Privacy Policy

1. Who we are

Croopt.com is run by Kieron Bertani, a sole trader based in the United Kingdom, who is the data controller for the personal data described here. For any privacy question or request, email privacy@croopt.com.

2. What we collect

• Account details: your email address, name, and a securely hashed password. If you sign in with Google, we receive your name and email address from your Google account.
• Audit data: the URLs you submit, the device type you choose, screenshots of those pages, and the audit results and scores we generate.
• Purchase data: your token balance, purchase and subscription history, and Stripe payment session references. We never see or store your full card details; Stripe handles them.
• Support requests: the email address, subject and message you send us through the help page.
• Usage data: pages visited, device and browser information, approximate location, and how you arrived at the site, collected through analytics and advertising tools (see section 5).

3. How we use it, and our lawful basis

• To create and run your account, run the audits you request, and keep your audit history: performance of a contract.
• To take payments, keep records, and meet tax and accounting obligations: contract and legal obligation.
• To send account emails such as email verification and receipts: contract.
• To answer support requests: legitimate interests in helping our users.
• To understand how the site is used, measure marketing, and improve the service: consent where cookies or similar technologies are involved, otherwise legitimate interests.
• To prevent fraud and abuse and keep the service secure: legitimate interests.

We do not sell your personal data, and we do not use your audit content to train AI models.

4. Who we share it with

We use the following service providers to run Croopt.com. They process data on our behalf and only for the purposes above:

• Vercel: website hosting and privacy-friendly page analytics.
• MongoDB: database hosting for accounts, audits and support tickets.
• Stripe: payment processing. Stripe is also an independent controller for the payment data it collects; see Stripe's privacy policy.
• OpenAI: AI analysis of the page screenshots and content you submit for audit.
• Amazon Web Services and ApiFlash: capturing screenshots of the URLs you submit.
• Mailgun (EU region): sending account emails.
• Google: Google sign-in and Google Analytics, including purchase events sent from our server to measure sales.
• Meta: the Meta Pixel and Meta Conversions API, used to measure our advertising. When you make a purchase, we send Meta the purchase value and a hashed (irreversibly scrambled) version of your email address so Meta can match the sale to an ad you may have seen.

We may also disclose data if the law requires it, or to protect our rights or the safety of others.

5. Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

• Essential: keeping you signed in and completing checkout. The site cannot work without these.
• Analytics: Google Analytics (cookies such as _ga) and Vercel Web Analytics, which does not use cookies.
• Advertising measurement: the Meta Pixel (cookies such as _fbp).

You can block or delete cookies in your browser settings. You can also opt out of Google Analytics with Google's opt-out add-on and manage Meta ad preferences in your Meta account settings.

6. Google user data

If you sign in with Google, we only request your name and email address, and we use them only to create and identify your Croopt account. Croopt's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or share it with anyone except as needed to provide the service.

7. International transfers

Some of our providers are based in, or process data in, the United States and other countries outside the UK. Where that happens, we rely on safeguards recognised under UK data protection law, such as the UK's adequacy regulations (including the UK–US data bridge) or standard contractual clauses with the UK addendum.

8. How long we keep it

• Account and audit data: while your account is open. When you ask us to delete your account, we delete it within 30 days.
• Purchase and transaction records: six years, to meet UK tax and accounting rules.
• Support requests: up to two years after the request is closed.
• Analytics data: according to the retention settings of the analytics tool, which for Google Analytics is up to 14 months.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use it
• receive your data in a portable format
• withdraw consent at any time, where we rely on consent

To make a request, email privacy@croopt.com. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Security

We use encrypted connections (HTTPS), hash passwords, and limit access to personal data to what is needed to run the service. No system is perfectly secure, but we take reasonable steps to protect your data.

11. Children

Croopt.com is a business tool and is not aimed at children. Users under 18 may only use it under the supervision of a parent or guardian, as set out in our Terms and Conditions.

12. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed. If a change is significant, we will let account holders know by email.