Privacy Policy
Last updated: 7 September 2026
This Privacy Policy explains how CRAlens, operated by Pedro Buso (Brazil) ("we", "us"), the operator of cralens.com (the "Service"), collects and processes personal data. We designed the Service to collect as little personal data as possible.
This document describes how the Service actually works today and is published for transparency. It has not yet been reviewed by a qualified lawyer; that review is a blocker for the paid commercial launch, not for the free Scope Checker.
1. Who we are (data controller)
CRAlens is operated by Pedro Buso, Brazil. Contact for privacy matters: privacy@cralens.com. Postal address available upon legitimate request.
2. What we collect, why, and on what legal basis
a) Your email address (only if you request a report). When you complete the CRA Scope Checker and request your full report, we collect your email address to (i) send you a confirmation email (double opt-in), (ii) deliver your report, and (iii) — only if you confirm — send you occasional emails about preparing for the Cyber Resilience Act. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time via the unsubscribe link in any email or by contacting us.
b) Your questionnaire answers. Your answers (e.g., product type, distribution model, company size range) are used to generate your assessment and are included in your report. They describe your product and company, not you as an individual. When linked to your email, we treat the record as personal data. Legal basis: consent, together with the delivery of the report you requested.
c) Product waitlist (optional). If you actively tick the waitlist checkbox (never pre-ticked), we tag your email to notify you when the product launches. Legal basis: consent.
d) Anonymous usage analytics. We measure how the Service is used (pages viewed, checker steps completed, verdict shown) using cookieless, anonymous analytics. We do not use analytics cookies, we do not create user profiles, and analytics events never contain your email address or your raw questionnaire answers linked to you. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in understanding and improving the Service.
e) Security telemetry. Our infrastructure processes IP addresses and request metadata for rate limiting and abuse prevention. These logs are kept for a short period and are not used for profiling. Legal basis: legitimate interest in keeping the Service secure.
3. What we do NOT do
We do not sell personal data. We do not run advertising or share data with advertisers. We do not use tracking cookies. We do not profile individuals. We do not make automated decisions with legal or similarly significant effects about you — the Scope Checker assesses products against regulatory criteria, not people.
4. Processors and sub-processors
We use the following providers to operate the Service:
| Provider | Purpose | Location/notes |
|---|---|---|
| Vercel | Website hosting and server-side rendering | US company. Serverless functions for this deployment are pinned to an EU region (Frankfurt). Processes under its data processing agreement, incorporating Standard Contractual Clauses. |
| Supabase | Database (your email address and questionnaire answers) | EU region. |
| Resend | Transactional email (confirmation and report delivery) | US company. Processes under its data processing agreement, incorporating Standard Contractual Clauses. |
| PostHog | Anonymous usage analytics | EU region. Receives no email address and no identifier for you. |
Each provider processes data under a data processing agreement. An up-to-date list is available on request.
5. International transfers
Your data is stored and processed in the EU (Frankfurt, Ireland). CRAlens is operated from Brazil, which the European Commission has recognised as providing an adequate level of data protection (Commission Implementing Decision (EU) 2026/179 of 26 January 2026). Access to your data from Brazil therefore relies on that adequacy decision and requires no additional transfer safeguards.
Two of our providers, Vercel (hosting) and Resend (transactional email), are established in the United States. Where they access personal data from outside the EU/EEA in the course of providing their services, the transfer relies on their data processing agreements incorporating the European Commission's Standard Contractual Clauses (see section 4).
6. Retention
Confirmed leads: until you unsubscribe or after 24 months of inactivity. Unconfirmed sign-ups (no double opt-in): deleted within 30 days. Security logs: up to 30 days. Anonymous analytics contain no personal data and may be retained as aggregate statistics.
7. Your rights
Under the GDPR (and, where applicable, Brazil's LGPD) you have the right to access, rectify, delete, and receive a copy of your personal data, to withdraw consent, to object to processing based on legitimate interest, and to lodge a complaint with your supervisory authority. To exercise any right, email privacy@cralens.com. We respond within one month.
8. Children
The Service is intended for business users and not directed at children under 16. We do not knowingly collect data from children.
9. Changes
We will post any changes on this page and update the date above. Material changes affecting how we use your email will be communicated to you before they take effect.