What we know about you, and why.
Short because we collect little. Every processor that touches your data is named, including the AI providers that carry out change requests.
1The short version
We collect what running the service needs and nothing for fun. We do not sell personal data, we do not run advertising trackers, and we do not build profiles to resell. If you want your data out or gone, write to us and we do it.
Controller: Admin, trading as Cruscy Studio · full registered address is stated on every invoice and provided on request · [email protected].
2What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email, name, password hash, sign-in times, IP address, which version of our documents you accepted and when | You, when you register and sign in |
| Sign-in via Google | Your Google account identifier, email, name | Google, if you choose that button |
| Requests and briefs | What you wrote in the contact form or to the agent, your chosen package and budget | You |
| Project data | Content, images and links you give us to put on the site; for partners: client name, contact, agreed price, prepayment, stages | You, or your partner |
| Payments | Invoice id and amount, blockchain transaction reference, or the Paddle transaction reference | Our payment gateway, or Paddle |
| Technical | Server logs, error traces, uptime and performance data | Automatically, when you use the site |
| Enforcement | Warnings, suspensions and their reasons | Us, if it happens |
We never ask for and never receive card numbers: crypto payments have none, and card payments go to Paddle, not to us.
3Why, and on what basis
- To provide what you bought — build, host, support, count quota, send notifications. Basis: performance of a contract.
- To take payment and keep books. Basis: contract and legal obligation.
- To keep the service safe — rate limits, fraud and abuse checks, investigating incidents, enforcing the Rules. Basis: legitimate interests, and legal obligation where reporting is required.
- To prove consent — storing which document version you accepted, when and from which IP. Basis: legitimate interests and legal obligation.
- To answer you when you write to us. Basis: contract or legitimate interests.
We do not do behavioural advertising, and we do not make decisions with legal effect about you by automated means alone: a person reviews suspensions and closures.
4Who else touches it
| Who | What they get | Why |
|---|---|---|
| Cloudflare | Traffic metadata, IP addresses | Serving the site, protecting it from attacks |
| Our payment gateway (self-hosted) | Invoice, amount, transaction reference | Taking USDT payments |
| Paddle.com Market Limited | Email and billing details you enter at checkout | Merchant of record for card payments, tax compliance |
| Telegram | A notification that a request, payment or approval happened, including the email involved | So a human sees it within minutes |
| AI model providers | The text of change requests and the site content needed to carry them out | Doing the work — see §5 |
| Hosting and infrastructure | Everything stored on the servers | Running the service |
Everyone above acts on our instructions or as an independent controller for their own part (Paddle for payments, Google for sign-in). We do not sell data and we do not share it with data brokers.
5AI processing
Change requests are carried out by AI agents supervised by our engineers. That means the text of your request, and the parts of your site needed to fulfil it, are sent to model providers. We use business-tier access with providers whose terms exclude training on customer data. Do not paste secrets, passwords or third-party personal data into a request — if a task needs credentials, ask us for the secure way to hand them over.
6Cookies
One cookie: c_sess, which keeps you signed in. It is HttpOnly, Secure and
SameSite=Lax, and it lasts 30 days, or 180 if you tick "remember me". No advertising
cookies, no third-party trackers, no consent banner theatre. Your browser may also keep a
partner referral code in local storage for 90 days if you arrived through a partner
link.
7How long we keep it
- Account and project data: while the account exists, then 90 days after closure so you can come back or export.
- Change requests and agent conversations: 24 months.
- Payment records: as long as tax law requires.
- Server logs: 30 days, longer if part of an active investigation.
- Enforcement records and consent records: 3 years, because they may be needed to defend a decision.
8Your rights
Depending on where you live you can ask us to: give you a copy of your data, correct it, delete it, restrict or object to processing, or hand it to another provider. Write to [email protected] — we answer within 30 days and we do not charge for it.
Some data we must keep even if you ask us to delete it: invoices and tax records, and enforcement records where the account was closed for a breach. We will tell you exactly what stayed and why. If you are unhappy with the answer, you can complain to your local data protection authority.
9Where the data lives
Our servers and the payment gateway are operated by us. Some processors listed in §4 operate internationally, which can mean your data is processed outside your country. Where that happens we rely on the safeguards those providers offer, such as standard contractual clauses.
10Children
The service is for adults running a business. We do not knowingly collect data from children under 16. If a site we host is aimed at children, that is a §3 case in the Rules and must be agreed with us first.
11Contact
Admin, trading as Cruscy Studio · full registered address is stated on every invoice and provided on request · [email protected]. Privacy questions go to the same address and reach a person, not a queue.