRA grants specific privacy rights:

• No Sale or Sharing of Personal Data: CRDPay does not sell personal information and has not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.
• Right to Know & Delete: You have the right to request disclosure of categories and specific pieces of personal data collected, and request deletion subject to statutory exceptions.
• Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

21 Children's Privacy

CRDPay is a business-to-business (B2B) SaaS workflow platform designed strictly for professional agencies, enterprises, and adult commercial operators. Our services are not directed to individuals under eighteen (18) years of age, and we do not knowingly collect personal data from children.

22 Security Incident & Breach Notification

CRDPay maintains an incident response protocol. In the event of a confirmed security incident impacting customer personal data, we will notify affected subscribers and relevant supervisory authorities within required statutory timeframes (e.g., within 72 hours under GDPR) following validation.

23 Third-Party Links & Integrations

Our website and client workspaces may contain links to third-party services or documentation. We do not control and are not responsible for the privacy practices or content of third-party platforms. We encourage you to review their policies independently.

24 Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect service evolutions, technological advancements, or regulatory amendments. Updates will be posted on this page with a revised "Effective Date". Continued use of CRDPay following an update constitutes acceptance of the amended terms.

25 Data Protection Officer & Privacy Contact

For inquiries, Data Processing Agreement (DPA) requests, or to exercise your individual data rights: