Privacy Policy
This Privacy Policy explains how iPixel Media LLC ("CrateDrive," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our cloud backup service for DJ libraries and audio files (the "Service"), available at cratedrive.com and through our desktop application.
By using the Service, you consent to the practices described in this Privacy Policy.
1. Information We Collect
1.1 Information You Provide
- Account information. Email address, password (stored as a salted hash), display name.
- Billing information. Plan tier and billing status. We do not store full payment card numbers. Payment cards are collected and processed directly by Stripe, Inc., our payment processor, which provides us with a tokenized reference to your payment method.
- Content. Audio files, metadata (artist, title, BPM, key, etc.), crate and playlist data, cover art, and other content you upload to the Service.
- Support correspondence. Messages you send us via support@cratedrive.com or in-app feedback forms.
1.2 Information Collected Automatically
- Account usage data. Storage used, files uploaded, share links created, sync activity, and feature usage.
- Device information. Operating system, application version, IP address, browser type (for web app usage), and locale.
- Log data. Server logs of API requests, including timestamps, response codes, and error messages. Used for debugging and security monitoring.
- Crash reports. If our desktop application crashes, we may collect crash report data (stack trace, OS version, application state) through Sentry to diagnose and fix the bug. Crash reports are designed not to include the contents of Your Content.
- Email engagement. When we send you transactional emails, we may receive delivery and bounce status from our email provider.
1.3 Information from Connected Apps
When you connect a DJ application library (Serato, Rekordbox, Traktor, Engine DJ) to CrateDrive, our desktop agent reads metadata from that library's local files (crate definitions, track paths, BPM, key data, cue points). This metadata is uploaded to the Service so it can be displayed in the web app. We do not access content beyond what is referenced in your connected DJ library.
1.4 Information We Do NOT Collect
We do not collect:
- Biometric data
- Precise GPS location
- Audio recordings made through your device's microphone
- Files outside of folders you have explicitly connected to the Service
2. How We Use Your Information
We use the information we collect to:
- Provide the Service. Upload, store, sync, and serve Your Content; render your library in the web app; process plan changes and share links.
- Process payments. Bill you for subscription fees through Stripe.
- Communicate with you. Send transactional emails (welcome, password reset, payment confirmation, account changes), respond to support requests, and notify you of material changes to the Service or these policies.
- Improve the Service. Analyze aggregated usage patterns, debug crashes, fix bugs, and develop new features.
- Protect the Service. Detect and prevent fraud, abuse, security incidents, and violations of our Terms.
- Comply with legal obligations. Respond to lawful requests from authorities, enforce our Terms, and protect our legal rights.
We do not sell your personal information to advertisers or data brokers. We do not use Your Content to train artificial intelligence or machine learning models.
3. Legal Basis for Processing (EU Users)
If you are in the European Economic Area, United Kingdom, or Switzerland, we process your personal information on the following legal bases:
- Contract: processing necessary to provide the Service you have signed up for.
- Legitimate interests: improving the Service, securing it against abuse, communicating service updates. We balance these interests against your privacy rights.
- Consent: where you have explicitly consented, such as enabling optional features.
- Legal obligation: complying with applicable law.
4. How We Share Information
We share personal information with the following categories of recipients:
4.1 Service Providers (Subprocessors)
We share information with third-party service providers who process data on our behalf. Each is contractually obligated to protect your information and use it only for the purposes we specify:
| Subprocessor | Purpose | Location |
|---|---|---|
| Base44 | Backend platform (hosts our application + database) | United States |
| Backblaze B2 | Cloud object storage for Your Content (audio files, cover art) | United States |
| Stripe, Inc. | Payment processing | United States |
| SendGrid (via Base44) | Transactional email delivery | United States |
| Brevo (Sendinblue) | Outbound support email + email routing for support@cratedrive.com | European Union |
| Cloudflare, Inc. | DNS, CDN, inbound email routing | Global |
| Sentry (Functional Software, Inc.) | Crash reporting + error tracking | United States |
| OnRender, Inc. | Web hosting (delivers cratedrive.com) | United States |
This list may change as we add or remove vendors. We will update this page when significant changes occur.
4.2 Legal Requirements
We may disclose personal information when we believe in good faith that disclosure is necessary to:
- Comply with a subpoena, court order, or other lawful request;
- Enforce our Terms of Service or investigate potential violations;
- Detect, prevent, or address fraud, security, or technical issues;
- Protect the rights, property, or safety of CrateDrive, our users, or the public.
We do not voluntarily provide personal information to government authorities. We will challenge overly broad requests and notify affected users where lawful and practical.
4.3 Business Transfers
If CrateDrive is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or use of your information through an email notice and a prominent notice on the Service.
4.4 With Your Consent
We may share information for other purposes with your explicit consent.
5. International Data Transfers
CrateDrive is operated from the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States and other countries where our subprocessors operate.
For transfers from the European Economic Area, United Kingdom, or Switzerland to countries that do not have an adequacy decision from the relevant data protection authority, we rely on Standard Contractual Clauses approved by the European Commission, or equivalent legal mechanisms, to provide adequate protection for your information.
6. Data Retention
| Category | Retention period |
|---|---|
| Account information | While your account is active. Deleted within 30 days of account deletion. |
| Your Content (audio files, etc.) | While your account is active. Deletion request triggers removal from B2 cloud storage within 1 hour. Database records deleted within 24 hours. |
| ShareLinks | Until you delete them or your account is deleted. |
| Server logs | 30 days. |
| Crash reports | 90 days, then anonymized aggregates only. |
| Email delivery logs | 90 days. |
| Transactional records (invoices, billing) | 7 years (retained for tax and accounting compliance). |
| DMCA notices and counter-notices | 7 years. |
Backups of database state may persist for up to 30 days after deletion before being permanently overwritten.
7. Your Rights
7.1 All Users
You have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete your account and associated personal information (available via the Service's account deletion feature).
- Export your data in a portable format (available on request to support@cratedrive.com).
7.2 EU / UK / Swiss Users (GDPR)
In addition to the above, you have the right to:
- Restrict processing of your personal information.
- Object to processing based on legitimate interests.
- Lodge a complaint with your local data protection authority.
- Withdraw consent where processing is based on consent.
7.3 California Residents (CCPA / CPRA)
In addition to the rights above, California residents have the right to:
- Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share information.
- Opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising.
- Limit the use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the Service.
- Non-discrimination. We will not discriminate against you for exercising these rights.
7.4 How to Exercise Your Rights
Use the in-app account deletion feature for deletion. For all other rights, email support@cratedrive.com from the email address associated with your account. We will respond within 30 days (or shorter if required by law). You may also designate an authorized agent to submit a request on your behalf, subject to verification.
8. Security
We use industry-standard technical and organizational measures to protect your personal information, including:
- Encryption in transit. All communication with the Service uses TLS.
- Encryption at rest. Audio files are stored in encrypted form by our cloud storage provider.
- Password hashing. Account passwords are stored as salted hashes; we never store passwords in plain text.
- Signed URLs. Access to cloud-stored files is gated by short-lived, signed URLs.
- Access control. Internal access to user data is limited to personnel who need it to operate the Service.
- Audit logging. Administrative actions on user data are logged.
No system is perfectly secure. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.
9. Children's Privacy
The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18 without verifiable parental consent, we will delete it. If you believe we may have collected such information, contact us at support@cratedrive.com.
10. Cookies and Tracking
The Service uses cookies and similar technologies for the following purposes only:
- Essential cookies. Required for the Service to function (e.g., maintaining your login session, remembering preferences).
- Functional cookies. Remember your settings within the application (theme, view preferences, etc.).
We do not use third-party advertising cookies. We do not use cross-site tracking or fingerprinting techniques.
11. Do Not Track
Some browsers send a "Do Not Track" signal. Because there is no industry consensus on how to interpret this signal, the Service does not currently respond to it. We do not engage in cross-site tracking regardless.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be announced via email to your account address at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after the effective date of an updated Privacy Policy constitutes acceptance of the updated policy.
13. Contact
Questions, requests, or complaints about this Privacy Policy or our handling of your personal information? Contact:
iPixel Media LLC 15106 Barby Ave., Tampa, FL 33625 Email: support@cratedrive.com
For EU/UK/Swiss users, you may also lodge a complaint with your local data protection supervisory authority.