Start Free

LEGAL

Privacy Policy

GDPR compliant. How MINBO QRE SRL handles personal data for CrawlBrain.

Effective Date: 22 July 2026

This Privacy Policy explains how MINBO QRE SRL (Company No. 35085735), a company registered in Romania, operating the CrawlBrain product (“CrawlBrain”, “we”, “our”, or “us”), collects, uses, stores, and protects personal data in connection with the CrawlBrain website, application, search widget, WhatsApp channel, content export, and API (together, the “Service”).

We are committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and all applicable data protection laws. Please read this policy carefully before using the Service.

Contents

  1. Controller and Processor
  2. Roles
  3. Legal Basis for Processing
  4. Personal Data We Collect
  5. Data We Process on Behalf of
  6. Customers
  7. How We Collect Personal Data
  8. How We Use Personal Data
  9. AI Processing and Sub-Processors
  10. Disclosure of Personal Data
  11. International Data Transfers
  12. Data Security
  13. Data Retention
  14. Your Rights Under GDPR
  15. Cookies and Analytics
  16. Children’s Privacy
  17. Changes to This Policy
  18. Contact Information

1. Controller and Processor Roles

CrawlBrain plays two different roles depending on the data involved.

Where we act as data controller. For your account registration, billing, support, and general use of our website and application, MINBO QRE SRL determines the purposes and means of processing and acts as the data controller.

Where we act as data processor. When you connect a website to CrawlBrain, we process the content of that website and the questions submitted by your site visitors in order to return search results and answers. For this data:

  • You, the customer who connects the website, act as the data controller and are responsible for the lawful basis, notices, and consents relating to your visitors’ data.
  • CrawlBrain acts as a data processor, processing that data only on your documented instructions and only to provide the Service.

A Data Processing Agreement that reflects Article 28 GDPR is available to customers on request. If you are a visitor to a website that uses CrawlBrain, please contact that website’s owner regarding their privacy practices, as they control how the Service is used on their site.

2. Legal Basis for Processing

We process personal data only where we have a lawful basis under GDPR:

  • Performance of a contract (Article 6(1)(b)): to provide the Service, manage your account, and process payments.
  • Legitimate interests (Article 6(1)(f)): to operate, secure, improve, and promote the Service and to prevent fraud and abuse, where these interests are not overridden by your rights.
  • Legal obligation (Article 6(1)(c)): to comply with tax, accounting, and other legal requirements.
  • Consent (Article 6(1)(a)): for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting processing carried out before withdrawal.

3. Personal Data We Collect

As a controller, we may collect and process the following categories of personal data:

  • Identity data: full name, username, account credentials.
  • Contact data: email address, support correspondence.
  • Billing and transactional data: subscription status and order history. Card and payment details are collected and processed directly by Paddle, not stored by us.
  • Technical data: IP address, browser type, operating system, device information, referring URLs, and usage data collected through cookies and analytics.
  • Communications data: messages you send through our contact form, support channels, or the WhatsApp channel.

We do not collect special category data such as health, biometric, or political data as part of running your account. Personal data means any information relating to an identified or identifiable natural person.

4. Data We Process on Behalf of Customers

When you use CrawlBrain on your website, we process the following on your behalf as a processor:

  • Website content: the pages, products, FAQs, articles, and other content we crawl and index from the website you connect. This content may contain personal data if you publish it.
  • Visitor questions and searches: the text your site visitors type into the search widget or send through the WhatsApp channel, together with the answers returned.
  • Conversation logs: a record of visitor questions and answers, made available to you in your dashboard so you can review how the Service performs.
  • WhatsApp data: where you enable the WhatsApp channel, the visitor’s phone number and message content, processed through our messaging providers to deliver answers.c
Visitor questions can contain personal data. As the website owner, you are responsible for informing your visitors and for not encouraging the submission of sensitive personal data through the search widget. We recommend a short notice near the widget pointing to your own privacy policy.

5. How We Collect Personal Data

  • Directly from you when you register, make a purchase, connect a website, or contact us.
  • Automatically through your interaction with our website and application, including cookies, analytics, and server logs.
  • From your website and visitors when we crawl connected content and when visitors use the widget or WhatsApp channel.
  • From third parties such as Paddle, where necessary to complete transactions and manage billing.

6. How We Use Personal Data

As a controller, we use personal data to:

  • Create and manage your account and deliver the Service.
  • Process payments, manage subscriptions, and handle billing questions (through Paddle).
  • Provide customer and technical support.
  • Send transactional messages such as confirmations, renewal reminders, and service notices.
  • Send marketing communications where you have consented or where permitted for existing customers. You may opt out at any time.
  • Improve the Service through analytics, aggregated statistics, and feedback.
  • Detect, investigate, and prevent fraud, abuse, and security incidents.
  • Comply with legal obligations.

We do not sell your personal data. We do not use it for automated decision-making that produces legal or similarly significant effects on you. We do not use the questions your visitors ask, or the content of your website, to train our own or any third party’s foundation models.

7. AI Processing and Sub-Processors

To provide search and answers, CrawlBrain sends website content and visitor questions to specialist providers that generate the numerical representations (embeddings) and the natural-language answers. We use a limited set of trusted sub-processors, each bound by a data processing agreement and, where relevant, by terms that prohibit using your data to train their models.

Sub-processor
Purpose
Location
Paddle.com
Payments, billing, tax, and Merchant of Record
United Kingdom / EU
Anthropic
Large language model used to generate answers
United States
Voyage AI
Text embeddings and reranking for semantic search
United States
Qdrant
Vector database storing indexed content
EU
Twilio
Messaging infrastructure for the WhatsApp channel
United States / EU
Meta Platforms
WhatsApp Business message delivery
United States / EU
Cloud hosting provider
Application hosting and storage
EU
We maintain an up-to-date list of sub-processors and will provide reasonable notice of material changes to customers who have a Data Processing Agreement with us. Where content or questions are processed outside the European Economic Area, we rely on appropriate safeguards as described in Section 9.

8. Disclosure of Personal Data

We do not sell, rent, or trade personal data. We may share it only where necessary with:

  • Paddle.com, our payment processor and Merchant of Record, to process transactions and manage billing.
  • Sub-processors listed in Section 7, to deliver the core functionality of the Service.
  • Professional advisers such as lawyers, accountants, and auditors, where necessary for legal and compliance purposes.
  • Regulatory and law enforcement authorities, where required by law, court order, or legal process.

All third parties with whom we share personal data are required to handle it securely and in accordance with applicable data protection law.

9. International Data Transfers

MINBO QRE SRL is based in Romania, within the European Economic Area (EEA). Some of our sub-processors operate outside the EEA, including in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR, which may include Standard Contractual Clauses approved by the European Commission, or transfers to countries or frameworks recognized by the European Commission as providing an adequate level of protection. You may request information about the safeguards applicable to a specific transfer by contacting us using the details in Section 16.

10. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These include access controls and role-based permissions, strong authentication for system access, encryption of data in transit using TLS/HTTPS, encryption of sensitive data at rest where appropriate, and regular review of our security practices and infrastructure.

No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by GDPR.

11. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

  • Account and subscription data: for the duration of your active account and a reasonable period thereafter to handle post-cancellation queries or disputes.
  • Indexed website content and conversation logs: for the life of your account, or until you delete the connected website or the relevant data. On account closure, this data is deleted or anonymized within a reasonable period, subject to backups being overwritten on their normal cycle.
  • Billing and transactional records: retained for the period required by Romanian tax and accounting law, typically 10 years.
  • Support communications: retained for the duration of the support relationship and a reasonable period thereafter.

When personal data is no longer required, it is securely deleted or anonymized.

12. Your Rights Under GDPR

If you are located in the EU or EEA, you have the right of access, rectification, erasure, restriction of processing, objection, and data portability, and the right to withdraw consent where processing is based on consent. Where CrawlBrain acts as a processor for a website you visited, we will refer your request to that website’s owner, who is the controller.

You also have the right to lodge a complaint with your national supervisory authority. In Romania, this is the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP) at www.dataprotection.ro.

To exercise any of these rights, contact us using the details in Section 16. We will respond to legitimate requests within 30 days. In complex or multiple cases we may extend this by a further 60 days, and will notify you of the extension and the reason. We will not charge a fee unless a request is manifestly unfounded or excessive.

13. Cookies and Analytics

We use cookies and similar technologies on our website to ensure core functionality and security, analyze performance and visitor behavior, improve user experience, and deliver relevant marketing where you have consented. Cookies that are not strictly necessary are only placed with your explicit consent, in accordance with GDPR and the ePrivacy Directive. You can manage or withdraw your cookie preferences at any time through your browser settings or our cookie consent tool. Disabling certain cookies may affect website functionality.

The embeddable CrawlBrain widget is designed to run in an isolated container on your visitors’ pages and does not set advertising cookies.

14. Children’s Privacy

The Service is not directed at children under 13, and we do not knowingly collect personal data from children under 13 as part of running an account. If you believe we have inadvertently collected such data, please contact us and we will take prompt steps to delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or business operations. The current version is always available at crawlbrain.com/privacy-policy and is identified by the date at the top of the page. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

16. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your data rights, contact us at privacy@crawlbrain.com.

For formal or legal correspondence, please write to:

MINBO QRE SRL
Company No. 35085735
Romania

We will respond to all data protection inquiries within 30 days.

CrawlBrain is a product of MINBO QRE SRL (Company No. 35085735), Romania. See also our Terms of Service and Refund Policy.