Updated September 21, 2026
Privacy
This notice explains how CRU Technologies handles website inquiries, authorized security monitoring records, and information needed to license, install, support, and renew CRU Backups.
Information we collect
Website request forms may collect your name, email address, organization, approximate device or public destination count, destination preference, scheduling or follow-up preference, and the notes you choose to provide. For a sale or deployment, CRU may also record billing contacts, invoice references, machine identity, license ending, support dates, purchased storage capacity, installation results, and support history.
Security monitoring and authorization
A CRU SecScan website inquiry does not start a scan or authorize access to a network. Before enabling monitoring, CRU confirms the authorized domains and IP addresses, exclusions, contacts and service arrangements. Service records can include approved scope, DNS and service observations, TLS certificate information, bounded web-response evidence, scan timing and coverage, risk assessments, ownership, review decisions and reports. CRU uses these records to identify changes, prioritize review, explain findings and verify approved remediation. Access to the operations workspace is restricted to authorized staff. Do not submit credentials or detailed network inventories through the public inquiry form.
Product and backup information
CRU Backups sends the licensing and update service the product version, platform, architecture, machine identity, license status, and update health needed to provision a seat and deliver eligible releases. When CRU-hosted notifications are enabled, operational backup status and report information is sent to CRU's notification service for delivery. Feedback is sent only when a user submits it.
Where backup content goes
Backups configured for a customer-owned USB disk, local disk, or NAS are written to that destination and are not uploaded to CRU. Optional CRU Cloud sends encrypted repository data to the provisioned CRU storage account. Repository content and metadata are encrypted by restic before storage. Keep the recovery kit outside the protected computer and do not send its secret through a website form or ordinary email.
How information is used
CRU uses this information to answer requests, prepare quotes, agree on authorized monitoring scope, review security observations, provision licenses and purchased capacity, perform installations, authenticate devices, send notifications and reports under the agreed service arrangements, deliver signed updates, provide support, investigate failures, prevent abuse, and contact the billing recipient about update-support renewal.
Sharing and retention
CRU does not sell personal information. Information may be processed by infrastructure and communication providers used to operate the requested service, or disclosed when required by law or needed to protect customers and systems. Records are retained for service, security, accounting, and legal needs, then removed or de-identified when no longer required.
Your choices
You may choose customer-owned storage instead of CRU Cloud, disable CRU-hosted notifications, use supported authenticated SMTP, or opt out of automatic software updates. Disabling updates does not disable installed backup or restore. Contact CRU to correct a billing address, change renewal-notice preferences, or request access to or deletion of information where applicable.
Security
CRU uses access controls, encrypted transport, machine-bound service credentials, signed update manifests, component hashes, and encrypted backup repositories. No system can guarantee absolute security. Never submit passwords, full license keys, device tokens, NAS credentials, or recovery-kit contents through the public website.
Contact
Questions or requests can be sent to [email protected] or 320-309-8645. CRU Technologies is located at 24 W Birch St, St. Joseph, MN 56374.