Skip to content
    CROPILOT
    Start free

    CroPilot · Privacy & agreements

    Know who helps deliver the service.

    The role of each provider matters as much as its name. Here is what must be clear before processing begins.

    Privacy & security overview
    Provider inventory · awaiting operational confirmationContracting entities, processing locations and transfer arrangements must be completed in the published DPA schedule.

    How to read this inventory

    This is the implementation inventory for review, not a claim that every integration is active for every customer. A provider name does not establish the contracting entity, processing region or transfer safeguard. The final DPA schedule must specify those details before new customer processing is enabled.

    Infrastructure and generation

    Render: application hosting, background processing and database infrastructure. Confirm the selected region, support-access locations, contracted entity and applicable data processing terms.

    Google Gemini: bounded model requests where generation is enabled. Submitted page evidence and business context must stay within the authorised scope. Confirm the API account’s service terms, processing locations, retention and transfer arrangements. An AI recommendation does not authorise the provider to receive unrelated visitor records.

    Optional support, diagnostics and analytics

    The codebase includes Intercom for support, Sentry for error diagnostics, and PostHog and Google Analytics for analytics. Activation, consent, configuration and personal-data exposure must be reviewed for each service. Do not infer activation or an EU region from the presence of an SDK.

    Support and diagnostics can involve account/contact information and technical context. Analytics must respect the applicable consent boundary. The final register must name only the relevant contracted processing entities and their actual data categories.

    Payments and connected platforms

    Lemon Squeezy handles applicable web subscriptions as merchant of record. Shopify has its own platform, merchant and billing responsibilities where a Shopify connection is used. These roles need to be distinguished from subprocessors acting solely on the customer’s instructions; do not list every integration as a subprocessor indiscriminately.

    Notifications and questions

    The proposed DPA provides advance notice and an objection process for new or replacement subprocessors. Its review draft does not itself approve an incomplete list. Ask privacy@cropilot.ai for the completed provider schedule and relevant transfer information before acceptance.