CRACI Privacy Notice

Last updated: October 9, 2026

This privacy notice describes how CRACI processes personal data of representatives of our customers, potential customers, website visitors and other stakeholders. We can be reached at [email protected].

Controller: CRACI Corporation Oy, 3573431-1, Kampinkuja 2, 00100 Helsinki, Finland.

Please note that this privacy notice covers the processing that CRACI carries out as a controller for our own purposes described below. CRACI also processes personal data on behalf of our customers, and such processing is not covered by this privacy notice.

We may update this privacy notice from time to time, for example if we change our processing activities or if applicable law changes. We will publish the updated version on our website and indicate the date of the latest update. We will notify you of any substantial changes.

Purposes and Legal Grounds for the Processing

1.1.

Provision of the Services

We process personal data of the users of our services in order to provide the services in accordance with the CRACI Terms of Service, to ensure the security, functionality and availability of the services and our website, and to provide customer support.

This processing is based on our legitimate interests to provide the services and related support, to meet our contractual obligations towards our customers, and to ensure the services work as intended.

1.2.

Customer Relationship Management, Sales, Marketing and Communication

We process personal data of users and representatives of our customers to manage customer relationships and to communicate about our services through service-related messages and newsletters. We also process personal data of representatives of potential customers for sales and marketing purposes, for example to organize demo sessions.

This processing is based on our legitimate interest to manage our customer relationships and communicate about our services, and as regards direct marketing communications and newsletters, consent.

1.3.

For Service Development and Analytics

We process analytics data gathered from the use of our services and our website to improve the quality of our services and to develop new features and functionalities for example by analysing trends in how our services are used. Where possible, we do this using aggregate data.

However, in some instances, individual users may be identifiable for example through a combination with other data, which is why we handle any such data as personal data, even if it does not directly identify anyone.

This processing is based on legitimate interest to improve our services and make sure they meet the expectations of our customers, and as regards the data gathered through the use of cookies or similar technologies, consent. You can find more information about the use of cookies below under the heading Cookies.

1.4.

For Protecting Our Legal Interests

We may process personal data in connection with any investigations, lawsuits, or similar circumstances if required to protect our interests for example in cases of misuse or fraud.

This processing is based on our legitimate interest to protect our services and business and to defend and enforce legal claims.

1.5.

For Our Legal Obligations

We process personal data to enable us to fulfil our legal obligations. This includes data processed for example for complying with our accounting and tax obligations.

This processing is based on compliance with our legal obligations.

Categories and Sources of Personal Data

The personal data we process can be categorized as follows:

User account data (such as user name and access rights)
Contact details (such as name and email address)
Customer relationship data (such as company affiliation and job title)
Subscription and payment data (such as credits and subscription periods)
Communication data (such as messages with us and newsletter subscriptions)
User data (such as data input or otherwise processed by the user in the services)
Customer support data (such as support ticket data)
Usage data (such as log data about the use of our services and our website)

The specifics of what kind of data we process depends on which group of data subjects you belong to (for example, whether you are a user of our services or a contact person of our customer), and how you use the services.

Personal data is primarily received from you during the registration process, through your use of the services, or through your interactions with us. We also receive personal data from third party services in case you connect such services (for example GitHub or GitLab) through integrations. We also receive data from public sources, such as social media platforms or through other third parties, including ad networks.

International Transfers

Our services are provided from and we process personal data primarily in the European Economic Area (EEA). Some of our service providers operate globally and also process personal data outside the EEA, primarily in the United States. Transfers of personal data to outside the EEA are based on the European Commission’s decisions on the adequate level of data protection in such countries (and as regards the United States, on the Data Privacy Framework), or on the use of transfer mechanisms recognized by the General Data Protection Regulation, such as Standard Contractual Clauses approved by the European Commission and additional safeguards implemented by our service providers.

Recipients of Personal Data

We use service providers to run and manage our services and our business, and these companies process personal data on our behalf when offering services related to for example our IT infrastructure, hosting, payment handling, customer support tools and similar. These service providers have committed themselves to processing personal data in accordance with applicable law and our instructions. Some of these service providers may also process personal data for their own purposes.

Data may also be shared with third party service providers if the user chooses to share data they process in the services with others. In addition, personal data may also be shared with the relevant authorities in case we have a legal obligation to do so or in connection with any investigations related to fraud, misuse, or similar, and in connection with corporate arrangements or transactions.

Storage Periods

We process personal data of the users of our services generally for as long as they have an account for the services. Some data may also be stored after the user no longer has an account (such as data required to fulfil our legal obligations). By default, user data is deleted after one year of inactivity.

Data of potential customers is stored for three years after the last contact. Website and service usage data is stored for a maximum of 24 months.

Any personal data included in accounting data is stored for 10 years after the current fiscal year.

We use cookies and similar technologies (such as local storage and pixels, collectively referred to here as cookies) on our website and, where applicable, within our service. We use cookies to ensure the functionality and security of our service and the website, and based on your consent, for analytics and marketing purposes.

You can control the use of cookies through our cookie preferences and through your browser settings. Please note, however, that blocking cookies completely will limit the ability to use our service.

You can find more information about the cookies we use and their storage times within the website and the platform.

TODO: Add link to the platform page that shows the cookies

Rights Related to the Processing of Personal Data

You have the right to access your data and the right to have any inaccurate or false data corrected. You have the right to ask that your data is deleted, that the processing of your data is restricted, and the right to object to the processing (including the processing for direct marketing purposes). For any processing that is based on your consent, you have the right to withdraw your consent at any time and the right to request to receive your data and to be transmitted to another controller. Please note that a withdrawal of consent does not affect the legality of processing prior to the consent being withdrawn.

When you submit a request, we may ask you to verify your identity so that we can protect your personal data. We will respond without undue delay and, in any event, within one month (subject to the extensions permitted by the GDPR).

You can modify your messaging preferences through your profile settings. As regards the exercise of your other rights, you can contact us at [email protected]. Please note that some of the rights are subject to additional requirements and may not be applicable in each case.

In case you find our processing of personal data to be inconsistent with the applicable data protection laws, you may lodge a complaint with Data Protection Ombudsman’s Office, whose website can be found at www.tietosuoja.fi/en.

Providing personal data is required in order to use our services. Personal data is not used for profiling or for making automated decisions with significant effects as referred to in Article 22 of the GDPR.