Crustat is web analytics made by Web Freestyle SRL, a company registered in the Republic of Moldova (IDNO 1021600031185, VAT 0509192, str. Alba-Iulia 21, of. 1, MD-2051, Chișinău, Republic of Moldova). This page explains what we collect, why, who else sees it, how long we keep it, and what you can do about it.

It covers two groups of people: visitors of websites that use Crustat, and customers: the people and companies who have a Crustat account.

1. Who is responsible

Data about visitors of our customers' websites: the website owner decides to use Crustat and why, so they are the controller. We process that data only on their instructions, to provide the service, as their processor. The terms of that are in our Data Processing Agreement.
Data about our customers, and about visitors of crustat.com: Web Freestyle SRL is the controller.

We follow the personal data protection law of the Republic of Moldova and, where it applies, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. Visitors of websites that use Crustat

What is collected

When a page with Crustat loads, the browser sends us the page address, the page the visitor came from (on the first view only), and the width of the window. Our server adds the visitor's country (from the network), the browser, the operating system and the device type, read from the request.

Nothing is stored on the visitor's device

Crustat sets no cookies and writes nothing to local storage or anything like it. It stores nothing on the visitor's device. The only thing it checks for is an opt-out flag that a website owner can set on their own browser, at their own request, to leave their own visits out; visitors never have it.

How visitors are counted

To count each visitor once a day, our server builds a one-way code (a hash) from four things: a random value for that day (the "salt"), the website, the IP address and the browser details. Only the code is kept, never what went into it, and it can't be turned back into an IP address.

A new random salt is made for every day (UTC) and kept only on our servers.
Each salt is deleted after two days. From then on, nobody, including us, can work out which IP address or browser produced that day's codes.
Because the salt changes every day, the same person gets a new code each day. A visitor can't be followed from one day to the next, or from one website to another, and there are no "returning visitors".
The IP address and the full browser details are used only in memory, to build the code and find the country. They are never stored.

What is never collected or kept

IP addresses are used for a moment, to find the country and to build the daily code. They are never stored.
No cookies, local storage or other data on visitors' devices.
No names, email addresses, form contents or account details of visitors.
No tracking across different websites, and no combining of data between different customers.
Known bots are dropped before anything is stored.

We never sell this data, never use it for advertising, and never use it for our own purposes.

Legal basis and consent

Because Crustat stores nothing on visitors' devices and reads nothing from them to identify or count them, it doesn't need visitors' consent under the EU and UK rules on cookies and similar technologies (Article 5(3) of the ePrivacy Directive and the laws based on it), so no cookie banner is needed for it. The IP address is still processed for a moment to build the daily code, so the GDPR applies to that. The website owner, as controller, can rely on a legitimate interest in understanding how their website is used, in a way that keeps visitors anonymous and can't follow them over time. We process this data for them as their processor, under our Data Processing Agreement.

A website owner can leave their own browser out with the "Ignore my visits on this browser" switch in the dashboard, or by opening their site once with #crustat-ignore at the end of the address. That saves a flag in that one browser, which they asked for. Anyone can also block the Crustat script with a content blocker. If you visited a website that uses Crustat and have a question about your data, ask that website's owner, who is responsible for it; we help them answer.

3. Customers

What	Why	Legal basis
Name, email address, password (stored only as a secure hash) or your Google sign-in	To create and run your account and let you sign in	Contract
Your websites, settings and team members	To provide Crustat	Contract
Plan, payments and invoices (card details are handled only by our payment provider; we see the card type and last four digits)	To bill you and keep financial records	Contract; legal obligation
Messages you send us	To answer you	Contract; legitimate interest in helping you
Sign-in and security logs (time, IP address, browser)	To keep accounts safe and stop abuse	Legitimate interest in security
Service emails: trial and billing reminders, reports you ask for, important notices	To run your account	Contract
Product news, only if you opt in	To tell you what's new	Consent, which you can withdraw at any time

You need to give us your email address to have an account; everything else is optional or comes from using Crustat. We keep a session cookie on app.crustat.com so you stay signed in. It is only on the dashboard, never on the websites you track, and it is strictly necessary for signing in.

4. Visitors of crustat.com

crustat.com counts its own visits with Crustat, as described above; nothing is stored in your browser for it. The site also remembers your light or dark choice in your own browser; that choice is never sent to us. We have a legitimate interest in knowing how our own website is used.

Waiting list. If you leave your email to hear when Crustat opens, we keep the address, the date, the page you were on, your language and your country (from the network). We use it only to email you once, when sign-ups open, based on your consent. We don't add you to any newsletter. We delete the list 30 days after that email is sent, or earlier if you ask: write to us or reply to the email.

5. Who else sees the data

We use a small number of service providers, each only for its job and under a contract that protects the data:

Cloudflare, Inc.: hosting, network, and storage of visit data and account data.
Google LLC: sign-in with a Google account, only if you choose it.
Our payment provider: card payments, invoices and tax.
Our email provider: sending account and report emails.

The current list, with what each provider does, is part of our Data Processing Agreement. We may also share data when the law requires it, for example with a court or tax authority, and only as much as required.

6. Transfers outside your country

Some providers process data outside Moldova, the EU or the UK. Where a country isn't recognised as giving adequate protection, we rely on the provider's standard contractual clauses approved by the European Commission (and the UK addendum), or on the provider's certification under the EU-US Data Privacy Framework.

7. How long we keep data

Visit data: while your account is active, so you can look back over your history. When you delete a site, or your account is closed or deactivated, its visit data is deleted from our systems within 90 days.
Account data: while your account is active, then deleted within 90 days of closing, except what we must keep.
Invoices and payment records: as long as tax and accounting laws require, usually 5 to 10 years.
Waiting list emails: until 30 days after the "we're open" email, or until you ask us to remove you.
Security logs: up to 12 months.
Messages to support: up to 3 years after the conversation ends.

8. Security

Data is encrypted in transit and at rest. Access inside our company is limited to the people who need it for their job. Passwords are stored only as secure hashes. If a breach puts personal data at risk, we act straight away to contain it, tell affected customers without undue delay, and notify the authorities where the law requires.

9. Your rights

You have the right to:

know what personal data we hold about you and get a copy;
have it corrected, completed or deleted;
get your data in a common format to take elsewhere;
limit or object to how we use it, including processing based on legitimate interest;
withdraw consent at any time, without affecting what happened before;
complain to a data protection authority.

Write to hello@crustat.com. We answer within one month, and may ask you to confirm who you are first. You can complain to the authority where you live or work, or in Moldova to the National Center for Personal Data Protection (datepersonale.md). We'd be glad to try to help you first.

We don't make decisions about people based only on automated processing, and we don't profile visitors.

California

We don't sell or share personal information, as the California Consumer Privacy Act (CCPA) defines those words, and we don't use it for targeted advertising. That's true for the visitors of websites that use Crustat and for our customers. California residents can use the rights above, and we won't treat anyone differently for using them.

10. Children

Crustat is a service for website owners and isn't meant for children. Accounts are for people aged 18 or over.

11. Changes

If we change this page in a way that matters, we email customers before the change takes effect. The date at the top always shows the latest version.

12. Contact

Web Freestyle SRL, str. Alba-Iulia 21, of. 1, MD-2051, Chișinău, Republic of Moldova. hello@crustat.com