Global Privacy Notice - Crowd Control

Last updated: 11/4/2026

Crowd Control, operated by Court & Bergen, LLC (“Company,” “we,” “our,” or “us”), respects your privacy and is committed to protecting it. This Global Privacy Notice describes how we collect, use, process, retain, and disclose personal data when you use crowdcontrol.co or our Shopify apps, including Relocate+ Order Editing and the legacy Crowd Control Pledge Manager (collectively, our “Services”).

This notice applies to information we collect:

Through crowdcontrol.co and our Shopify apps, including Relocate+ Order Editing and the legacy Crowd Control Pledge Manager.
In communications, including email, chat, and other electronic messages, between you and Crowd Control.

This notice does not apply to information collected by third parties that operate independently from Crowd Control, including Shopify, or to websites and services that link to their own privacy notices.

We may provide additional privacy notices for particular features, services, or activities. Those notices supplement this notice and apply to the processing they describe.

Please read this notice carefully to understand our practices regarding personal data. This notice may change from time to time; see Changes to This Global Privacy Notice for more information.

Children's and Minors’ Data

Our Services are not directed to children under 16. We do not knowingly collect personal data from anyone under 16, or under a higher minimum age where the law of the applicable jurisdiction requires a higher age. If we learn that we collected personal data from a child in violation of applicable law, we will delete it.

The Personal Data That We Collect or Process

“Personal data” means information that identifies, relates to, or could reasonably be linked with an individual. It does not include information that has been deidentified or aggregated so that it cannot reasonably be used to identify an individual.

The types and categories of personal data we collect or process include:

Merchant account and contact information, including name, business contact details, email address, and information used to administer a Crowd Control account.
Shopify store information and access tokens needed to connect, authenticate, and provide the Services to a merchant’s Shopify store.
Support communications and other information you provide when you contact us, including through squad@crowdcontrol.co or amigo@crowdcontrol.co.
Device and usage data, including IP address, browser and operating system information, device identifiers where available, logs, timestamps, pages viewed, and interactions with the Services.
Cookie and similar technology information, including information collected through cookies and comparable technologies used to operate, secure, measure, and improve the Services.
Shopper names, email addresses, and order details processed through the Services for merchants, as described in Merchants’ Customers’ Data.

We do not intentionally collect biometric information, identity-document numbers, Social Security numbers, precise geolocation, demographic information, or payment card information. Shopify processes payments for Shopify stores, and Crowd Control does not receive or store payment card data through the Services.

We do not seek to collect special categories of personal data (as defined under the GDPR) or sensitive personal information (as defined under applicable U.S. state law). Where any such data is processed, we do so only as permitted by applicable law and, where required, with your consent.

We also collect:

Aggregated information. We may aggregate or deidentify information so that it no longer reasonably identifies an individual. We may use that information for analytics, reporting, and service improvement.
Technical information. Technical information includes internet connection information and usage details about interactions with the Services, such as access times, pages viewed, response times, errors, and navigation patterns.

If we combine aggregated or technical information with personal data so that it identifies an individual, we will treat the combined information as personal data.

Merchants’ Customers’ Data

Crowd Control processes shopper names, email addresses, and order details on behalf of merchants that use the Services. For this data, Crowd Control acts as a processor or service provider under the applicable merchant’s Data Processing Addendum.

The merchant determines the purposes and means of processing this data and is the controller or business responsible for it. The merchant’s privacy notice governs its collection and use of shopper data.

If you are a shopper whose information is processed through a merchant’s use of the Services, please direct privacy requests to that merchant. We will assist the merchant as required by the applicable Data Processing Addendum and law.

How We Collect Personal Data

Information You Provide

We collect information you provide when you create or administer a merchant account, connect a Shopify store, request support, communicate with us, or otherwise use the Services.

Automatically Through Our Services

As you navigate through and interact with the Services, we may automatically collect device and usage data, IP address, browser and operating system information, logs, timestamps, and information collected through cookies and similar technologies.

These technologies help us operate, secure, troubleshoot, measure, and improve the Services.

The technologies we use for automatic collection may include:

Cookies. Cookies are small files placed on your device when you interact with the Services. We use essential cookies to operate and secure the Services and may use non-essential cookies for analytics and service improvement. Where required, we obtain prior consent for non-essential cookies from users in the EEA and the UK through a cookie banner. You can manage choices through the Cookie Settings link or your browser settings.

How We Use Personal Data

We use the personal data we collect or process to:

Provide, operate, maintain, secure, and support the Services.
Operate Relocate+ Order Editing and the legacy Crowd Control Pledge Manager, including enabling merchants and their shoppers to edit address or order information and cancel orders where the merchant permits.
Fulfill the purpose for which you provide the information, including responding to support requests and administering an account.
Communicate with you about your account, the Services, security, support, and material service changes.
Analyze and improve the Services, develop aggregated or deidentified information, troubleshoot issues, and measure performance. We do not use personal data to train general-purpose artificial intelligence models.
Send direct marketing where permitted by law and consistent with your choices. We do not sell personal data or use personal data for targeted advertising.
Carry out our contractual obligations and enforce our rights under agreements with you or a merchant, including for billing, collection, security, and fraud prevention.
Notify you about Services updates and changes to products or services we offer.
Process personal data for another purpose with your consent where consent is the applicable legal basis.

GDPR Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases under Article 6(1), depending on the purpose and circumstances of the processing:

Consent — Article 6(1)(a). Non-essential cookies, optional direct marketing, and other processing for which we ask you to provide consent.
Contract — Article 6(1)(b). Providing and supporting the Services, administering accounts, connecting Shopify stores, and performing applicable agreements.
Legal obligation — Article 6(1)(c). Complying with applicable law, responding to lawful requests, maintaining required records, and addressing legal claims.
Legitimate interests — Article 6(1)(f). Securing, troubleshooting, improving, and administering the Services, preventing fraud, communicating about service matters, and protecting our rights, where those interests are not overridden by your rights.

Aggregated and usage information helps us understand performance and usage of the Services and improve their functionality.

We may use that information to estimate audience size, understand usage patterns, measure performance, and identify technical issues.

Who We Disclose Personal Data To

We may disclose aggregated or deidentified information that cannot reasonably identify an individual without restriction, consistent with applicable law.

We may disclose personal data as described in this notice:

To contractors, service providers, and other processors that support our organization or provide services on our behalf, subject to confidentiality, security, and purpose limitations.
To a buyer or successor in connection with a merger, acquisition, financing, reorganization, dissolution, or other transfer of some or all of our business or assets, subject to applicable law.
To fulfill the purpose for which you provide the personal data or as otherwise directed by you or the applicable merchant.
With your consent or at your direction.

We may also disclose personal data:

To comply with applicable law, court order, legal process, or lawful government or regulatory request.
To enforce or apply our agreements and other policies, including for billing, collection, security, and fraud prevention.
If we believe disclosure is reasonably necessary to protect the rights, property, or safety of Crowd Control, our users, merchants, shoppers, or others.

The categories of personal data we may disclose include:

Merchant account and contact information.
Shopify store information and access tokens, where necessary to provide or support the Services.
Support communications and information provided in connection with a request.
Device and usage data.
Cookie and similar technology information.
Shopper names, email addresses, and order details processed for merchants, subject to the applicable merchant’s instructions and Data Processing Addendum.

Global Privacy Rights and Choices

Depending on where you live and the law that applies, you may have the rights described below. Some rights are subject to legal exceptions and may apply differently to merchants’ shopper data, for which the merchant is responsible.

Global Rights

Access, rectification, and erasure. You may request access to your personal data, correction of inaccurate data, and deletion of data where applicable.
Restriction and portability. You may request restriction of processing in applicable circumstances and receive personal data in a portable format where applicable.
Objection and withdrawal. You may object to processing based on legitimate interests, including direct marketing, and withdraw consent at any time where processing is based on consent.
Automated decisions. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, except where permitted by law.
Complaints and response time. You may complain to a supervisory authority, including in the place where you live, work, or believe an infringement occurred. Where required by law, we will respond to a rights request within one month.

Cookies and Tracking Technologies:

Cookies and Cookie Settings. You can manage non-essential cookie choices through the Cookie Settings link and can configure your browser to refuse or delete cookies. Essential cookies may be necessary for the Services to function. Where required in the EEA or UK, we ask for consent before setting non-essential cookies.

Your U.S. State and California Privacy Rights

Depending on your state of residence, you may have rights related to your personal data, including the following:

Access and data portability. You may confirm whether we process your personal data and request access to a copy in a portable format where required by law.
Correction. You may request correction of inaccuracies in personal data we maintain, subject to applicable law.
Deletion. You may request deletion of personal data we maintain, subject to exceptions under applicable law.
Opt out of sale, sharing, targeted advertising, and certain profiling. You may have the right to opt out of these activities under applicable state law. Crowd Control does not sell personal data or use it for targeted advertising.
Right to Appeal. If we decline to take action on a rights request, you may appeal that decision by contacting us at privacy@crowdcontrol.co within the period permitted by applicable law. We will respond to your appeal within the time required by law and will explain the reasons for our decision. If your appeal is denied, you may contact your state attorney general or other applicable supervisory authority.

Important: The exact scope of these rights varies by state, and exceptions may apply.

To exercise a right or appeal a decision regarding a consumer rights request, contact us at privacy@crowdcontrol.co. We may take reasonable steps to verify your request as permitted by law.

Some browsers and browser extensions support Global Privacy Control (“GPC”), which can send a signal to opt out of certain processing. When we detect a GPC signal, we will make reasonable efforts to honor it as required by applicable law.

If you are a California resident, you may have rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, including for targeted advertising, as provided by the California Consumer Privacy Act. You may also have the right to limit certain uses of sensitive personal information. Crowd Control does not sell or share personal information for targeted advertising.

Authorized Agents. Where permitted by applicable law, you may use an authorized agent to submit a rights request on your behalf. We may require the agent to provide proof of authorization and may ask you to verify your identity directly with us before we process the request.

Non-Discrimination. We will not discriminate or retaliate against you for exercising any of your privacy rights, including by denying services, charging different prices, or providing a different level or quality of services, except as permitted by applicable law.

How We Protect Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of personal data transmitted to or through the Services.

You are responsible for taking reasonable steps to protect your account credentials and other personal data against unauthorized use, disclosure, and access.

In the event of a personal data breach, we will notify affected individuals, merchants, and supervisory authorities as and when required by applicable law and the applicable Data Processing Addendum.

How We Retain Personal Data

We retain personal data only for as long as reasonably necessary for the purposes described in this notice, including to provide and secure the Services, support merchants and users, comply with legal obligations, resolve disputes, enforce agreements, maintain business records, prevent fraud, and protect safety. We consider the nature and amount of data, the sensitivity and risk of harm, the purposes of processing, whether those purposes can be achieved by other means, and applicable legal and business requirements. At the end of the applicable period, we delete, destroy, or deidentify the data. For merchant data, we delete or return the data within 30 days after the merchant uninstalls the applicable app, unless retention is required by law or the applicable Data Processing Addendum provides otherwise.

International Transfers

Where personal data is transferred outside the country in which it was collected, we use a lawful transfer mechanism and appropriate safeguards. Depending on the circumstances, these may include an adequacy decision, the EU Standard Contractual Clauses under European Commission Decision 2021/914, the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, and safeguards recognized under the Swiss Federal Act on Data Protection.

Where applicable, we may rely on the EU-U.S. Data Privacy Framework for transfers to a recipient that is certified under that framework. We will provide information about relevant safeguards on request through privacy@crowdcontrol.co.

Changes to This Global Privacy Notice

We may update this notice from time to time and will provide notice of changes as required by law. The date this notice was last updated appears at the top of the page. We may notify you by updating the notice and posting it on the Services; please check periodically for changes.

Contact Information

To exercise your rights or ask questions about this notice or our privacy practices, contact us at privacy@crowdcontrol.co.

66 S Main St Unit 377

Salt Lake City, UT 84101

Support: squad@crowdcontrol.co. General inquiries: amigo@crowdcontrol.co.