Privacy notice
Last updated: 2026-10-30
This notice describes what personal data we process, why, and who we share it with, under Regulation (EU) 2016/679 (GDPR). It is written about how the service actually works, not from a generic template.
1. Data controller
CRYCATCH S.R.L., Via Strona 20, 00166 Roma (RM), Italia, VAT IT18260331006. To exercise your rights or ask anything: legiscan@crycatch.com — certified email crycatch@pec.it.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Creating the account, signing in by emailed link, sending the report and service messages | Performance of the contract (art. 6.1.b) |
| Domain, brand name, market, competitors given | Running the analysis you requested | Performance of the contract (art. 6.1.b) |
| IP address, network prefix, technical browser fingerprint (as a hash), visitor identifier | Preventing repeated use of the free audit, which is limited to one per person, and protecting the service from automated abuse | Legitimate interest (art. 6.1.f) |
| Billing data: registered name, address, VAT number, amounts, transaction identifiers | Issuing the invoice and meeting tax and accounting obligations | Legal obligation (art. 6.1.c) |
We do not process your payment card details. Payment happens entirely on Stripe's pages: we receive only the outcome, the amount and a transaction identifier.
About the browser fingerprint
To enforce the limit of one free audit per person we compare a few technical signals from the request. The browser fingerprint is computed from the headers every browser sends anyway, and is stored only as a hash: it does not allow your device configuration to be reconstructed, it only recognises a repeat request. We use no active fingerprinting techniques (canvas, fonts, sensors) and we do not profile users for advertising. You can object to this processing by writing to us: if you do, the free audit may not be available to you, while the paid services remain fully usable.
3. What we send to the AI assistants
The analysis requires putting questions to third-party services (OpenAI, Anthropic, Perplexity). The questions contain the market sector and the brand names under analysis, phrased as any user would put them. We do not send those providers your email, your billing data or any other personal data.
4. Recipients
We use the following providers, appointed as processors where the conditions for it apply:
- Stripe Payments Europe Ltd. (Ireland) — payments, invoicing, subscription management
- Resend (United States) — sending transactional email
- OpenAI, Anthropic, Perplexity (United States) — running the queries described in section 3
- Hosting and storage providers — running the application and storing the reports generated
Some of these providers are based in the United States. Transfers are made on the basis of the applicable adequacy decisions or of the Standard Contractual Clauses adopted by the European Commission. We do not transfer or sell personal data to third parties for their own purposes.
5. Cookies
We use first-party technical cookies only, not accessible to scripts and not used for profiling. We use no analytics and no advertising cookies, which is why you see no consent banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
ars_session | Keeps you signed in to your account | 30 days |
ars_vid | Recognises the visitor for the free audit limit | Up to 400 days |
6. How long we keep data
- Account and analyses — for the life of the relationship and until you ask for deletion.
- Tax documents — ten years, as Italian law requires. This period prevails over a deletion request.
- Anti-abuse signals — kept as long as the project they refer to is kept; the comparison based on network and browser signals only ever looks at the last thirty days in any case.
- Fingerprint of a free audit already delivered — twelve months. When you delete the account we keep a keyed hash (HMAC-SHA256) of the sole fact that the free audit had already been delivered, so that deletion does not become the way to obtain another one. It is not reversible and contains no email address, cookie or IP address: it recognises a repeat and nothing else. Legal basis: legitimate interest in preventing abuse (art. 6(1)(f)). It is not created for a failed free audit, which produced no report.
- Sign-in sessions — thirty days, then they expire automatically.
7. Your rights
Deletion without asking permission. If you have an account you can delete it yourself, immediately, from Dashboard → Account: we erase the email address, projects, audits, reports, PDFs and share links, and cancel any active subscription. Only the tax documents and the anti-abuse fingerprint described in section 6 remain: the former stripped of the link to your identity, the latter irreversible and limited to twelve months. You can object to processing based on legitimate interest by writing to us.
You can also ask us at any time for access to your data, rectification, restriction or portability, and you can object to processing based on legitimate interest. Write to legiscan@crycatch.com: we answer within thirty days. If you believe the processing breaches the law you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
8. Automated decision-making
The score the service produces is calculated automatically, but it concerns a website and not a person: it produces no legal effects on natural persons and does not similarly affect their situation. We do not profile users.