Privacy policy
CrokioBridge ("we") operates the platform at this address. This policy explains what personal data we process when you use it, why, and what rights you have.
What we collect
Account data you give us: name, email address, username, password hash, and avatar. Sign-in data from Google when you connect it: your Google account id, name, email, and profile image. Organization data: the organizations you belong to, your membership role, and the invitations you send or receive. Technical data: IP address, browser user agent, and session identifiers, kept with each session. Usage data needed to run the service, such as the projects and shortlists you create.
Why we process it
To create and secure your account (authentication, email verification, password reset, session management); to run organizations and their memberships; to deliver the marketplace features you use; to prevent abuse (rate limiting, bans, audit logging of administrator actions); and to send transactional email you asked for. We do not sell personal data and we do not use it for advertising.
Legal basis
Performance of the contract with you (account and organization features), our legitimate interest in keeping the service secure and reliable, and your consent where you connect a third-party sign-in provider.
Sharing
Data is processed by the infrastructure providers that host the platform and deliver its email, under data-processing agreements. Members of an organization see the name, email, and username of the other members. Nothing else is shared without your instruction.
Retention
Account data is kept while the account exists. Sessions expire after 30 days of inactivity. Administrator audit events are kept for the period required to investigate abuse. When you delete your account, personal data is removed and what must be kept is anonymized.
Your rights
You can view and change your profile, email, password, connected accounts, and sessions under My account, and delete the account there. You can also download a copy of your personal data under My account › Your data: the file is machine-readable JSON, separates what you gave from what the platform derived about your use of it, and is delivered through a link that only you can open and that expires after ten minutes. You may request correction of your data, and anything we have to handle by hand — a correction, or an access request that the download does not cover — is answered within one month of receiving it. You may lodge a complaint with your supervisory authority.
Contact
Questions about this policy go to the platform operator through the contact address published on the site.