Privacy Policy

CrabAI is an AI assistant for restaurants and other local businesses, built and operated by Open Media INC. (Open Media). Business owners and managers can create an account themselves on this site; Open Media also sets up accounts for restaurants it works with. This policy covers the CrabAI website and app at crabai.updeal.top, including the tools for connecting Google, Meta and TikTok accounts.

CrabAI 是 Open Media INC.（Open Media）开发并运营的 AI 助手，服务餐厅和其他本地商家。商家可以在本站自助注册账号；Open Media 也会为合作餐厅代为开通账号。本政策覆盖 crabai.updeal.top 上的CrabAI 网站与应用，包括连接 Google、Meta、TikTok 账号的功能。

• Account — your sign-in email and the stores you add. Passwords are stored only as a salted hash, never in plain text.
• Conversations — the messages you send, the files you upload, and the assistant’s replies, kept so your history is there when you come back.
• Store business data — orders, reviews, menus and similar records from the store systems and platform accounts you have authorized us to connect.
• Connected platform data — Google in section 4, TikTok in section 5, Meta in section 6.

Google user data, as defined in section 4, is used, stored and shared only as section 4 describes.

账号信息（登录邮箱、你添加的门店；密码只存加盐哈希）、对话内容（你发的消息、上传的文件和助手的回复）、 你已授权接入的门店经营数据，以及已连接平台的数据（Google 见第 4 节，TikTok 见第 5 节，Meta 见第 6 节）。 第 4 节所说的 Google 用户数据，只按第 4 节的方式使用、存储和共享。

To provide CrabAI to you: to show your own stores’ data, answer your questions, draft the replies and posts you ask for, publish what you confirm, and keep the service secure and working. We do not sell your information, we do not rent it, and we do not use it to target advertising. For Google user data, section 4 applies.

用来为你提供 CrabAI：展示你自己门店的数据、回答你的问题、按你的要求起草回复与帖子、 发布你确认过的内容，以及保障服务安全、正常运行。我们不出售、不出租你的信息，也不用它做广告定向。 Google 用户数据按第 4 节处理。

This section covers the data CrabAI receives from Google APIs when you connect a Google account on CrabAI’s Google consent screen (“Google user data”). It is the complete description of how CrabAI handles Google user data; nothing elsewhere in this policy expands it.

本节说明你在 CrabAI 的 Google 授权页上连接 Google 账号后，CrabAI 从 Google API 获得的数据（「Google 用户数据」）。本节完整说明 CrabAI 如何处理 Google 用户数据，本政策其他部分不扩大本节的范围。

How you connect

You connect on Google’s own consent screen, which names CrabAI and lists the permissions requested. CrabAI asks only for these, and only when you choose to connect that service:

• Google Business Profile — https://www.googleapis.com/auth/business.manage
• Google Drive — https://www.googleapis.com/auth/drive.file, plus OpenID and email for the connected account.
• Google Analytics — https://www.googleapis.com/auth/analytics.readonly (read-only).
• Google Ads — https://www.googleapis.com/auth/adwords
• Outreach Gmail — https://www.googleapis.com/auth/gmail.send and https://www.googleapis.com/auth/gmail.readonly, only through the separate optional mailbox connection described below.

Google Ads offers only this one permission, so Google’s consent screen describes it as full access to manage your Google Ads accounts. CrabAI uses it for the authorized reads and individually confirmed changes described below. We do not use Google sign-in for your CrabAI login. Connecting Business Profile, Ads, Analytics or Drive does not request Gmail access; outreach Gmail uses its own optional authorization. We do not request Calendar or contacts access. Drive uses the separate per-file permission described below.

连接时你在 Google 自己的授权页上看到申请方是 CrabAI，以及申请哪些权限。CrabAI按服务申请 Google 商家资料（business.manage）、Google Ads（adwords）、Google Analytics（analytics.readonly，只读）或 Google Drive（drive.file，逐文件），而且只在你选择连接对应服务时才申请。 Google Ads 只提供 adwords 这一项权限，所以授权页上会把它写成「管理你的 Google Ads 账户」的完整权限，CrabAI 用它执行下文说明的授权读取和逐次确认的变更。我们不用 Google 登录做 CrabAI的账号登录。连接商家资料、Ads、Analytics 或 Drive 不申请 Gmail 权限；邀约 Gmail 使用独立的可选授权，申请 gmail.send 和 gmail.readonly。我们不申请日历或联系人的权限。Drive 仅使用下文说明的逐文件权限。

What we access

• Google Business Profile: the name and ID of your Business Profile account; the business locations your Google account manages (name, address and basic listing details such as the Maps link); customer reviews of those locations and the replies to them; and the replies and posts published through CrabAI.
• Google Ads: the email address of the Google account you connect; the Google Ads accounts your Google account can use (account ID, name, currency, time zone, and whether it is active, a manager account — one that manages other Google Ads accounts — or a test account); and, for the account you choose for a store, campaign and ad-group settings, budgets, bids, ads, assets, targeting and conversion settings, and the performance fields and date ranges you request, such as spend, impressions, clicks and conversions. Account-management or billing information is accessed only for the operation you request and where your role and Google permissions allow it.

Google 商家资料：商家资料账号的名称和编号；你的 Google 账号管理的门店（名称、地址，以及地图链接等基本资料）； 这些门店的顾客评价及回复；经 CrabAI 发出的回复和帖子。Google Ads：你连接的 Google 账号的邮箱地址；你的 Google 账号可以使用的 Google Ads 账户（编号、名称、币种、时区，以及是否有效、是否经理账号（用来管理其他 Google Ads 账号的上级账号）或测试账号）；对你选定的账户，读取广告系列/广告组设置、预算、出价、广告、素材、定向和转化设置，以及你要求的字段与日期范围内的花费、展示、点击、转化等表现。账号管理或账单资料仅在你请求对应操作且角色与 Google 权限允许时读取。

Google Analytics: the connected Google account email, accessible GA4 properties and website hostnames, property currency/timezone, and aggregate users, sessions, purchases, purchase revenue, traffic sources, landing pages and event counts for the website you bind to a store. We show these reports on Website traffic and use them to answer website-analysis questions you ask. We do not modify your Analytics settings or website.

Google Analytics：连接的 Google 账号邮箱、可访问的 GA4 属性与网站域名、属性币种与时区，以及你关联到门店的网站的汇总用户、访问、购买、购买收入、来源、入口页和事件次数。用于网站流量页面及回答你提出的网站分析问题，不修改 Analytics 设置或网站。

How we use it

• To show it to you — your locations and reviews, and, onCrabAI’s Google Ads page, how your campaigns are doing (spend, impressions, clicks and conversions).
• To answer your questions and draft replies — when you ask the assistant about your reviews, or ask for a reply to a review, it reads the data needed and replies with analysis, suggestions or a draft. When you request Google Ads analysis or enable a scoped read task, the assistant also reads the authorized account data needed to answer, summarize reports or prepare a proposed change.
• To act for you, only as you direct — publish a review reply or post you confirmed; or, if you turned on auto-reply for a store, automatically reply to its 4- and 5-star reviews that raise no complaint or question, written in the style of replies you posted yourself, held for 2 hours so you can edit or stop it, and at most 10 a day per store. You can pause or switch auto-reply off at any time. Google Ads changes, including creation, status, budget, bid or removal operations, require an authorized user to review and confirm each prepared change. The assistant can read and prepare a proposal; it cannot confirm or execute it itself.
• To keep the service working and secure — for example, recording that a request to Google failed so we can fix it.

We use Google user data only for these features, all of which you can see in CrabAI. Google Ads data is used to report on and manage your own campaigns at your direction; requesting analysis or accepting a plan does not by itself submit an advertising change.

展示给你：门店、评价，以及在 CrabAI 的 Google Ads 页面显示广告系列的表现（花费、展示、点击、转化）。回答问题、起草回复：你在对话里问到评价、或者让它起草评价回复时， 助手读取所需数据，给出分析、建议或草稿；你请求 Google Ads 分析或开启有范围限制的读取任务时，也会读取获授权账户中所需的数据，用于回答、汇总报表或准备变更建议。只按你的指示代你操作：发布你确认过的回复和帖子；或者在你为某家店开启自动回复后， 自动回复该店没有提出问题或疑问的 4 星、5 星评价——按你以前亲自发出的回复的口吻写，写好后等 2 小时再发，期间你可以修改或拦下， 每家店每天最多 10 条，随时可暂停或关闭。Google Ads 的创建、启停、预算、出价、删除等变更，须有权限的用户逐次核对并确认已准备的内容；助手可以读取和准备，不能自行确认或执行。 保障服务正常和安全：例如记录某次向 Google 的请求失败了，以便修复。我们只把 Google 用户数据用于上述功能，这些功能你都能在CrabAI 里看到。Google Ads 数据用于按你的指示查看和管理你自己的广告系列，请求分析或采纳计划本身不会提交广告变更。

AI processing

The CrabAI assistant is powered by large language models from OpenAI. Google user data is sent to the model only when CrabAI needs it for something you asked for or turned on: answering your question about your reviews, drafting a review reply, or writing an auto-reply you enabled, analyzing authorized Google Ads resources or reports and preparing proposals when you request it or enable a scoped read task, analyzing your selected website using aggregate Google Analytics reports when you ask the assistant, or generating captions from selected imported Drive photos when you request AI captions or start an automatic posting plan. Google Ads analysis can send account identifiers, names, selected settings and report results, dates, currency, your stated goal and relevant instructions to OpenAI. OAuth credentials and the controls that confirm an advertising change are not sent to the model. We do not use Google user data, or anything derived from it, to develop, improve or train any AI or machine-learning model, including generalized or non-personalized models, and we do not transfer it to anyone for that purpose.

CrabAI 的助手由 OpenAI 的大模型驱动。只有在完成你要求或开启的事情时，才会把相关 Google 数据发给模型：回答你关于评价的问题、起草评价回复，撰写你开启的自动回复，在你请求或开启有范围限制的读取任务时分析获授权的 Google Ads 资源/报表及准备建议，在你提问时分析所选网站的 Google Analytics 汇总报表，或在你请求 AI 文案、启动自动发帖计划时根据选中的 Drive 导入照片生成文案。Google Ads 分析可能将账号编号/名称、所选设置和报表结果、日期、币种、你填写的目标及相关指示发送给 OpenAI；OAuth 凭据和用于确认广告变更的操作控件不发送给模型。我们不用 Google 用户数据或由它衍生的数据开发、改进或训练任何 AI / 机器学习模型（包括通用或非个性化模型），也不为此转交给任何人。

Where it is stored and how it is protected

• The access keys Google issues to CrabAI (access and refresh tokens, which let CrabAI act for you) are encrypted with AES-256-GCM, a standard strong encryption method, and kept in a separate service. Refresh tokens and client secrets stay on our servers. Google Drive Picker receives a short-lived access token in your browser to let you select files; our interface does not persist it in browser storage. Other Google access tokens are used server-side.
• Other Google user data is stored in our databases, hosted by Railway in the United States, and in nightly backups that are encrypted before they leave Railway and kept in Cloudflare R2 storage in North America. The key that opens those backups is not stored on Railway or Cloudflare.
• Data travels between your browser, our servers and Google over encrypted connections (HTTPS).

Google 发给 CrabAI 的访问凭据（访问令牌和刷新令牌，相当于代你操作的钥匙）用 AES-256-GCM 这种通行的强加密方式存放在独立服务里。刷新令牌和客户端密钥只留在服务器；Google Drive Picker 会在浏览器使用短期访问令牌供你选文件，界面不把它持久保存在浏览器存储中。其他 Google 服务的访问令牌在服务器使用。其他 Google 用户数据存在 Railway 托管的美国数据库里，以及每晚的备份里；备份在离开 Railway 之前就已加密，存放在 Cloudflare R2（北美），解密钥匙不放在 Railway 或 Cloudflare 上。数据在你的浏览器、我们的服务器和 Google 之间传输时全程加密（HTTPS）。

How long we keep it

• Access keys: until you disconnect that Google account or delete your CrabAI account — then deleted immediately. The store-owned outreach mailbox has the separate rules below.
• Business Profile locations, reviews and replies: kept while your CrabAI account exists (they stay after you disconnect, so your history is not lost); deleted when you delete your account, or within 30 days of an email request.
• Google Ads data: the email of the connected Google account and the Google Ads account you chose for each store are kept until you disconnect Google Ads or delete your CrabAI account. Reports used in conversations become part of conversation/tool history. Saved report definitions, analyses and plans, and encrypted change proposals with before/after values, approval records and provider receipts can remain after disconnecting.
• Record of actions: what was posted or replied, and from which connected account, is kept so failures and abuse can be investigated. If you delete your account it is detached from your sign-in and kept; it has no automatic expiry today, and we delete it within 30 days if you email us.
• Backups roll off on their own schedule and are fully replaced within 90 days.

访问凭据：保存到你断开这个 Google 账号或注销 CrabAI 账号，届时立即删除；门店邀约邮箱按下文单独说明处理。商家资料的门店、评价和回复： 在你的 CrabAI 账号存续期间保留（断开后也保留，历史不会丢），注销即删，或收到邮件后 30 天内删除。Google Ads 数据：连接的 Google 账号邮箱和你为每家门店选定的 Google Ads 账户，保存到你断开 Google Ads 或注销 CrabAI 账号为止。对话中使用的报表会成为对话/工具历史的一部分；保存的报表定义、分析/计划，以及加密变更草案中的前后值、批准记录和平台回执可能在断开后继续保留。操作记录（发了什么、回复了什么、用的哪个已连接账号）用于排查故障和滥用； 注销后与登录账号脱钩继续保留，目前没有自动到期，发邮件给我们，30 天内删除。备份按自身周期滚动，90 天内完全覆盖。

Google Ads records: when a new change preview is created, we clean up transaction/event records last updated more than 365 days ago, except executing, uncertain or submitted operations. This is not a guaranteed deletion date for every record. Saved analyses and report definitions do not expire automatically. Deleting a personal account removes its local advertising transactions and saved report definitions; shared store/customer analyses and plans are separate records. Contact us to request removal of retained advertising records. The confirmation deadline on a proposal only controls whether it can still be executed.

Google Ads 记录：创建新的变更预览时，会清理最后更新超过 365 天的事务/事件记录，但执行中、结果不明确或已提交的操作除外；这不是每条记录的保证删除日期。保存的分析和报表定义不会自动到期。注销个人账号会删除该账号本地的广告事务与报表定义，门店/客户共享分析和计划是独立记录；保留的广告记录可联系我们申请删除。草案确认时限只决定还能否执行，不是数据删除时限。

Saved advertising snapshot access records: we keep the associated account, customer, snapshot version, chat/turn read scope and encrypted read credential. These records have no automatic cleanup and are not currently removed when you delete a conversation or personal account. Credential expiry ends access with that credential, not storage of the records. Request removal through the advertising data deletion instructions.

已保存广告快照的访问记录：我们保存关联账号、客户、快照版本、会话/轮次读取范围及加密读取凭据。这些记录没有自动清理，当前删除对话或个人账号也不会移除；读取凭据到期会终止通过该凭据的访问，不等于删除记录。可按广告数据删除说明申请移除。

Google Ads query caches and request limits: to reduce repeated requests and enforce platform limits, we store cached query results, request/usage records, and project/ad-account coordination records. Company-connected Google Ads reads can reuse a result for the same connection context, ad account and query conditions, subject to current sign-in and customer-binding checks. Personal Google connections remain separate; this shared cache does not contain personal conversations, drafts or approvals.

Google Ads 查询缓存与请求限额：为减少重复请求并遵守平台限额，我们保存查询结果缓存、请求/用量记录，以及项目和广告账户的协调记录。公司接入的 Google Ads 读取可在同一连接上下文、广告账户和查询条件下复用结果，但仍须通过当前登录和客户绑定检查。个人 Google 连接保持独立；这类共享缓存不包含个人对话、草稿或审批。

Cache validity controls reuse, not deletion from storage. During later request-completion processing, request records created more than seven days ago and snapshots more than one day past their cache validity with no active collection lease become eligible for cleanup in limited batches. These are not guaranteed deletion deadlines. Project/ad-account coordination records have no automatic expiry. Disconnecting or deleting a personal account does not automatically erase these shared caches and control records; use the Google Ads deletion instructions to request removal.

缓存有效期决定能否复用，不等于从存储中删除。在后续请求完成处理时，创建超过七天的请求记录，以及缓存有效期已过一天且没有进行中采集租约的快照，才会分批清理；这些时间不是保证删除期限。项目和广告账户协调记录没有自动到期。断开连接或注销个人账号不会自动清空这些共享缓存与控制记录；如需移除，请按Google Ads 数据删除说明申请。

Google Analytics retention: encrypted credentials and website bindings are kept until you disconnect or delete your account. Reports are read on demand and not stored as an analytics database. Reports used in a conversation become part of that conversation and its tool history, retained under the conversation retention terms below. Disconnecting Analytics removes credentials and bindings, not existing conversations. Analytics disconnect deletes the grant locally without revoking other Google services; you can revoke the entire app in your Google Account settings.

Google Analytics 保留：加密凭据和网站关联保存到断开或注销；报表按需读取，不另建报表数据库。用于对话的报告成为该对话及工具记录的一部分，按下文对话保留规则保存。断开 Analytics 会删除凭据与关联，不会删除已有对话；也不会向 Google 撤销其他服务的权限。你可在 Google 账号设置中撤销整个应用。

Gmail: outreach messages and related replies · Gmail 邀约与相关回复

Connecting an outreach mailbox is optional and uses a separate Google authorization. We send only messages you individually preview and confirm. Read-only permission identifies the connected mailbox, checks an uncertain send by its exact Message-ID, and reads replies in threads started by confirmed outreach through CrabAI. The permission covers the mailbox, but this integration does not search for unrelated inbox conversations or edit labels, delete mail or change mailbox settings. Only replies matching the saved thread, addresses and reply references are added to the collaboration.

连接邀约邮箱是可选功能，使用独立的 Google 授权。邮件须由你逐封预览并确认才会发送。只读权限用于识别连接的邮箱、按精确 Message-ID 核对结果不明确的发送，以及读取经 CrabAI 确认发起的邀约线程中的回复。权限本身覆盖邮箱，但此接入不搜索无关收件箱对话，也不改标签、删邮件或更改邮箱设置；只有线程、收发地址和回复引用符合已保存会话的回复才会加入合作记录。

We store the connected address and encrypted access/refresh credentials; outgoing drafts and messages, including sender, recipient, subject, body and contact-source snapshot; verified replies; message/thread identifiers, delivery status, timestamps and preview/approval/action records. Authorized users of the same store can view this collaboration history. Confirmed messages go through Google to the recipient you selected; hosting and storage providers process the records as described below. This mailbox integration does not send message content to AI models. Content you separately choose to paste into the assistant is processed as a conversation; Google user data is not used to train AI models.

我们保存连接的邮箱地址及加密的访问/刷新凭据；发信草稿和邮件，包括发件人、收件人、主题、正文及联系来源快照；核实的回复；邮件/线程编号、投递状态、时间和预览/批准/操作记录。同店有权限的用户可以查看合作历史。确认的邮件经 Google 发给你选定的收件人，托管和存储服务商按下文说明处理记录。邮箱接入本身不将邮件内容发送给 AI 模型；你另外主动粘贴到助手的内容按对话处理，Google 用户数据不用于训练 AI 模型。

In the outreach mailbox card, Disconnect mailbox removes our saved credentials and pending authorization state and cancels prepared or queued messages. Synchronization or sending that has already started may finish; a message already submitted cannot be recalled. Existing messages and collaboration/action history remain and have no automatic expiry; a preview's confirmation deadline is not a deletion deadline. Disconnecting does not revoke Google-side access or delete mail in Gmail. You can revoke this app separately in your Google Account's third-party connections settings.

在邀约邮箱卡片选择「断开邮箱」，会删除我们保存的凭据和待完成授权状态，并取消已预览或排队的邮件。已开始的同步或发送仍可能完成；已经提交发送的邮件不能撤回。已有邮件和合作/操作历史保留，目前没有自动到期；预览确认时限不是数据删除时限。断开不会向 Google 撤销授权，也不会删除 Gmail 中的邮件；你可另行在 Google 账号的第三方连接设置中撤销此应用。

This mailbox and its records belong to the store, not just your personal login; deleting your personal CrabAI account does not automatically remove them. Disconnect the mailbox while you have access, or contact us to request removal of retained mailbox credentials, messages and collaboration records. See Gmail deletion instructions.

邮箱和记录属于门店，不仅属于个人登录账号；注销个人 CrabAI 账号不会自动删除这些数据。请在仍有权限时断开邮箱，或联系我们申请删除保留的邮箱凭据、邮件和合作记录，具体见Gmail 数据删除说明。

Google Drive: selected files and imported copies

Connecting Drive is optional. We request https://www.googleapis.com/auth/drive.file, plus OpenID and email to identify the Google account you connect. Google describes this scope as permission to see, edit, create and delete specific files you use with the app; CrabAI uses it to display metadata and thumbnails for photos and videos already shared with this app, and to read originals when you select them for import or content creation. The library shows these authorized files as private references without automatically copying originals. We do not access files outside this grant, traverse folders, automatically synchronize originals, or edit or delete files from Google Drive.

连接 Drive 是可选的。我们申请 drive.file，以及用于识别所连接 Google 账号的 OpenID 和邮箱权限。Google 将该权限描述为查看、编辑、创建和删除你通过应用使用的特定文件；CrabAI 用它展示已授予本应用访问权限的图片／视频元数据与缩略图，并在你选用文件导入或创作时读取原件。素材库直接显示这些账号私有映射，不会自动复制原件；不访问授权范围外文件、不遍历目录、不自动同步原件、不修改或删除 Drive 原件。

Your Drive connection is bound to the selected store; other stores cannot use that connection. Reconnecting for another store replaces your previous Drive authorization in CrabAI. We store the account-to-store binding and authorization request records to enforce this choice.

Drive 连接绑定到所选门店，其他门店不能使用这份连接。在另一家店重新连接会替换你在 CrabAI 中原有的 Drive 授权。我们保存账号与门店的绑定和授权请求记录，以落实这个选择。

We read the selected file's ID, name, media type, size and available integrity metadata, and copy its original media bytes into the selected customer's independent asset library. Authorized users of that customer can preview, download and select those copies for posts. When you request AI captions or start an automatic posting plan, selected photos and relevant writing context are processed by OpenAI to generate captions. Importing alone does not publish a post or start an automatic plan. We do not use this data to train AI models.

我们读取所选文件的编号、名称、媒体类型、大小及可用的完整性校验信息，将原始媒体字节复制到当前客户的独立素材库。拥有该客户权限的用户可预览、下载和选用副本发帖。你请求 AI 文案或启动自动发帖计划时，选中的照片与必要写作上下文会由 OpenAI 处理以生成文案。仅导入不会发布帖子或启动自动计划，也不用于训练 AI 模型。

Disconnecting Drive deletes the locally stored Drive credentials. Requests already in progress may finish; disconnecting does not revoke the whole Google project's authorization or remove imported copies, drafts or existing schedules. You can revoke the app separately in your Google Account settings; this may affect other Google services connected through the same project. Deleting your CrabAI account deletes its Drive credentials and attempts to revoke the Drive grant with Google; a failed revocation does not undo account deletion.

断开 Drive 会删除本地保存的 Drive 凭据，已开始的请求仍可能完成；不会撤销整个 Google 项目的授权，也不会删除已导入副本、草稿或已有排期。你可以另行在 Google 账号设置中撤销应用，可能同时影响该项目下连接的其他 Google 服务。注销 CrabAI 账号会删除其 Drive 凭据，并尝试向 Google 撤销 Drive 授权；撤销失败不会撤回账号删除。

Disconnecting clears the active store association. Connection-binding records and their authorization request records may remain after disconnecting or deleting your personal account. Binding records have no automatic expiry. Expired request records are cleaned during a later connection attempt, so an authorization deadline is not a guaranteed deletion date. You can request removal of these retained records through the deletion instructions below.

断开会清空当前门店关联。连接绑定记录及其授权请求记录可能在断开或注销个人账号后保留；绑定记录没有自动到期。过期请求记录在之后发起连接时清理，授权截止时间不是保证删除日期。你可按下方删除说明申请移除这些保留记录。

Imported copies do not expire automatically. To remove one, move it to the asset library's recycle bin and confirm permanent deletion. Active publishing references block deletion; pending storage cleanup is retried, and shared or external objects are retained and reported. Google originals are unaffected. We retain source file/customer/asset identifiers for deduplication and minimal deletion audit records; permanent deletion is not a claim that every audit or backup entry vanishes immediately. Existing copies are not automatically updated when a Drive original changes. Disconnecting or deleting a personal account does not automatically erase a customer's independent library: remove copies while you have access or contact us to request deletion of retained files, receipts and records. We handle deletion requests within 30 days, and backups roll off within 90 days.

导入副本不会自动到期。删除时先移入素材库回收站，再确认永久删除。有有效发布引用时禁止删除；存储清理未完成会重试，共享或外部对象保留并明确提示，Google 原件不受影响。我们保留来源文件、客户及素材编号用于去重，并保留最小删除审计；永久删除不表示审计及备份条目立即全部消失。Drive 原件变化不会自动更新已导入副本。断开或注销个人账号不会自动清空客户的独立素材库：请在仍有权限时删除副本，或联系我们申请删除保留文件、导入回执和记录。删除申请在 30 天内处理，备份在 90 天内滚动覆盖。

Who we share it with

In addition to the authorized sharing and publishing described above, service providers process data on our behalf to run CrabAI, and only as needed for the features above:

• Railway — application hosting and databases.
• Cloudflare — some of our network traffic passes through it, and it stores our encrypted backups and imported media in the independent asset library.
• OpenAI — the AI models that generate the assistant’s replies and requested analyses (see “AI processing” above), including the Google Ads data needed for those requests.
• Oracle Cloud — hosts one of our tool gateways, which the assistant uses to fetch data from your connected Google Business Profile and social media accounts.

We do not sell or rent Google user data. We do not transfer it to data brokers or information resellers. Data read from Gmail, Drive, Analytics or Business Profile, and data derived from it, is not used to profile people, build advertising audiences, or target or retarget advertising. We do not transfer that data to advertising platforms for those purposes. Authorized Google Ads operations send the campaign settings, targeting choices and creative content you provide and confirm to Google for your campaigns; this does not authorize using data from those other Google services for advertising targeting. When you request publishing, selected imported media and captions are sent to your chosen connected social platforms through our publishing services. We do not use it to determine creditworthiness or for lending. Beyond the authorized uses and providers above, we disclose it only when required by law, when needed for security (for example, investigating abuse), or as part of a merger, acquisition or sale of assets — and in that last case only after obtaining your explicit consent first.

除上述经授权的协作、共享和发布外，服务商也会代我们处理数据，且只限上述功能所需：Railway（托管与数据库）、Cloudflare（部分网络流量经过它，存放加密备份及独立素材库中的导入媒体）、 OpenAI（生成助手回复和你要求的分析，见上文「AI 处理」，包括完成这些请求所需的 Google Ads 数据）、Oracle Cloud（托管我们的一个工具网关，助手通过它读取已连接的 Google 商家资料和社媒账号的数据）。 我们不出售、不出租 Google 用户数据，不转给数据经纪商或信息转售商，不用于信用评估或借贷。从 Gmail、Drive、Analytics 或商家资料读取的数据及其衍生数据，不用于建立个人广告画像、构建广告受众、广告定向或再营销，也不为这些目的转交广告平台。获授权的 Google Ads 操作会把你提供并确认的广告系列设置、定向选择和广告素材发送给 Google，用于你的广告系列；这不授权将上述其他 Google 服务的数据用于广告定向。你要求发布时，选中的导入媒体和文案会经发帖服务发送到你选择的已连接社交平台。除上述经授权的用途和服务商外， 只在法律要求、安全需要（如调查滥用）或公司合并、收购、资产出售时披露，最后一种情况须先取得你的明确同意。

Who at Open Media can see it

People at Open Media do not read your Google user data unless you have asked us to look at specific data (for example, a review you want help with), it is necessary for security (for example, investigating a bug or abuse), it is required by law, or it has been aggregated and is used for internal operations in line with applicable law (for example, counting how many replies were sent across all stores).

Open Media 的人员不阅读你的 Google 用户数据，除非你请我们查看具体的数据（例如你想让我们帮忙看的某条评价）、 安全需要（如排查故障或滥用）、法律要求，或者数据已经汇总、并按适用法律用于内部运营（例如统计全部门店一共发了多少条回复）。

Disconnecting and deleting

• Business Profile and Ads in CrabAI: open Social accounts (社媒账号), choose ⋯ next to the account, then Disconnect (解绑账号). We delete our copy of the access keys immediately, stop using the account, and revoke CrabAI’s access with Google, unless another CrabAI account is still connected to the same Google account. If you connected Google Business Profile and Google Ads with the same Google account, Google may treat them as one authorization, so disconnecting one can also end CrabAI’s access to the other; connect it again if you still need it.
• At Google: remove CrabAI at myaccount.google.com/permissions at any time. After that, CrabAI can no longer reach that account.
• Account deletion: delete your account under Account settings → Delete account (账号设置 → 注销账号; on a phone, 我的 → 账号设置), or email info@openmediaads.com. Store-owned outreach data and independent library copies follow the separate rules above. Step-by-step instructions are on the Data Deletion page.

在 CrabAI 里断开商家资料或 Ads：打开「社媒账号」，点账号旁的「⋯」→「解绑账号」。我们会立即删除访问凭据、停止使用这个账号， 并向 Google 撤销 CrabAI 的授权（除非另一个 CrabAI 账号仍连着同一个 Google 账号）。如果你用同一个 Google 账号同时连接了 Google 商家资料和 Google Ads，Google 可能把它们视为同一份授权，解绑其中一个可能同时结束另一个的访问， 需要的话重新连接即可。在 Google 里：随时可以在 myaccount.google.com/permissions 移除 CrabAI，移除后CrabAI 就无法再访问该账号。账号删除：在「账号设置 → 注销账号」（手机上在「我的 → 账号设置」）里注销，或发邮件到 info@openmediaads.com；门店邀约数据和独立素材库副本按上文单独说明处理，具体步骤见「数据删除」页。

Limited Use

CrabAI’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

CrabAI 对从 Google API 获得的信息的使用，将遵守 Google API 服务用户数据政策（Google API Services User Data Policy），包括其中的 Limited Use（有限使用）要求。

The posting-data description below applies to the TikTok social publishing connection. A separate, optional TikTok Ads connection can read advertising accounts, settings and performance for advertising features you authorize. When you ask the assistant to analyze them, the required advertising resources and report results are sent to OpenAI.

下文发帖数据说明针对 TikTok 社媒发帖连接。独立、可选的 TikTok Ads 连接可读取广告账户、设置及表现，以完成你授权的广告功能；当你请求助手分析时，所需广告资源和报表结果会发送给 OpenAI。

When you connect a TikTok account, you authorize CrabAI through TikTok’s own login screen and you choose which permissions to grant. Here is exactly what we receive, where it lives, and how it goes away.

What we obtain

• Account identifiers and profile — your TikTok open ID, display name and profile picture, so the workspace can show which account a post will go out from.
• Creator posting settings — the privacy levels available to you, whether comments, Duet and Stitch are allowed on your account, your maximum video length, and how many posts you have made today. These are read from TikTok each time the posting screen opens and are shown to you before you post.
• Publishing results — the publish identifier and status TikTok returns for each post we send on your behalf.
• Access and refresh tokens — the credentials TikTok issues so we can act on your behalf until you disconnect.

Through the social publishing connection, we do not read your inbox, your followers, your analytics, or anyone else’s content.

How we store it

• Tokens are encrypted at rest, held on our servers only, and never sent to a browser or to any third party.
• Creator posting settings are not kept — they are fetched live for the screen you are looking at and discarded when you leave it.
• We keep a record of what was published, when, and by which account, so you can see your own posting history and so we can investigate failures.

How it is deleted

• You can disconnect a TikTok account at any time. On disconnect we delete our copy of the token immediately and revoke the access with TikTok, unless another CrabAI account is still connected to the same TikTok account; then we leave the TikTok authorization in place so theirs keeps working, and you can remove it in TikTok’s settings. The account’s name and ID stay on the disconnected entry until you delete your account or ask us to remove them.
• Publishing records are kept while your account exists so you can see your posting history, and are deleted when you delete it; for accounts set up by Open Media they are kept for up to 12 months. You can ask us to delete them sooner.
• To have everything removed, email info@openmediaads.com. We act on the request within 30 days and confirm when it is done.

连接 TikTok 时你在 TikTok 自己的授权页上选择给哪些权限。我们取得的是：账号标识与 昵称头像、创作者发帖设置（可选隐私级别、是否允许评论/合拍/拼接、最长时长、当天已发条数，每次打开发帖页都实时重新拉取并展示给你）、每条发布的结果与 publish id、 以及访问与刷新令牌。通过社媒发帖连接，我们不读你的私信、粉丝、后台分析，也不读别人的内容。 令牌加密存储、只留在服务端；创作者设置不落库，看完即弃；发布记录在账号存续期间保留、方便你查看发帖历史，注销即删，由 Open Media代开的账号至多保留 12 个月，你也可以要求提前删除。你随时可以断开连接 —— 断开时我们立即删除令牌，并向 TikTok 撤销授权；但如果另一个 CrabAI 账号仍连着同一个 TikTok 账号，我们会保留 TikTok 上的授权以免影响对方，你可以到 TikTok 设置里自己移除。账号名和账号编号留在那条已断开的记录上， 直到你注销账号或要求我们删除。要彻底删除，发邮件到 info@openmediaads.com，我们在 30 天内处理并回复确认。

You connect Facebook Pages and Instagram accounts through Meta’s own authorization screen. We obtain only what the features you use need — such as your Pages and Instagram professional accounts, their messages and comments, and the posts you publish through CrabAI. Tokens are encrypted at rest. When you disconnect, we delete our copy of the token immediately; we do not currently revoke the access with Meta for you, so remove it in your Facebook or Instagram settings (see the Data Deletion page).

Facebook 主页和 Instagram 账号通过 Meta 自己的授权页连接。我们只取你所用功能需要的部分，例如你的主页和 Instagram 专业账号、它们的私信与评论、以及你经 CrabAI 发布的帖子。令牌加密存储。断开时我们立即删除令牌； 目前不会替你向 Meta 撤销授权，请到 Facebook 或 Instagram 的设置里自己移除（见「数据删除」页）。

Service providers that run parts of CrabAI for us: hosting, database and file-storage providers; Oracle Cloud, which hosts one of our tool gateways; Cloudflare, for network traffic and our encrypted backups; OpenAI, whose models generate the assistant’s replies (conversation content is sent there to produce a reply); and the publishing service that delivers some posts to social platforms. Each gets only what it needs for that job. We do not share your data with advertisers or data brokers. Google user data is shared only as section 4 describes.

代我们运行 CrabAI 部分功能的服务商：托管、数据库与文件存储服务商；托管我们一个工具网关的 Oracle Cloud；承载网络流量并存放加密备份的 Cloudflare；生成助手回复的 OpenAI（对话内容会发过去以生成回复）； 以及把部分帖子送达社媒平台的发帖服务。每家只拿到它那项工作需要的部分。 不与广告商或数据经纪商共享。Google 用户数据只按第 4 节共享。

Your CrabAI account is protected by your password (stored only as a salted hash) and optional two-step verification. Platform credentials are encrypted at rest and are only ever used server-side, and data is encrypted in transit (HTTPS). No method of transmission or storage is perfectly secure, and we do not claim otherwise.

CrabAI 账号由你的密码（只存加盐哈希）和可选的两步验证保护；平台凭据加密存储且只在服务端使用， 传输全程加密（HTTPS）。没有任何传输或存储方式是绝对安全的，我们不作此承诺。

You can disconnect any platform account, delete your account yourself (Account settings → Delete account, 账号设置 → 注销账号), or ask us for a copy of what we hold about you, to correct it, or to delete it. Email info@openmediaads.com (or, if Open Media runs your store, your Open Media contact). Step-by-step instructions are on the Data Deletion page.

你可以随时断开任一平台账号、在「账号设置 → 注销账号」里自己注销，也可以要求查阅、更正或删除我们持有的你的信息。 发邮件到 info@openmediaads.com（门店由 Open Media 代运营的，也可以找你的对接人）；具体怎么做见「数据删除」页。

CrabAI is a business tool and is not directed to anyone under 18.

CrabAI 是面向商户的工具，不面向 18 岁以下人群。

We may update this policy. The effective date at the top always reflects the current version. If we change how we use Google user data or other connected platform data, we will tell you in CrabAI and ask for your consent before using it in the new way.

本政策可能更新，顶部生效日期即当前版本。如果我们改变使用 Google 用户数据或其他已连接平台数据的方式，会先在 CrabAI 里告诉你并征得你的同意，再按新方式使用。