CrateHQ Privacy Policy

Last Updated: August 8, 2026

This Privacy Policy explains how CrateHQ ("we", "us", "our") collects, uses, discloses, and protects information when you use our wholesale ordering platform (the "Service").

CrateHQ is operated by Vinay Padmanabhi, doing business as CrateHQ.

1. Information We Collect

A. Information you provide to us

  • Account information: name, email address, business name, business address, phone number
  • Payment information: payment details for your CrateHQ subscription are collected and processed by Stripe; we do not store full payment card details. CrateHQ does not process payments on behalf of you or your customers.
  • Communications: messages you send to us via email or in-product
  • Customer Data: information about your wholesale customers and their orders that you upload or that flows through the Service

B. Information from third-party services you connect

  • Shopify: store data, products, customers, orders (only data you authorize via OAuth)
  • Square: store data, products, customers, orders (only data you authorize via OAuth)
  • QuickBooks: invoice and customer data, accounts receivable information (OAuth)
  • ShipStation: shipment and tracking data (OAuth or API credentials you provide)

We only access third-party data you authorize.

C. Information we collect automatically

  • Usage data: pages visited, features used, time spent, actions taken
  • Device information: browser type, operating system, IP address, device identifiers
  • Cookies and similar technologies: for session management, preferences, and analytics

2. How We Use Information

We use information to:

  • Provide, maintain, and improve the Service
  • Bill subscription fees and manage subscriptions
  • Communicate with you about the Service, including support, billing, and product updates
  • Develop new features and analyze usage patterns
  • Detect, prevent, and address fraud, security issues, and policy violations
  • Comply with legal obligations
  • Enforce our Terms of Service

3. How We Share Information

We share information with:

  • Service providers who help us operate the Service (hosting, payment processing via Stripe, analytics, customer support tools, email delivery). These providers are bound by confidentiality obligations.
  • Third-party integrations you connect (Shopify, Square, QuickBooks, ShipStation) as necessary to provide the Service.
  • Advertising partners: With your consent, we share limited event and technical data, such as page URLs, sign-up and trial events, browser/device information, IP address, and cookie or similar identifiers, with Meta Platforms via the Meta Pixel and with OpenAI via the OpenAI measurement pixel, to measure and target Crate's own advertising. You can withdraw consent anytime via Cookie settings, and we honor Global Privacy Control (GPC) signals.
  • Legal authorities when required by law, subpoena, or court order, or when necessary to protect our rights or the safety of others.
  • Business transfers in connection with a merger, acquisition, sale of assets, or bankruptcy. We will notify you of any such transfer.

We do not sell personal information.

4. Data Retention

  • Account information is retained for as long as your account is active and as needed to provide the Service.
  • After account termination, we retain Customer Data for 30 days to allow export, then delete it within a reasonable period unless retention is required by law.
  • We may retain aggregated, de-identified data indefinitely for analytics and Service improvement.
  • Backup copies may persist for up to 90 days after deletion before being overwritten in the ordinary course.

5. Security and Incident Notification

We use commercially reasonable administrative, technical, and organizational measures to protect your information, including encryption in transit (TLS), access controls, authentication, and regular security review. No system is completely secure, and we cannot guarantee absolute security.

If we confirm a security incident involving unauthorized access to your information, we will notify you without undue delay and provide reasonable information and cooperation regarding the incident.

6. Your Rights

Depending on your location, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Delete your information (subject to legal retention requirements)
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent (where processing is based on consent)

To exercise these rights, contact us at vinay@cratehq.ai. We will respond within the timeframes required by applicable law.

7. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended):

  • Right to know: what personal information we collect, use, and share
  • Right to delete: request deletion of personal information (subject to exceptions)
  • Right to correct: request correction of inaccurate personal information
  • Right to opt out of sale or sharing: we do not sell your personal information. With your consent, we share limited event and technical data, such as page URLs, sign-up and trial events, browser/device information, IP address, and cookie or similar identifiers, with Meta and OpenAI for cross-context behavioral advertising (Crate's own ads); you can opt out anytime via Cookie settings, and we honor Global Privacy Control — when GPC is present we do not share for advertising
  • Right to limit use of sensitive personal information: we do not use sensitive personal information for purposes requiring this right
  • Right to non-discrimination: we will not discriminate against you for exercising privacy rights

To exercise these rights, contact us at vinay@cratehq.ai.

8. European Economic Area, United Kingdom, and Switzerland Residents (GDPR)

If you are in the EEA, UK, or Switzerland, you have additional rights under data protection laws:

  • Lawful basis for processing: we process data based on contractual necessity, legitimate interests, or your consent
  • Right to lodge a complaint with a supervisory authority in your jurisdiction
  • Right to data portability in a machine-readable format

We may transfer data outside the EEA to the United States. When we do, we use appropriate safeguards such as Standard Contractual Clauses.

9. Children's Privacy

The Service is not intended for use by children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately.

10. Cookies and Tracking

We use cookies and similar technologies to:

  • Maintain your login session
  • Remember your preferences
  • Analyze usage patterns and Service performance
  • With your consent, measure and target Crate's advertising (the Meta Pixel and the OpenAI measurement pixel)

You can change your analytics and advertising choices anytime via the Cookie settings control on our site and app, or through your browser settings. We honor Global Privacy Control (GPC), which disables advertising cookies. Disabling essential cookies may impact Service functionality.

We do not currently respond to "Do Not Track" signals from browsers.

11. Text Messaging (SMS)

If you provide your mobile phone number to us or to a merchant that uses Crate (for example, giving your number at a cafe register to join that cafe's loyalty program), we may send you a text message related to that program, such as a one-time notification that you earned a loyalty reward. Consent to receive text messages is never a condition of any purchase.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, excluding the vendors and platforms that deliver text messages on our behalf (our SMS provider), solely to the extent necessary to deliver those messages. All of the sharing categories described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with, or sold to, any third party.

Message frequency varies by program; cafe loyalty notifications are limited to a single message. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. Full text-messaging terms are in our Terms of Service.

12. International Data Transfers

We process data in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-product notification. The "Last Updated" date at the top reflects the most recent revision.

14. Contact

For privacy questions, requests, or to exercise your rights:

Vinay Padmanabhi, doing business as CrateHQ Email: vinay@cratehq.ai

We use cookies for analytics and advertising to improve Crate and measure our ads. Essential cookies keep you signed in and are always on. See our Privacy Policy.