Privacy policy
Crom Services, Australia
Last updated (effective date): 23 October 2026
Privacy contact: privacy@cromservices.com.au
This page covers two things:
- The Crom Services website (cromservices.com.au) and the quote enquiries you send us. See Part 1.
- Brief, our email assistant for small businesses (brief.cromservices.com.au). See Part 2.
Google user data (Brief): Brief's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Part 1: The Crom Services website and quote enquiries
What we collect
This website has no sign-up. You can contact us in two ways.
Order form. When you tap Get this pack, a short form asks for the pack you picked, your name, your email, your website (optional) and a few lines about what you need. The page also sends the address of the page you were on. Our server records your browser type and a scrambled code made from your IP address (not the address itself), which we use only to stop repeated spam.
Email. When you tap Request a quote or Email cromservices@gmail.com, your own email app opens a message to cromservices@gmail.com. The quote email is pre-filled with these headings:
- Business name
- What you do and where (suburb)
- How people book with you now
- Current website (if any)
- Anything else we should know
We receive whatever you choose to write, plus the details that come with any email: your email address, the name on your email account, and anything you attach. Please don't send health, financial or other sensitive information. We don't need it to quote.
Why we collect it
We use your enquiry only to reply to you and to prepare a quote. If you go ahead, we also use it to do the work you asked for. We don't add you to a mailing list, and we don't sell or share your enquiry for anyone else's marketing.
Where it goes
Order form details are stored in our database (Supabase, hosted in Tokyo, Japan) and sent to our inbox by our email-sending provider (Resend). Enquiries arrive in our email inbox (cromservices@gmail.com), which Google provides. Mail sent to privacy@cromservices.com.au is forwarded to the same inbox by our email-routing provider (Cloudflare). Supabase, Resend and Google can store or process information outside Australia, including in Japan and the United States, so Australian Privacy Principle 8 (overseas disclosure) applies.
Cookies and analytics
This site uses Google Analytics 4 to count visits, and for nothing else. Google Analytics sets cookies (named _ga) in your browser so it can tell one visit from the next. It records the pages you view, your approximate location (city or region), your device and browser, and the site that sent you here. It never collects your name, your email or anything you type into a form.
Advertising features are turned off. This site has no advertising cookies or pixels.
Google may process this data outside Australia, including in the United States (see Where it goes for overseas disclosure under Australian Privacy Principle 8). To opt out, install Google's Google Analytics opt-out browser add-on, or block cookies for this site in your browser settings.
Lovable (site host), which runs on Cloudflare, keeps standard server logs (IP address, browser, time) for security. We don't use them to identify you.
How long we keep it
If no work goes ahead, we delete your enquiry (including order form details) within 12 months. If you become a client, we keep records of the work and invoices for as long as Australian tax law requires.
Access, correction and deletion
You can ask to see the details we hold about you, correct them, or have them deleted. Email privacy@cromservices.com.au. We may need to check it's you before we act. We'll reply within 30 days. If we must keep something (for example an invoice, for tax), we'll tell you what and why.
Demo sites
Our demo sites, such as Little Chip Dental, are samples, not real businesses. If you try a demo booking, the demo saves what you enter (first and last name, email, mobile, any note, and the appointment you pick) and emails a confirmation and a reminder the day before to the address you give, using our email-sending provider (Resend). You can also choose to book with Google sign-in. No real appointment is made. Demo bookings are cleared every 30 days, except in our Saltbush Dog Grooming booking demo, where bookings are stored only in your browser. Please use made-up details, and email privacy@cromservices.com.au if you want a demo booking deleted.
Complaints
Email privacy@cromservices.com.au. If we cannot resolve it, you can contact the Office of the Australian Information Commissioner: oaic.gov.au.
Part 2: Brief privacy policy
Brief is operated by Crom Services in Australia.
Privacy contact: privacy@cromservices.com.au
This policy describes how Brief handles personal information under the Australian Privacy Principles (Privacy Act 1988 (Cth)). It matches how the product actually works. If we change the flow, we will change this page.
What Brief does
Brief is an email assistant for small businesses. You create an account with a magic link. You connect Gmail with Google sign-in (OAuth). We never ask for your mailbox password.
On connect, each morning, and when you tap Run Brief, we read your Inbox from the last 7 days (not Sent, not All Mail), write a Brief (Prioritise, Waiting, and Noise, plus suggested actions and draft reply text you can copy), and discard the emails. We do not poll Gmail, and reloading the page does not read mail again. When you open Their mail, we read that one Inbox message, show it, and discard it. We do not keep a copy of your mailbox.
When you tap Send, we send that reply from your Gmail. We do not send without you. We do not change labels, delete mail, or download attachments.
Google Limited Use
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
We request Gmail read-only to produce your Brief. When you use Reply, we also request Gmail compose so we can send the reply you confirm — we do not send without you. We use that access solely for in-product features you can see (the action list, draft text, Reply, and the privacy panel). We do not sell Google user data. We do not use it for advertising. We do not use it to train or improve a general machine-learning model.
Humans at Brief cannot open your mail or your stored Briefs in the ordinary course of support. We may look only if you ask us to, to investigate a security issue, or if the law requires it. Those accesses are logged.
What we collect
| We collect | Why |
|---|---|
| Your account email | Log you in (magic link) and contact you about your account |
| Your mailbox address | Show which inbox is connected |
| An encrypted Google refresh token | Run the daily Brief without asking you to sign in again |
| Message IDs and a hash of the body | Avoid processing the same mail twice; “Open in Gmail” |
A sync cursor (historyId) | Fetch only new mail next time |
| The Brief itself (summary, actions, draft text you see in Brief) | This is the product. You can delete it |
| Whether you marked an action done, and optional “looks right / missed something” | Improve your Brief, not a model |
| Stripe customer and subscription IDs | Charge the plan you chose. Stripe holds the card, not us |
| Technical logs (request IDs, counts, error codes) | Keep the service up. Logs do not include subjects, snippets, bodies, drafts, or Google tokens |
| IP address, browser, timezone | Sign-in security and the morning digest time |
Email content (bodies, subjects, snippets, attachments, most headers) is read in a short-lived job and then discarded. It is not written to our database, file storage, or logs.
Your mail may include health, financial, or other sensitive information. We do not ask for it. If it is in the mail we read, we process it only to write that Brief, then discard it.
What we store, and for how long
| Kept | How long |
|---|---|
| Email bodies, subjects, snippets, attachments | Not kept |
| Briefs | 30 days, or until you delete them or disconnect |
| Message IDs and body hashes | Until you disconnect, or 90 days after the last job |
| Encrypted refresh token | Until you disconnect |
| Account email, mailbox address | Until you delete the account |
| App logs | 7 days |
| Invoices and tax records (via Stripe) | 7 years (Australian tax law) |
| A wipe log (that a delete happened, not what was in the mail) | 2 years |
Our host, Amazon Web Services in Sydney, keeps app logs for 7 days for security and troubleshooting. These logs can include your account email address and the one-time sign-in link we create when you log in. They never include your mail, subjects, snippets, drafts or Google tokens.
Tokens and Briefs are encrypted with a per-mailbox key. If you wipe, we destroy that key.
How we use information
- Provide Briefs, actions, and in-app draft text
- Run the daily job. When service email is switched on, send sign-in links, “your Brief is ready” and trial-ending notices
- Bill you through Stripe
- Security and abuse prevention
We do not train models on your mail. We do not sell data. We do not use mailbox contents for marketing.
Who else sees it
| Who | What | Where |
|---|---|---|
| OAuth and the Gmail read we perform | Google’s infrastructure (including the United States) | |
| Stripe | Billing identity and payment | Stripe’s infrastructure |
| Amazon Web Services (our host) | The Brief app, database and the processing that writes your Brief, run by Brief's own code with no third-party AI | Sydney (ap-southeast-2) |
Brief does not send your mail to any outside AI service. If that ever changes, we will update this page and the in-app privacy panel first, and only use a vendor that does not keep or train on your mail.
If we later add Microsoft 365, it will be read-only on your mailbox (not your whole organisation), under the same discard-and-wipe rules. We will update this page before that ships.
Overseas disclosure
Some processors are outside Australia (Google, Stripe). Australian Privacy Principle 8 applies. We use them only to provide Brief, under contract, and we do not claim that mail is processed only in Australia.
Access, correction, and deletion
Your mail lives in Gmail. Correct it there.
In Brief you can:
- See what we stored and what we threw away after every Brief (privacy panel)
- Disconnect a mailbox and delete that inbox’s Briefs, token, and message IDs
- Delete your Brief account (we keep invoice IDs Stripe already has, because tax law requires it)
To export your stored Briefs or ask a question: privacy@cromservices.com.au
After you disconnect, Google may take a short time to drop the grant. You can also remove Brief at Google Account permissions.
Direct marketing
The only email we send or plan to send is service email (sign-in links, Brief ready, trial ending). We do not build a marketing list from your mailbox. If we ever send marketing, it will have an unsubscribe.
Cookies
We use a session cookie to keep you logged in, and Stripe uses cookies on Checkout. We do not run advertising pixels.
Children
Brief is for adult small-business operators. It is not for anyone under 18.
Complaints
Email privacy@cromservices.com.au. If we cannot resolve it, you can contact the Office of the Australian Information Commissioner: oaic.gov.au.
Changes
We will update this page when the product changes. The effective date at the top is the current version.
Crom Services · Australia · privacy@cromservices.com.au · Terms