Privacy Policy

What CRASPACE collects, why, how long it keeps it, and what it deliberately does not do.

Provisional. This page describes accurately what the service does with data today, and it is kept in step with the code. It has not yet had a legal review, so treat the wording - not the facts - as a draft. Questions: [email protected].

The short version

We store the company name you check, the products we find publicly, and the assessment we produce.
We store your email address only when you give it to us - to send you a report, an invite, or a report someone shared with you.
No cookie is set unless you ask for one. Our own visitor counting uses no cookie and no identifier at all. Google Analytics does use a cookie, so it loads only if you accept it - and if you never decide, nothing loads.
We never store your full IP address.
You can ask us to delete everything we hold about you, and we will.

Cookies and analytics

Two separate things count visitors here, and they are not equivalent.

Our own counting (always on, no consent needed)	No cookie, no identifier, nothing written to your browser that identifies you. The only thing stored in your browser is a flag meaning “this tab already reported its arrival”, which contains no id. Counting is derived from your network address with its last part already discarded, and the key changes every calendar day, so it cannot link your visits across days. This is what we rely on, and it is why the numbers we actually use are complete rather than consent-dependent.
Google Analytics 4 (off until you accept)	Sets a first-party cookie in your browser that identifies your device to Google Analytics, so we can see which pages lead somewhere and which do not. Nothing is loaded and no request is made to Google unless you accept it. There is no analytics script on the page before that, and declining is not re-asked. It is never used for advertising: advertising consent signals are permanently set to denied, and the company name you type into the check is never sent to Google.

Our own counting (always on, no consent needed)

No cookie, no identifier, nothing written to your browser that identifies you. The only thing stored in your browser is a flag meaning “this tab already reported its arrival”, which contains no id. Counting is derived from your network address with its last part already discarded, and the key changes every calendar day, so it cannot link your visits across days. This is what we rely on, and it is why the numbers we actually use are complete rather than consent-dependent.

Google Analytics 4 (off until you accept)

Sets a first-party cookie in your browser that identifies your device to Google Analytics, so we can see which pages lead somewhere and which do not. Nothing is loaded and no request is made to Google unless you accept it. There is no analytics script on the page before that, and declining is not re-asked. It is never used for advertising: advertising consent signals are permanently set to denied, and the company name you type into the check is never sent to Google.

You can change your mind at any time, here - turning it off also deletes the cookies it set. Withdrawal has to be as easy as consent (Art.7(3) GDPR), and a banner you can never get back does not meet that.

Analytics cookies

Where analytics is enabled it is Google Analytics 4, used only to count page visits and see which pages lead to a completed assessment. Never used for advertising, and never shared with advertising networks. Nothing loads and no cookie is set unless you say yes.

The assessment, the report and the consultation all work identically whichever you choose. Analytics is never a condition of using the service. Legal basis: your consent (Art.6(1)(a) GDPR and Art.5(3) of the ePrivacy Directive) for the analytics cookie, and legitimate interests (Art.6(1)(f)) for the cookieless counting described above.

What we collect, and why

Company and product information	Read from public sources (the company's own website, and public reference sources) to produce the assessment you asked for. Nothing is taken from a private system.
Your email address	To send your report, a verification code, a calendar invite, or a report a colleague shared with you. Needed to deliver what you asked for.
Your assessment answers	Supply-chain role, EU market exposure, turnover band, deadline focus - the inputs the assessment is calculated from.
Approximate location	Country, and where available region and city, from your network address - so we know which markets use the service. Derived from an address whose last part we have already discarded.
How you arrived	Whether you came directly, from a search engine, a link, or a campaign - and the campaign name if the link carried one.
Device type and browser	To find rendering problems and to tell automated crawlers apart from people.
Your consent record	Which permissions you gave, when, the exact wording you were shown, and its version. This exists so we can prove what you agreed to - including proving you did not agree to something.

What we deliberately don't do

No cookie you did not agree to. Our own counting sets none at all; the only thing it writes to your browser is a flag meaning "this tab already reported its arrival", which contains no id and identifies nobody. The single optional cookie is the analytics one described above, and it requires your explicit acceptance.
No full IP addresses. The last part of an IPv4 address is zeroed (and IPv6 truncated) before storage - and the shortened form is also what we send to the geolocation service, so your exact address never leaves our server.
No advertising pixels, no ad-network audiences, and no data sold or shared with brokers. Google Analytics advertising features and consent signals are permanently denied, not merely left unconfigured.
No profile that follows you across our own service. The key used for our cookieless counting is derived per calendar day, so it cannot link your visits across days.
The company name you check is never sent to Google. Analytics events record that a check ran and what class of result it produced - never whose products were assessed.

Legal bases

Producing and sending the assessment you requested is processed on the basis of performance of a contract (Art.6(1)(b) GDPR) - it is what you asked us to do, which is why that acknowledgement is required rather than optional. Marketing emails are sent only on your consent(Art.6(1)(a)), which is a separate, optional tick and never a condition of receiving your report. Understanding which markets use the service, and keeping it secure, rest on our legitimate interests (Art.6(1)(f)) - which is why that data is minimised as described above.

How long we keep it

Traffic records	90 days, then deleted automatically.
Analytics cookie (only if accepted)	Up to 2 years in your browser, and 14 months in Google Analytics. Turning analytics off on this page deletes it immediately.
Your cookie choice	Stored in your browser only - not on our servers - so that a decision either way is not asked again.
Shared report links	Expire 14 days after being created; the record is removed within 30 days of expiry.
Verification codes	Minutes. Single-use, and deleted after 24 hours.
Assessments and contact details	Kept while we have a business relationship, and deleted on request.
Consent records	Kept for as long as we rely on them, plus the period we may need to evidence them. Deleting a consent record would destroy the proof it exists to provide.

Sharing a report with someone else

If you share a report, we email that person a secure link that expires. Their address is used once, for that delivery - it is not added to any mailing list and they receive nothing else. The person sharing cannot give consent on their behalf, so we don't pretend otherwise: we record that you confirmed you had a reason to send it, and the email names you as the sender so the recipient can tell it apart from a cold approach.

Who else processes it

Hosting and database - our infrastructure providers, within the EU/EEA or under standard contractual clauses.
Email delivery - to send codes, reports and invites.
AI processing - an AI service reads the public pages we retrieve and extracts product names from that text. It is given retrieved public text, never your contact details.
Approximate location lookup - given only the shortened address described above.
Google Analytics - only if you accepted the analytics cookie. Google acts as our processor for this and is the one entity on this list that may transfer data outside the EU/EEA; that transfer relies on the EU–US Data Privacy Framework and standard contractual clauses. Declining keeps your visit entirely inside the cookieless counting described above, and no request to Google is made at all.

None of these are permitted to use the data for their own purposes.

Your rights

You can ask for a copy of what we hold, correction, deletion, or a copy in portable form; you can object to processing based on legitimate interests; and you can withdraw marketing consent at any time without affecting a report you already asked for. Email [email protected] and we will answer within one month. You may also complain to your national data protection authority.

Automated decisions

The assessment is produced automatically and is indicative: it is a scoping hypothesis, not legal advice, not a conformity assessment, and not a determination of compliance. It has no legal effect on you, and a human reviews anything that turns into advice. Verify any classification against your actual product specifications before relying on it.

Last updated 11 August 2026.