CCrush It Engine← Back to site

Privacy Policy

Effective: September 7, 2026
Last updated: September 29, 2026

This Privacy Policy explains how Crush It Media Group LLC, doing business as Crush It Engine ("Crush It Engine," "we," "us," or "our"), collects, uses, and shares information when you use crushitengine.com and the Crush It Engine platform.

1. Two kinds of people

Customers — businesses that subscribe to Crush It Engine. Callers/Contacts — people who call or text a Customer's Crush It Engine number, submit a request through a Customer's website form or digital business card, or are otherwise a Customer's customers. For Caller data, the Customer is the data controller and we process it on their behalf to provide the Service.

2. What we collect

  • Account data: name, email, business name, phone, timezone, plan and billing status.
  • Team member data: for each person a Customer invites — name, email, role (owner, manager, or staff), and, for people with a phone line, their extension, availability status, call-forwarding choices (such as a mobile number to ring), and per-person call statistics and scorecards derived from the calls they handle. Customers manage this data for their own staff.
  • Team phone (Cloud PBX) data: calls to and from a Customer's staff (numbers, times, durations, who answered, the route the call took through menus and departments), and — where the Customer's recording announcement is on — recordings, live transcripts, AI summaries, quality scores, to-do lists, and notes and tags staff add; recordings of callers saying their name (if call screening is on) and keypad call ratings (if the survey is on); greetings a Customer records or uploads (stored at unlisted web addresses so the phone network can play them); the emergency (E911) address registered for each line, which is shared with our carrier and emergency services, and a record of the account owner's acknowledgment of the 911 limits (the wording shown, their name and email, the time, IP address and browser); desk-phone sign-in settings; and, for call tracking numbers, which number a caller dialed and the advertising source it belongs to.
  • Number transfer (porting) data: when a Customer asks to move an existing number to us, the account holder name, the authorized person, the service address, the account's billing number, the account number and transfer PIN (stored encrypted), a typed signature, and a copy of a recent bill from the current provider — used to complete the transfer with the carriers and kept with the request as a record of the Customer's authorization.
  • Business content: the knowledge, greetings, rules, and settings you configure for your agent, including content derived from your public website at your request.
  • Call and message data: call metadata (numbers, times, durations), call recordings, transcripts, AI-generated summaries and sentiment, SMS message content, and captured lead details (as provided by the caller).
  • Marketplace lead data: when a Customer connects a lead marketplace (such as Angi, Thumbtack, Yelp, Google Local Services Ads, or Meta), we receive the lead details that source sends — typically the consumer's name, phone, email, job description, and the lead's cost — so the Customer can respond to the inquiry.
  • Digital business card data: the contact details a Customer publishes on a card (name, role, company, phone, email, website, social links) and any photo they upload. A published card is a public web page — anything a Customer puts on it is intentionally visible to anyone with the link. Uploaded photos are re-encoded on upload, which removes embedded metadata such as EXIF GPS location before the image is stored.
  • Card and website form submissions: when someone asks for a callback through a Customer's digital business card or website widget ("Text us" or "Call me back"), we receive what they enter (name, phone, email, service address, what it's about, and answers to the business's questions) and a record of their consent — for card requests, the exact texting-consent wording shown, the time, their IP address, and their browser/user-agent; for website "Call me back" requests, the exact call-back consent wording shown, the time, and their IP address — kept as proof of consent.
  • Card statistics: when someone opens a Customer's digital business card, we record anonymous usage events (opens, contact saves, button taps, and whether the card was opened from a QR scan) with a salted one-way hash used only to count unique visitors — never the IP address itself. Automated fetches and the Customer's own previews are excluded.
  • Referral data: when a Customer's customer shares a "Refer a friend" link from a digital business card, we store the first name (and, if given, phone number) they enter, so a request that arrives through that link can be credited to them. We never contact the friend they share it with. When a caller tells a Customer's AI receptionist who referred them, that answer is saved with the lead.
  • Review data: where a Customer connects Google Business Profile, we store the public reviews on their profile (reviewer name, rating, text, date) and any replies, so the Customer can respond and display them. We also keep a record of review requests the Customer sends.
  • QR scan data: for tracked QR codes only, we record that a scan occurred, the time, a coarse device/user-agent string, and a salted one-way hash used solely to tell repeat scans apart. We do not store the IP address of anyone who scans a code, and we do not build a profile of scanners. Automated fetches (link previewers such as WhatsApp or iMessage, and crawlers) are flagged and excluded from the counts a Customer sees.
  • Scheduling data: where a Customer connects a calendar or field-service system (Google Calendar, Housecall Pro, ServiceTitan, Cal.com), we read availability in order to offer open times and write the appointments they book. We read only what is needed to determine free/busy and to create the booking.
  • Compliance records: opt-in/opt-out events (e.g., STOP/START), timestamps, and delivery outcomes — kept as an append-only audit trail.
  • Free-offer abuse prevention: when someone claims a free offer (such as a free digital business card), we record a device identifier calculated from their browser's characteristics (a "device fingerprint"), a salted one-way hash of their IP address (never the address itself), and set a cookie noting the claim. We use these only to limit each free offer to one claim per person, and for no other purpose.
  • Usage and device data: log data, approximate location from IP, and cookie data described in the Cookie Policy.

3. How we use it

To provide and operate the Service (answering calls, sending texts, delivering leads); to meter usage and bill; to maintain safety, security, and legal compliance (including honoring opt-outs); to improve reliability; and to communicate with Customers about the Service. We do not sell personal information, and we do not use your callers' data to market to them.

Staff access. A limited number of our authorized staff can view a Customer's account — including call recordings, transcripts, messages, and leads — only to provide support, help with setup, fix problems, or investigate security, compliance, or abuse concerns. This access is view-only unless the Customer asks for or permits changes, and every access is recorded in an internal audit log.

4. AI processing

Conversations are processed by third-party AI providers (speech recognition, language models, speech synthesis) under agreements limiting their use of the data to providing the service to us. AI outputs (transcripts, summaries) are stored in your dashboard.

5. Sharing

We share data with service providers necessary to operate the platform (telephony carrier, cloud hosting, database, AI providers, payment processor), with a Customer's designated destinations (e.g., their CRM webhook or email — configured by them), and where required by law. We may disclose to protect rights, safety, or the integrity of the Service.

6. Retention

Account and business data are kept while your account is active. Digital business cards remain published until the Customer unpublishes or deletes them, or the account closes; uploaded card photos are deleted with the card. QR scan records are kept while the code exists so a Customer can see trends, and are deleted with the code. Call recordings, transcripts, and messages are kept so Customers can use them, and deleted or de-identified within a reasonable period after account closure, except compliance records (opt-outs) which we retain as legally prudent.

7. Your choices

Customers can access, correct, and export their data from the dashboard, and can close their account by contacting us. Callers who wish to stop receiving texts can reply STOP at any time; requests about a Customer's records should be directed to that business, and we will assist the Customer in honoring them.

8. Security

We use industry-standard measures including encryption in transit, row-level access controls, and least-privilege service credentials. No system is perfectly secure; report concerns to support@crushitengine.com.

9. Children

The Service is not directed to children under 13 and we do not knowingly collect their data.

10. Changes and contact

We will update the "Last updated" date when this policy changes. Questions: support@crushitengine.com · Crush It Media Group LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702.