Who we are
This policy explains how Crema Labs Inc. handles personal information. We are a British Columbia company based in North Vancouver, Canada. We build and run AI products for businesses: Remy, Associate, Scarlett, Coverage and Data Exchange. In this policy, “we” and “us” mean Crema Labs Inc.
British Columbia’s Personal Information Protection Act (PIPA) governs how we handle personal information in British Columbia. Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies when information crosses provincial or national borders. Other laws, such as Quebec’s, may also apply depending on where you live.
What this policy covers
This website (cremalabs.xyz), the ways you get in touch with us, our work with clients, and our products.
A product with its own privacy policy covers that product in more detail. Remy’s is at remy.cremalabs.xyz/privacy. Where the two differ about that product, the product’s policy applies.
Other sites we link to, such as our scheduling page and our social media accounts, have their own privacy policies.
Our two roles
- We’re in charge of information about visitors to this website, people who get in touch, the people we work with, and the people who have accounts in our products. We decide how it’s used, and this policy explains how.
- Our clients are in charge of the information our products handle for them, such as a law firm’s deal documents, a school’s students or a restaurant’s staff. We handle it as their service provider, under our agreement with them, and use it only to provide our products to them. The exceptions are anonymised data and usage records, explained below.
If you’re a customer, student, employee or guest of one of our clients, start with that organization about your information. We’ll help it respond.
What we collect
- When you visit this website. We count visits with Vercel Web Analytics. It records the page you viewed, the page that sent you, your rough location, and your device, operating system and browser. It sets no cookies and doesn’t record your IP address: it tells visits apart with a code made from your request, which is deleted after 24 hours. Before a visit is recorded, everything after “?” in the page’s address is removed except campaign tags (utm_), so details in a link you followed stay with you. Our host, Vercel, also processes your IP address to deliver and protect the website, and keeps short-lived technical logs.
- When you get in touch. If you email us, we keep your message and your address so we can reply. If you book a call, you use Cal.com: you give your name, your email and anything else you choose to type. Cal.com keeps this for us, and its own privacy policy also applies.
- When you work with us. The names, roles and contact details of the people we work with, and what we need to invoice.
- When you use one of our products. Your account details, such as your name, email address and role. If you sign in with Google or Microsoft, they give us your name and email address.
- What a client connects. The systems and documents a client gives a product access to. A product’s own policy lists what it receives.
This website has no forms, no advertising trackers and no cookies.
How we use it
- To reply to you and arrange calls.
- To prepare demos and proposals, and to provide, support, secure and improve our products, including with anonymised data and usage records as explained below.
- To run, secure and improve this website, using visit counts that identify no one.
- To tell you about our work, only if you’ve asked us to or the law allows it. Every message names us, gives our mailing address and lets you unsubscribe for free, and we act on an unsubscribe within 10 business days.
- To meet our legal, tax and accounting obligations.
We don’t sell personal information, and we don’t use it for advertising. Our products support people’s decisions; they don’t make decisions about anyone on their own. If we want to use your information for a new purpose, we’ll ask you first, unless the law allows it without your consent.
Anonymised data
Some of our products use anonymised data and usage records to improve the product and to train, test and fine-tune AI models. Usage records show how a product is used, without names or contact details. A product’s own policy sets out what it uses and its standard.
Anonymised data has no names, contact details or account numbers and no record about a single person, and there must be no serious possibility of identifying anyone from it, alone or combined with other information. We won’t try to identify anyone from anonymised data, and anyone we share it with must agree to the same.
We license a client’s data to anyone else only if the client opts in, and only once it’s anonymised. That includes Data Exchange, which works with companies that choose to license their own data and anonymises it before any dataset reaches an AI or robotics lab.
Who else handles it
We use other companies to run this website and our products. Each may use information only to provide its service to us, and each is bound in writing to protect it:
- Vercel hosts this website and runs its analytics, in the United States.
- Cal.com handles call bookings, in the United States.
- Google Workspace runs our email and documents.
- Amazon Web Services and Google Cloud host our products. Remy and Associate store their data in Canada, in Montreal.
- AI model providers, including Anthropic and the model hosts OpenRouter connects us to, run the AI models in our products, in the United States. They don’t train their models on what we send them.
- Sentry receives error reports from our products, in the United States.
A product’s own policy may list more. We may also disclose information when the law requires it, to protect someone’s safety or our legal rights, or as part of a sale or reorganization of our business, where this policy keeps applying to it.
Information outside Canada
Remy and Associate store their data in Canada. Other information is handled in the United States and other countries by the companies above. While it’s there, the courts, law enforcement and national security authorities of that country may be able to access it.
Before we add or change a company that handles a client’s personal information, we tell the client, as our agreement with it sets out.
How long we keep it
- Website visits: the code that tells visits apart is deleted after 24 hours.
- Emails and call bookings: as long as we need them to work with you. You can ask us to delete them at any time.
- Client data: as long as the client’s agreement says, then deleted or returned. A product’s own policy may give details.
- Business records: as long as tax and other laws require.
If we use your information to make a decision that directly affects you, we keep it for at least a year after, as the law requires. When we no longer need information, we delete it or anonymise it.
How we protect it
Only the people who need information can reach it, the companies that handle it are bound in writing to protect it, and our products encrypt it when it’s stored and when it moves. This website is served only over encrypted connections.
If a breach of our safeguards creates a real risk of significant harm to you, we’ll report it to the Privacy Commissioner of Canada and tell you as soon as we can. If it involves a client’s information, we’ll tell the client right away. We keep a record of every breach.
Your rights
- Ask what personal information we hold about you, how we’ve used it and who we’ve shared it with.
- Ask us to correct it if it’s wrong.
- Withdraw your consent with reasonable notice, unless that would stop us meeting a legal obligation. We’ll tell you what it means first; for example, we may no longer be able to provide a service.
- Ask us to delete information we no longer need.
Email team@cremalabs.xyz. Requests are free. We may need to confirm who you are first, and we’ll answer within 30 days, or tell you why we need longer and when you’ll hear from us. If your request is about information a client controls, we’ll pass it to the client and help it answer.
Children and students
This website isn’t meant for children, and we don’t knowingly collect information from children through it.
Scarlett handles students’ reading recordings and results only for the school using it, under the school’s direction and our agreement with it. We never sell students’ information, use it for advertising, license it or include it in Data Exchange. Parents and guardians should contact their child’s school, and we’ll help the school answer.
Changes to this policy
When we change this policy, we post the new version here and update the date at the top. If a change matters to our clients, we tell them before it takes effect.
Contact us
Our Privacy Officer is responsible for this policy and answers questions, requests and complaints. We acknowledge every complaint, look into it and answer in writing.
Email team@cremalabs.xyz, or write to the Privacy Officer, Crema Labs Inc., 4385 Patterdale Drive, North Vancouver, BC V7R 4L6, Canada.
If you’re not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information (cai.gouv.qc.ca).