How we handle personal data.

Who we are

Crumbs is a trade name of GTM Engineering BV (enterprise number BE 1031.870.360) and Ruvleu BV (enterprise number BE 0787.584.471), both RPR Gent, afdeling Gent. Our office is at Kleindokkaai 17, 9000 Gent, Belgium.

GTM Engineering BV is responsible for this website and the plan tool. Ruvleu BV is the other company behind Crumbs.

For this website, the plan tool and our own prospecting, we decide what happens with personal data. In GDPR terms we are the controller. Questions about privacy go to ruben@getcrumbs.io.

This website

The site is hosted by Vercel. Like any web server, Vercel keeps short technical logs of each request, including your IP address, to deliver the pages and keep the service secure. We rely on our legitimate interest in running a secure website. In our Vercel account these logs are available for one day.

We count visits with Vercel Web Analytics. It sets no cookies and stores nothing on your device. Visits are counted with a hash of the request that is discarded after 24 hours, so we see pages and where visitors came from, not who they are. We also count clicks on the email and booking links and on the buttons that start a plan, without knowing who clicked or what they typed.

The fonts are served from our own domain, so loading a page sends nothing to Google. Our pages set no cookies, which is why there is no cookie banner.

The buttons to pick a time open Calendly's own site. On the plan page, Calendly's booking window opens on top of our page instead. Its code loads only when you click, and from then on Calendly's own privacy and cookie terms apply.

The plan tool

On our plan page you type a company's website address and your first name, and get a first GTM plan for it. You do not need to give us your last name or an email address.

What we read

The homepage of that website and a few of the pages it links to, such as the customers, about and careers pages. Only public pages: we never log in anywhere. A language model from Anthropic reads the page text and writes the plan. When a site cannot be read directly, for example because its pages only fill in after their scripts run, Exa reads the same public pages for us. Apart from your first name, the plan holds only what the website says.

Your first name

We ask for your first name to address the plan to you. It is shown in the plan and on the page its share link opens, so anyone you send the link to sees it. It is also in the notes our team gets about the plan, in Slack or by email. We keep it with the plan for 30 days. It is never sent to the language model or to Exa. Your browser keeps it for this tab only, so you do not have to type it twice. It is not a cookie.

The bot check

Before a plan runs or a mail goes out, Vercel BotID checks in the background that the request comes from a person in a browser, not from a script. It reads signals from your browser for that check, on the plan page only. For its deeper check Vercel works with Kasada. To stop one connection from asking for many plans or mails in a short time, we also count requests per IP address. We count with a one-way hash of the address, kept only in the server's working memory and never written to our store.

What we keep, and where

The website address you typed and the plan, for 30 days, so the link to the plan keeps working. After that the link stops working, and the plan is deleted in our next clean-up, which runs with the first plan of each day. When someone asks for the same website again within 7 days, they get their own copy of that plan instead of a new read, with their own first name, never yours. Plans are stored with Vercel in Frankfurt, Germany, and the code that reads the website and writes the plan runs on Vercel's servers there too.

What our team sees

For each new plan we get a short note in Slack, or by email when Slack cannot be reached: the website, the company name, your first name, the plays in the plan and a link to it. We get the same kind of note when someone gets a copy of a plan we already wrote, books a call from a plan, copies its link, asks for it by email, or tells us in one line what the plan read wrong. That line also goes to the model, to write the plan again. When you book a call from a plan, the booking carries the plan's number, so we know which plan you want to talk about.

If you ask for the plan by email

We use your address to send you the link once, through Resend. Our team gets a note with your address, and if something in the plan is worth a call, we may write to you once. Nothing else. Our store keeps only a one-way hash of the address, for about two days, so one address gets at most one mail a day. The note to our team stays in our Slack, or in our inbox when it came by email, until we delete it. We delete it when you ask.

We do all this because you asked for the plan or the mail, and to keep the tool safe from abuse, which is our legitimate interest.

When you write to us or pick a time

Email to us is handled by Google Workspace. When you pick a time for a call, Calendly stores your name, email address and the answers you give, and sends us the booking.

We may record and transcribe calls, so we can listen instead of taking notes. We say so at the start of the call, and you can ask us not to record.

Notes from calls and emails can end up in our internal tools: our CRM, Notion and Slack. We keep this correspondence while we are in touch, and after that for as long as it helps a possible next conversation, unless you ask us to delete it. Some records the law asks us to keep longer, for example invoices.

Our own prospecting

We may write to professionals at companies that fit our market, about our services. We use professional data only: name, role, company, work email address or LinkedIn profile, and public information about the company, such as news or job posts.

This data comes from public professional profiles and from B2B data providers that we reach through Clay. We rely on our legitimate interest in offering our services to companies for whom they are relevant, and we write to you only in your professional role.

Work for our clients

Most of our work is for clients: we find accounts in their market and write first messages that go out from their own sellers' accounts. In that work the client decides what happens with the data (the controller) and we work on its instructions (the processor).

If you received a message from one of our clients, the client is your first point of contact. You can also write to us, and we pass your request on.

If you apply for a job

If you send us an application, we use it only for that role. We keep it until the role is filled. We keep it longer, for a later role, only if you agree.

How long we keep it

• A plan, the website address and your first name30 days, then the link stops working and the plan is deleted
• A copy of a plan for the next visitor7 days, without your first name
• The hash of an address that asked for the plan by emailabout 2 days
• Our notes about plans, in Slack or by emailuntil we delete them, and we do when you ask
• Vercel's request logs1 day in our account
• Visit countsno visitor is kept, the hash of a visit is discarded after 24 hours
• Emails, call notes and bookingswhile we are in touch, then as long as they help a next conversation, or until you ask us to delete them
• Job applicationsuntil the role is filled, longer only if you agree
• The do-not-contact listyour name and email address, for as long as you want us not to write
• Invoices and other recordsas long as the law asks

Who else handles the data

These companies process personal data for us, each for one job:

• Vercelhosting this site, counting visits, the bot check on the plan page (with Kasada for its deeper check), and storing plans in Frankfurt
• Anthropicthe language model that reads public pages and writes plans
• Exareading public pages that a site does not show directly
• Google Workspaceemail, calendar and documents
• Calendlypicking a time for a call
• Fireflies and Wispr Flowcall recordings and transcripts
• Superhumanthe app we read and write email in
• Resendthe mail with the link to a plan, and the update emails we send to clients
• Our CRMour contacts and conversations
• Notion and Slackinternal notes, team chat and our notes about new plans
• Clay, and the data providers we reach through itfinding and checking business data
• LinkedInsending our own messages

Several of these companies are based in the United States, among them the providers of the language model (Anthropic) and of the fallback page reader (Exa). When data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's standard contractual clauses in the company's data processing terms.

Your rights

You can ask us for a copy of the data we hold about you, and ask us to correct it, delete it, limit what we do with it, or send it to you in a format you can take elsewhere. You can object to anything we do on the basis of our legitimate interest. Write to ruben@getcrumbs.io. We may ask you to confirm who you are before we act, and we answer within one month.

If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be.

Changes to this page

Version 1.1, 22 October 2026. When we change this page, we update the version and the date here.