1. Who is responsible?
CROPILOT AS, organisation number 937 028 245, Elisenbergveien 17, 0265 Oslo, Norway operates CroPilot. For privacy questions or a rights request, contact privacy@cropilot.ai.
We act as controller for our own website, account administration, service security and customer relationship. When a customer uses CroPilot to process information about visitors to their website, that customer determines the purposes and we act on their documented instructions under a data processing agreement. Please direct questions about a customer’s website to that website owner.
2. What information is involved?
Account and administration: name, email, password hash, workspace membership, authentication and verification records, plan and billing references, and messages you send to support. Payment providers handle card details; do not send card details, passwords or secret keys to support.
Website work: URLs, permitted page text and images, screenshots, your objectives, reviewed business facts, brand choices, proposals, revisions and decisions. Publicly accessible content can still contain personal data. Do not submit sensitive information or private customer records for a page assessment.
Connected measurement: when enabled and permitted, pseudonymous visitor/session identifiers, page and interaction events, browser/device details, timestamps, experiment assignments and configured outcomes. Commerce integrations may supply limited order references, values and currency. Removing a name does not necessarily make this data anonymous.
Technical operations: request and error metadata, security logs and provider-usage records. The data available depends on the feature, consent and configuration. An account, ownership verification or saved draft does not automatically install tracking or publish a test.
3. Purposes and legal bases
We use necessary account and service data to provide the service and administer the customer relationship. Where the account holder is the contracting individual, this is necessary to perform the contract. Business contact administration, service security, abuse prevention and resolving support requests may rely on our legitimate interests, balanced against individuals’ rights.
Legal obligations apply to records we are required to retain, such as relevant accounting records. Optional analytics, marketing communications and optional account-to-visit measurement use consent where required. You may withdraw consent without affecting the lawfulness of processing before withdrawal.
For connected customer websites, the customer establishes the lawful basis and required notices and consents. Our processing follows its instructions. This notice does not give permission to collect data from a customer’s visitors.
4. AI and website recommendations
Enabled generation can send bounded page evidence and approved business context to the configured model provider. Page content is untrusted input. Do not include special-category data, credentials or confidential customer material in a public-page request.
A generated recommendation is a proposal, not a verified business fact or proof of effectiveness. Customer review, technical validation and permission to serve a change are separate. This notice does not authorise reuse of customer personal data for unrelated model training. Provider terms and international-transfer arrangements must be checked for the service actually enabled.
6. Retention and deletion
We retain account and workspace information for the service relationship and the specific operational, security or legal purpose that requires it. Deletion requests may require proportionate identity verification. A request does not authorise deletion of another workspace’s data.
Raw measurement retention, support/security-log periods, active-system deletion and backup expiry depend on the configured service. These operational periods must be confirmed in the published notice and processing schedule; the review draft does not promise a retention setting that the product cannot enforce.
7. Your choices and rights
Subject to the applicable conditions, you can request access, correction, deletion, restriction, portability, and objection to processing, including objection to direct marketing. You can withdraw optional consent through the relevant preference controls or contact us. Essential account security is separate from optional analytics.
Send requests to privacy@cropilot.ai. We normally respond within one month; where the GDPR permits an extension, we will explain it within that initial period. We may need enough information to verify your authority, but do not send a password or unnecessary identity documents.
You may complain to Datatilsynet in Norway (datatilsynet.no) or your competent EEA supervisory authority. If your request concerns a customer’s connected website, contact that customer; we will assist it under the applicable processing agreement.
8. Scope and changes
CroPilot is a business service and is not intended for children. Do not intentionally submit children’s personal data. We will update this notice when processing changes and communicate material changes through an appropriate service channel.
Review version: 24 September 2026. Legal identity/contact operation, vendor contracts and transfer details, and the operational retention schedule require owner confirmation before this revision is publicly released.