Privacy Policy

1. Who we are

Cravault (“we”, “us”) provides a CRA Article 14 compliance service. The data controller is [Operator legal entity — to be confirmed]. For any privacy question, contact hello@cravault.io.

2. What we collect

• Account & organisation: your email, sign-in identity (GitHub/Google id or magic-link email), organisation name and membership.
• Product data (SBOMs): the list of components and versions you upload. We never receive your source code.
• Usage & logs: request metadata, IP address, and diagnostic logs used to operate and secure the Service.
• Billing: handled by Paddle (our payment processor and Merchant of Record). We receive subscription status and a customer reference, not your full card details.
• Communications: notification preferences and, if you connect them, Slack/Telegram delivery identifiers.

3. How we use it & legal bases

We process your data to provide the Service (performance of a contract): monitoring releases, generating Article 14 drafts and advisories, sending alerts, and maintaining an evidence trail. We also process limited data for security, fraud prevention and service improvement (legitimate interests), and to meet legal obligations. We do not sell your data or use it for advertising.

4. AI processing

Article 14 report drafts optionally use an AI model (Anthropic) to write only the narrative fields from facts derived from your SBOM and public vulnerability data. This processing may occur outside the EU (United States). You can disable it per organisation in Settings — the report facts are still filled in automatically and you write the narrative yourself, keeping that data in the EU.

5. Subprocessors

We rely on a small set of providers to run the Service:

• OVH (France) — hosting and infrastructure.
• Mailjet — transactional email (sign-in links, alerts, digests).
• Paddle — payments, invoicing and tax as Merchant of Record.
• Anthropic (US) — optional AI narrative drafting (see §4; can be disabled).
• Telegram — optional per-user alert delivery, only if you connect it.

6. Where your data is stored & transfers

Our servers and object storage run in the European Union (France). Data may be transferred outside the EU only for the optional AI processing described in §4, under appropriate safeguards. We do not use “EU data residency by default” as a blanket claim precisely because that optional AI step can send SBOM-derived facts to a US provider.

7. Retention

Your evidence vault is retained for 10 years on paid plans (90 days on Free) — the CRA’s long evidence horizon is a product feature. Account data is kept while your account is active. After cancellation there is a read-only export window, then deletion, unless you choose the optional Archive plan. Logs are kept only as long as needed for operations and security.

8. Your rights

Subject to applicable law (including the GDPR), you may request access to, correction or deletion of your data, export it, restrict or object to processing, and withdraw consent. You can export your evidence at any time from the app. To exercise a right, contact hello@cravault.io. You also have the right to complain to your local data protection authority.

9. Cookies

The application uses a strictly necessary session cookie to keep you signed in and a short-lived cookie during OAuth sign-in. We do not use advertising or cross-site tracking cookies. Any analytics we use are privacy-friendly and EU-hosted.

10. Security

Traffic is encrypted in transit; ingest tokens are stored only as salted hashes; access is org-scoped. See the Trust page for details and our security.txt for responsible disclosure.

11. Children

The Service is for business use and not directed to children under 16.

12. Changes

We may update this policy; we’ll post the new version here and update the date above.