Privacy Policy

Last updated: July 2026

1. Introduction

Crumblelead ("we", "us", or "our") operates the Crumblelead applicant tracking system (the "Platform") and the Crumblelead LinkedIn Importer browser extension (the "Extension"). The Platform is operated by Tonight Media Co., Ltd (Tax ID 0205562013361), which is the data controller responsible for your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and password. If you join a team, we also store your team membership and role.

2.2 Recruitment Data

You may store candidate profiles, client/company records, job listings, notes, files, and other recruitment-related data on the Platform. This data is entered by you or imported through our tools.

2.3 Browser Extension Data

The Crumblelead LinkedIn Importer extension extracts publicly visible profile data from LinkedIn pages you are actively viewing, only when you explicitly click the import button. This includes names, job titles, company names, education, location, and profile photos. The extension stores only your API authentication token locally in your browser using chrome.storage. No data is collected in the background or without your action.

2.4 Usage Data

We collect standard server logs including IP addresses, browser type, and pages visited to maintain security and improve our services.

3. How We Use Your Information

  • To provide and maintain the Platform and Extension
  • To authenticate your account and manage team access
  • To import and store recruitment data you choose to save
  • To send transactional emails (account verification, password resets, team invitations)
  • To improve our services and fix issues

4. Data Storage and Security

Your data is stored on secure servers using PostgreSQL with encryption at rest and in transit. We use industry-standard security measures including HTTPS, hashed passwords, and API token authentication to protect your information.

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. Your recruitment data is only accessible to members of your team on the Platform. We may share data only in the following cases:

  • With your team members as configured by your team's admin
  • With service providers who help us operate the Platform (hosting, email delivery), under strict data processing agreements
  • When required by law or to protect our legal rights

AI Processing

Crumblelead uses artificial intelligence features provided by a third-party AI provider to power resume parsing, candidate profile analysis, and candidate-to-job matching. When these features are used by your recruitment team, candidate personal data, including resume content, skills, experience, and profile information, is sent to that provider for processing. It processes this data under a data processing agreement with Crumblelead and does not use it to train its models. See our Sub-processors page for how our sub-processors break down by function; the full named list, including our AI provider, is available to customers under our Data Processing Agreement.

6. Browser Extension Permissions

The Extension requests the following permissions, each for a specific purpose:

  • Storage: To save your API authentication token locally so you stay logged in between sessions.
  • Active Tab: To read profile data from the LinkedIn page you are currently viewing when you click the import button.
  • Host permissions (linkedin.com): To inject the import button on LinkedIn profile and company pages.
  • Host permissions (crumblelead.com): To send imported data to your Crumblelead account.

The Extension does not run any remote code. All functionality is bundled within the extension package. No data is collected or transmitted without your explicit action.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account or request data removal, we will delete your personal data within 30 days. Recruitment data stored by your team may be retained by the team until the team admin deletes it.

8. Your Rights

You have the right to:

  • Access and download your personal data
  • Correct inaccurate information
  • Request deletion of your account and data
  • Withdraw consent for data processing

To exercise any of these rights, contact us at the email address below.

9. Cookies

We use essential cookies for session management and authentication. We do not use tracking or advertising cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "Last updated" date.

11. Contact Us

Crumblelead is operated by Tonight Media Co., Ltd (Tax ID 0205562013361), 4296 (Room 4, Floor 3), Dindaeng Subdistrict, Dindaeng, Bangkok 10400, Thailand.

If you have any questions about this Privacy Policy, please contact us at [email protected].