Privacy Policy

Effective from 13 May 2026. The Pepper-specific disclosure was added on 14 August 2026 and applies when Pepper is enabled. Active customers receive 30 days' email notice of material changes that require advance notice.

1. Data controller

Crubby is operated by UPPY SRL, VAT number 04914300167, Bolagnos 29, 24043 Caravaggio (BG), Italy. As the data controller we can be reached at fil@crubby.com. For privacy-specific requests write to privacy@crubby.com.

2. Data we collect

  • Account: email, restaurant name, password (hashed with bcrypt), notification preferences.
  • Menu content: names, prices, descriptions, allergens and product images you upload to the CMS. This is your venue's business data, not personal data.
  • Your end customers' data (only if you use Crubby Pay): optional email for the receipt, amount paid, payment method (Apple Pay / Google Pay / card). Card numbers never pass through our servers — they are handled by Stripe.
  • Diagnostics: application error logs (Sentry), anonymous product usage statistics (PostHog, optional), web server logs (IP, user agent, path) kept for 90 days.
  • Billing: company name, VAT number, address and payment method for the Crubby subscription (processed by Stripe on our behalf).
  • Pepper AI on WhatsApp: the authorised operator's phone number, WhatsApp technical identifiers, message content and delivery status and, when used, voice notes, images or documents. We link this information to the authorised Crubby account and venue to identify the operator, answer operational requests, prepare changes, record confirmations and maintain an audit trail. Simple supported commands can be processed without sending their content to an AI model.

3. Legal basis for processing

Under art. 6 GDPR, the legal bases on which we process data are:

  • Performance of a contract (art. 6.1.b): account, menu, payment processing.
  • Legal obligation (art. 6.1.c): retention of invoices, recording of takings, anti-money-laundering.
  • Legitimate interest (art. 6.1.f): error diagnostics, security, fraud prevention and protection of Pepper accounts against unauthorised or cross-tenant actions.
  • Explicit consent (art. 6.1.a): behavioural analytics (PostHog), heatmaps (Clarity), marketing and advertising (Meta pixel), newsletter. Revocable at any time from the cookie banner.

4. Purposes of processing

  • Provide and maintain the service (account, menu, payments).
  • Operational communications: payment confirmations, error alerts, password resets, subscription expiry.
  • Improve the product: understand which features you use, identify bugs, optimise performance.
  • Measure and optimise our marketing campaigns, and show Crubby ads to people who have visited the site (only with consent).
  • Comply with Italian tax and accounting obligations.
  • Provide Pepper on enabled channels, authenticate authorised operators, answer requests and apply confirmed changes within their account permissions.

5. Retention periods

  • Active account: for as long as you keep the account, +30 days after deletion for export and reconsideration.
  • Full backups: 90 days rolling (Supabase point-in-time recovery).
  • Web server and application logs: 90 days.
  • Security logs (logins, sensitive access): 12 months.
  • Invoices and tax documents: 10 years (legal obligation).
  • Pepper conversations and media: message content, conversation summaries and Crubby-hosted copies of images or documents are deleted after 90 days, unless a different period is configured and disclosed or retention is required by law. The phone-to-account link remains until the channel is disconnected or an erasure request is fulfilled. Accounting usage records may be retained in anonymised form.

6. Your GDPR rights

You have the right to: access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), portability (art. 20), objection (art. 21). To exercise them write to privacy@crubby.com attaching an identity document. We respond within 30 days.

A Pepper erasure request removes the operator identity, conversations, summaries, feedback and stored media linked to that operator, subject to legal retention duties. If a storage provider is temporarily unavailable, the deletion is retried and the technical reference is retained only for that retry. You can also send STOP on WhatsApp at any time to disable future Pepper notifications.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) if you believe the processing infringes the GDPR.

7. Sub-processors

The providers below may process data to deliver Crubby. Contractual terms, data processing agreements and transfer safeguards apply where required by their role and the applicable law.

  • Vercel (Next.js hosting, USA) — Standard Contractual Clauses 2021/914.
  • Supabase (database + auth, region eu-central-1 Frankfurt, Germany) — DPA available.
  • Cloudinary (image CDN, EU primary, US backup) — DPA + SCC.
  • Stripe (payments, Ireland + USA) — Stripe DPA + PCI-DSS Level 1.
  • Resend (transactional email, USA) — SCC + DPA.
  • PostHog (analytics, EU instance) — only with explicit cookie consent.
  • Sentry (error tracking, USA) — SCC; no personally identifiable data is logged (PII scrubbing active).
  • Microsoft Clarity (heatmaps, USA) — only with explicit consent, can be disabled.
  • Meta Platforms Ireland (Facebook/Instagram advertising pixel, Ireland + USA) — only with marketing consent; SCC + EU-US Data Privacy Framework.
  • Meta Platforms Ireland / WhatsApp Ireland (WhatsApp Business Platform and Cloud API) — phone number, technical identifiers, messages, media and delivery status needed to transport Pepper conversations.
  • Hangzhou DeepSeek Artificial Intelligence Co., Ltd.(advanced Pepper inference, only when enabled) — instructions, a recent conversation window, a short summary and the minimum operational context needed to answer or prepare a proposal. Advanced WhatsApp AI remains disabled until the required notice and transfer safeguards have been approved.
  • OpenAI contractual entity applicable to our account(optional voice-note transcription) — audio and the technical data needed to produce the transcript, only when that feature is enabled.

To obtain the full DPA, write to privacy@crubby.com.

8. Transfers outside the EU

Some providers (including Vercel, Stripe, Resend, Sentry, Clarity, Meta and, when enabled, OpenAI) may involve transfers to the United States. Such transfers take place under the provider's applicable transfer mechanism, including Standard Contractual Clauses (EU 2021/914) and, where applicable, EU-US Data Privacy Framework certification. DeepSeek states that it processes data in the People's Republic of China; advanced WhatsApp AI is not enabled until the necessary legal assessment, notice and safeguards are approved.

9. Security measures

  • TLS 1.3 encryption for all data in transit.
  • Database encrypted at rest (AES-256) managed by Supabase EU.
  • Passwords hashed with bcrypt cost factor 12.
  • Optional two-factor authentication for restaurant admins (coming soon).
  • Audit log of all cross-tenant administrative actions.
  • Daily backups with 7-day point-in-time recovery; weekly backups kept for 90 days.

Crubby uses three categories of cookies:

  • Strictly necessary (always on): session token, CSRF token, language preference. Without them you cannot use the service.
  • Analytics and diagnostics (only with consent): PostHog product analytics, Microsoft Clarity heatmaps.
  • Marketing (only with consent): the Meta pixel (Facebook/Instagram), which measures our advertising campaigns and lets us show Crubby ads to people who have visited the site. It activates only after «Accept all cookies» and is never loaded on our customers' public menu pages.

Consent to analytics and marketing cookies is optional and can be withdrawn at any time, just as easily as you granted it:

11. Children's data

Crubby is a B2B service intended for adult restaurateurs. We do not knowingly collect data on children under 16. If you become aware of an account opened by a minor, report it to privacy@crubby.com and we will proceed with removal.

12. Changes to this policy

We will update this page when sub-processors, purposes or security measures change. Active customers are notified by email at least 30 days in advance of material changes.

Last updated: 14 August 2026 · Terms of Service