Privacy Policy
How we collect, use and protect your personal data
Last updated: April 10, 2026
1. Data Controller
The data controller responsible for processing your personal data is:
Miralem Cebic CRA Compliance Management Studio
Auf der Weingartsweide 19
63543 Neuberg, Germany
Email: info@cra-studio.eu
Phone: +49 (0) 151 68471169
2. Data We Collect
We collect the following categories of personal data:
- Account data:Name, business email address, company name, job title โ provided during registration.
- Authentication data:Hashed passwords and session tokens managed by Supabase Auth.
- Workspace content:Product descriptions, compliance notes, policy documents, and uploaded evidence files you create within the platform.
- Usage data:Page views, feature interactions, and error logs collected automatically for product improvement.
- Device & connection data:IP address, browser type, operating system โ collected by our hosting infrastructure.
- Communication data:Email messages you send to our support team.
3. Purposes & Legal Basis
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Providing the platform and core compliance features | Art. 6(1)(b) โ Contract performance |
| Sending transactional emails (password reset, account alerts) | Art. 6(1)(b) โ Contract performance |
| Billing and subscription management | Art. 6(1)(b) โ Contract; Art. 6(1)(c) โ Legal obligation |
| Fraud prevention and platform security | Art. 6(1)(f) โ Legitimate interest |
| Product analytics and feature improvement | Art. 6(1)(f) โ Legitimate interest |
| Marketing communications (opt-in only) | Art. 6(1)(a) โ Consent |
| Compliance with legal obligations (tax, audit) | Art. 6(1)(c) โ Legal obligation |
4. Data Processors & Recipients
We engage the following sub-processors. Each sub-processor is bound by a Data Processing Agreement (DPA) meeting GDPR requirements:
- Supabase Inc. โ Database, authentication, file storageEU (Frankfurt, AWS eu-central-1)
- Netlify Inc. โ Hosting and CDNEU data routing available
- Paddle.com โ Payment processing & Merchant of Record (MoR) โ Paddle acts as the seller of record for all subscriptionsUK / EU
- Resend Inc. / AWS SES โ Transactional email deliveryEU region
- Umami Cloud โ Privacy-friendly website analytics โ cookie-free, no personal data collected, IP-anonymisedEU servers
- Google Ireland Ltd. โ Google Fonts web fonts โ loaded only after you opt in via the cookie banner; the request transmits your IP address to GoogleConsent-gated ยท US/EU
We do not sell your personal data to third parties. We do not share data with advertisers.
5. International Transfers
We store and process data primarily within the EU/EEA. Where processors are based outside the EU (e.g., US-headquartered companies with EU infrastructure), transfers are safeguarded by:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- EUโUS Data Privacy Framework adequacy decision (where applicable)
- Supplementary technical measures (encryption at rest and in transit)
6. Retention Periods
We retain personal data for the following periods:
- Active account dataDuration of the subscription + 30 days after account closure
- Audit logs7 years (legal obligation for commercial records)
- Backup dataRolling 30-day retention on encrypted backups
- Usage analytics24 months, then aggregated (no PII retained)
- Support correspondence3 years from last interaction
7. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Art. 15Right of accessโ Obtain a copy of all personal data we hold about you.
- Art. 16Right to rectificationโ Correct inaccurate or incomplete data.
- Art. 17Right to erasureโ Request deletion of your data where no legal ground for retention exists.
- Art. 18Right to restrictionโ Restrict processing while a dispute is resolved.
- Art. 20Right to portabilityโ Receive your data in a machine-readable format (JSON/CSV).
- Art. 21Right to objectโ Object to processing based on legitimate interest or for direct marketing.
- Art. 7(3)Right to withdraw consentโ Withdraw consent at any time without affecting prior processing.
To exercise any right, email info@cra-studio.eu. We will respond within 30 days (extendable by 2 months for complex requests).
9. Security Measures
We implement appropriate technical and organisational measures (TOMs) including:
- TLS 1.2+ encryption for all data in transit
- AES-256 encryption for data at rest (Supabase)
- Row-Level Security (RLS) policies ensuring strict tenant data isolation
- Multi-factor authentication (MFA) available for all user accounts
- Immutable audit log for all data modification events
- Regular vulnerability scans and penetration testing
- Strict least-privilege access controls for staff
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of the service after the effective date constitutes acceptance of the revised policy.
11. Contact & Complaints
For any privacy-related enquiry or to exercise your rights, please contact us:
If you believe we have not adequately addressed your concern, you have the right to lodge a complaint with your national supervisory authority. In Germany: Bundesbeauftragte fรผr den Datenschutz und die Informationsfreiheit (BfDI).