Privacy Policy

What personal data Midcrowd collects, why, and how long it is kept.

Version 0.4.1-draft · Effective 2026-09-17

What we collect

Account data from Google sign-in: your name, email address and profile picture.
Content you create: site text, images, product details and business information.
Enquiries you send us: the project enquiry form, a job application, or a newsletter sign-up.
Files you upload: images, documents and media you add to a website or attach to an enquiry.
Billing data: the subscription and payment identifiers our payment provider returns, and the last four digits of a card for display. We never see or store a full card number.
Operational data: correlation identifiers, a salted hash of your IP address, and your country. We do not store raw IP addresses.

On midcrowd.com, and only if you agree to it, we use Google Analytics and Google Ads measurement to record which pages you visited, where you came from, and whether an advert brought you here. You are asked before anything loads, declining costs you nothing, and nothing is sent if you decline. On the websites Midcrowd serves for subscribers we run no analytics collector at all, and set no analytics or advertising cookies. At the date of this version that measurement is switched off even for visitors who agree, and nothing is sent to Google. See the Cookie Policy.

Data about your customers

If you run a website on Midcrowd, the enquiries, orders and customer records it collects are YOUR data about YOUR customers. You decide what is collected and why; we hold and process it to provide the service to you and for no purpose of our own. We do not sell it, and we do not use it to market anything to anyone. The Data Processing Terms set out that relationship.

Why we use it, and on what basis

To operate your account and sites, to answer enquiries, to prevent abuse and fraud, to meet financial record-keeping obligations, and to keep the service reliable.

Where a legal basis is required — for example under the GDPR — we rely on performance of our contract with you for running your account and sites, on our legitimate interest in a secure and working service for abuse prevention and operational logging, on a legal obligation for financial records, and on your consent for the newsletter, which you can withdraw at any time.

Who processes data for us

Google Firebase — authentication, database and file storage.
Vercel — website hosting and delivery.
Stripe — subscription billing, and payments and payouts for subscribers who sell.
Resend — the transactional email we send you, such as a receipt or a notification.

The support assistant that once ran on this website is switched off, and no visitor message reaches an AI provider from it. Where AI providers are used on a custom project, they are named in that project's proposal — see the AI Terms.

Where data is processed

Our providers operate globally, so your data may be processed outside the country you are in, including in the United States and the European Union. Where the law requires a transfer mechanism, we rely on the safeguards those providers publish. The specific regions Midcrowd will commit to are still being settled and are listed as an open item on the legal index.

How long we keep it

Agency enquiries: 24 months from last activity, then anonymised. Enquiries marked spam are purged after 30 days.
Financial records: retained as required for record-keeping obligations.
Audit logs: retained and never modified or deleted.

Your choices

You can request a copy of your data, ask us to correct it, ask us to delete your account, object to a use of it, or ask us to stop emailing you. Write to midcrowd.ai@gmail.com and we aim to answer within 5 business days.

Financial records that we are obliged to keep are retained with personal details removed. If we cannot action a request, we will tell you why.

If you are the customer of a business whose website runs on Midcrowd, that business — not Midcrowd — holds your data. Ask them first; we will help them answer.