Privacy Policy

Controller: N32 TECHNOLOGIES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (N32 Technologies sp. z o.o.), ul. Młynarska 42/115, 01-171 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for the Capital City of Warsaw in Warsaw (Sąd Rejonowy dla m.st. Warszawy w Warszawie), Commercial Division of the National Court Register, under number 0001182221, NIP 5273172168, REGON 542179999, EU VAT ID PL5273172168, share capital PLN 5,000
Contact: team@crang.ai (general, legal and privacy), support@crang.ai (support)

This Privacy Policy explains how N32 Technologies sp. z o.o. ("N32", "we", "us") processes personal data in connection with Crang (crang.ai), our AI call center platform for businesses (the "Service"), and our website.

1Who is responsible for your data

1.1. N32 as controller. We are the controller of personal data we process for our own purposes: data of visitors to crang.ai, of people who sign up for the Service, of users of our customers' workspaces, and of our customers' representatives and billing contacts. This Privacy Policy covers that processing.

1.2. N32 as processor. When our business customers use the Service to call people, answer calls, or store contact lists, recordings and transcripts, the customer is the controller of that data and we process it only on the customer's behalf, under our Data Processing Agreement at crang.ai/dpa. If you received a call from, or called, a business that uses the Service, that business decides how your data is used. Please contact that business to exercise your rights. If you contact us, we will forward your request to the business where we can identify it.

1.3. We have not appointed a data protection officer. For any privacy question, contact us at team@crang.ai.

2What data we process, why, and on what legal basis

Data	Purpose	Legal basis under the GDPR
Signup data: full name, work email, company legal name, country, timezone, brand name, brand website, chosen workspace address, plan and promotion code	Creating the customer account and workspace, concluding and performing the contract	Article 6(1)(b), contract; for representatives of a company customer, Article 6(1)(f), our legitimate interest in concluding and performing the contract with that company
Email verification and sign-in codes	Verifying email addresses and signing users in securely	Article 6(1)(b) and 6(1)(f), security of the Service
Account data of users: name, email, role, workspace membership	Providing access to the Service and managing users	Article 6(1)(b) and 6(1)(f), performing the contract with our customer
Billing data: billing name and address, tax identification number, payment status, invoices, and payment method details held by our payment processor	Charging fees, issuing invoices, accounting and tax	Article 6(1)(b), contract; Article 6(1)(c), legal obligations under tax and accounting law
Legal acceptances: document version, time, IP address and browser information	Proving acceptance of our terms	Article 6(1)(c) and 6(1)(f), establishing and defending legal claims
Security and audit data: IP address, browser and device information, sign-in events, actions in the workspace (including exports, downloads of call transcripts, plays and downloads of call recordings, and API key events), sessions	Securing the Service, preventing fraud and abuse, keeping audit trails	Article 6(1)(f), security and fraud prevention
API key usage data: for each API key of a workspace, the time it was last used, the IP address it was last used from (an IPv4 address, or an IPv6 address shortened to its /64 network), and the networks it was recently used from (the last 20), all kept to recognize use from a new network. When a key is used from a network not among them (other than the first network it is used from), we record the event in the audit log and email the workspace owners, at most 3 times per key a day. These emails, and the one sent when the workspace's daily limit on personal data read with API keys is reached, give the key name, time and IP address; we also email owners 7 days before a key expires	Detecting stolen or misused API keys, protecting the personal data in the workspace, and warning the workspace owners	Article 6(1)(f), security of the Service and of our customers' data
Website server logs: IP address, browser information, requested pages, time	Delivering and securing the website	Article 6(1)(f), operating and securing the website
Communications: emails, support requests, onboarding call notes and booking details	Onboarding, support and answering questions	Article 6(1)(b) and 6(1)(f), providing support
Phone number entered for a test call; voice and transcript of a test conversation with an agent in the browser	Placing a test call or running a browser test conversation for the user who requests it	Article 6(1)(b) and 6(1)(f), demonstrating the Service
Usage data: features used, usage of call minutes, technical events	Operating, measuring, billing and improving the Service	Article 6(1)(b) and 6(1)(f), improving the Service
Email of an unfinished signup	One transactional service message, sent once 24 hours after a verified but unfinished signup, about completing that signup; it contains no marketing content	Article 6(1)(f), helping the person complete the signup they started
Requests to be notified about upcoming features	Telling you when the feature is available	Article 6(1)(a), consent, which you can withdraw at any time
Custom voice consent evidence, when a workspace makes a custom voice from a recording: the user who accepted and the time, IP address and browser information, the speaker's name, the texts shown, the transcript of the spoken consent sentence and the result of the automatic match, and a fingerprint (hash) of the consent clip	Showing that the speaker's consent was given and checked, and establishing and defending legal claims about a voice	Article 6(1)(f), our legitimate interest in defending legal claims
Data needed for claims	Establishing, exercising or defending legal claims	Article 6(1)(f)

2.1. Providing personal data is voluntary, but without the data marked as required at signup we cannot create an account or provide the Service.

2.2. We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects on you.

2.3. Custom voices. A workspace can make a custom voice for its agents from a recording of a speaker. The recordings used to create the voice and the AI voice model are processed for the customer as set out in section 1.2 and the Data Processing Agreement, only to speak for that customer's agents. We do not use a voice to identify anyone and do not match voices against other voices. We act as controller only for the consent evidence in the table above, which stays after the voice is deleted. If you are a speaker and want your voice removed, ask the workspace owner, who can withdraw the voice at any time, or email team@crang.ai and we will delete it.

2.4. We do not sell personal data. We do not send marketing messages without consent where the law requires consent.

3Cookies and similar technologies

3.1. We use only cookies and similar technologies that are strictly necessary to provide the Service you request. These do not require consent.

Name	Where	Purpose	Duration
Session cookie (__Host-sid)	Your workspace and the admin application	Keeps you signed in securely	Until sign-out, at most 14 days for workspaces and 12 hours for administrators
Signup cookie (__Host-sid)	crang.ai signup pages	Keeps your signup progress	Up to 7 days
Theme preference (browser local storage)	Workspace and admin applications	Remembers light or dark display	Until you clear it

3.2. We do not use analytics, advertising or tracking cookies, and we do not load third-party tracking scripts on our website or in the Service. If we decide to use them in the future, we will ask for your consent first and update this policy.

3.3. When you pay, you are taken to a checkout page hosted by our payment processor, Stripe, which may use its own cookies for payment and fraud prevention under its own privacy policy. When you book an onboarding call, you may use a booking page of a scheduling provider, under that provider's privacy policy.

4Who receives your data

4.1. We share personal data only as needed for the purposes in section 2, with: (a) service providers who process data on our behalf under data processing agreements, in these categories: cloud hosting, database and storage, email delivery, payment processing, error monitoring, scheduling of onboarding calls, and, where needed to provide the Service, voice AI and speech providers, which also carry out the AI analysis of calls; (b) Stripe, our payment processor, which processes payment data partly as an independent controller under its own privacy policy; (c) the customer whose workspace you use, which can see your user account, role and activity in its workspace; (d) professional advisers, such as lawyers, auditors and accountants, under confidentiality duties; (e) authorities, courts and other parties where required by law or to establish, exercise or defend legal claims; and (f) a buyer or successor in a merger, acquisition or sale of all or part of our business, under confidentiality duties.

4.2. The current list of our service providers is available on request at team@crang.ai.

5International transfers

5.1. Some of our service providers are located, or process data, outside the European Economic Area, including in the United States.

5.2. We transfer personal data outside the European Economic Area only on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or of the standard contractual clauses adopted by the European Commission, with supplementary measures where needed. You can request a copy of the relevant safeguards at team@crang.ai.

6How long we keep your data

Data	Retention
Unfinished signup data	Up to 7 days after the last activity, then deleted
Sign-in and verification codes	10 minutes, or until used
Account and workspace data	For the term of the contract, then 30 days for data export, then deleted, except as stated below. If the customer asks in the Service to delete its workspace, 14 days after the request (during which it can cancel), then deleted
Call recordings (processed for customers)	90 days by default; the customer can set another period in the Service
Call transcripts (processed for customers)	24 months by default; the customer can set another period in the Service
Call analysis results (summaries, evaluations, collected data)	24 months
Webhook delivery logs	30 days
Email sending jobs (recipient address; for API key alerts also the IP address)	Deleted once the email is sent; a failed one is kept for up to 7 days
Data exports (a ZIP file of a workspace's data, up to 200 MB, built when an owner, or N32 under the Terms, asks for it and stored in our database while it can be downloaded)	Available for download for 7 days, then deleted
API key usage data (last used IP address and recent networks)	While the key is valid, and for 30 days after it was revoked or expired, then cleared. Included in the workspace's data export, and erased with the workspace. The time a key was last used stays with the key until the workspace is erased. An alert in the audit log (a new network, or the daily read limit) keeps the full IP address and browser information of the request, as set out below for audit logs
Accounts of people removed from their last workspace	Erased at once (a nightly check completes any erasure that failed), together with their conversations with the in-product assistant and the invitations they accepted. If an audit log entry or a legal acceptance still names the person, the account stays only as an anonymized record (name, email address, phone number and language removed). A person who still belongs to another workspace keeps their data
Billing and accounting data, invoice records	For the periods required by tax law, typically 5 years from the end of the calendar year in which the tax payment deadline fell (Polish Tax Ordinance and Accounting Act)
Legal acceptances and contract records	Until the limitation period for claims under the contract expires under the Polish Civil Code (generally 6 years, or 3 years for claims related to business activity and for periodic claims; the period ends on the last day of a calendar year). This includes the IP address and browser information recorded with an acceptance: they stay with the contract records while the workspace exists, even if the person who accepted has left the workspace or their account was anonymized, when only their name, email address, phone number and language are removed from their account. After the workspace is erased, the contract record we keep holds the accepting person's email address, the document and version, the time and the IP address. That record, with the invoice records we keep, is deleted at the end of the 6th calendar year after the year in which the workspace was erased
Security and audit logs	For the term of the contract (audit logs for the whole term, including after a person leaves, with the user ID, IP address and browser information they were recorded with, and any name or email address written in the entry itself, such as the address of an invitation), and longer where needed for a security investigation or legal claim
Custom voices (processed for customers): recordings and voice model at our voice provider	Until the voice is deleted by withdrawal of consent, on request, by the customer, by us under the Terms, or 14 days after a notice for a voice no agent has used for 90 days; also when the workspace is erased. Recordings made to create the voice are not kept by us once the voice provider has accepted them
Custom voice consent evidence (controller)	The consent clip (audio) is deleted together with the voice. The other consent details are kept until the workspace is erased, to defend legal claims
Website server logs	For a short period needed for security, generally not longer than 90 days
Support and onboarding communications	For the term of the contract and then until the limitation period for claims expires
Data processed on the basis of consent	Until you withdraw consent

Data processed for our customers as a processor, such as call recordings and transcripts, is kept for the periods above or as set by the customer in the Service, and deleted as described in the Data Processing Agreement.

7Your rights

7.1. Under the GDPR you have the right to: (a) access your personal data and receive a copy; (b) have inaccurate data corrected; (c) have your data erased, where the legal conditions are met; (d) restrict processing, where the legal conditions are met; (e) data portability, for data processed on the basis of contract or consent by automated means; (f) object to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to processing for direct marketing; and (g) withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

7.2. To exercise your rights, email team@crang.ai. We may ask you to confirm your identity. We respond within one month, which may be extended by two further months for complex requests, as allowed by the GDPR.

7.3. You can lodge a complaint with the supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, or with the supervisory authority in your country of residence or work.

8Security

We protect personal data with appropriate technical and organizational measures, including encryption in transit, encryption of sensitive credentials, passwordless sign-in with single-use codes, role-based access control, API keys that always expire and raise alerts on use from a new network, isolation of each customer's data, audit logging and data minimization. A summary is in Annex 2 of the Data Processing Agreement. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9Children

The Service is intended for businesses and is not directed at persons under 18. We do not knowingly collect personal data of children for our own purposes.

10Changes

We may update this Privacy Policy. We will publish the new version on this page with a new version number and effective date, and notify account owners of material changes by email or in the Service.

11Contact

N32 Technologies sp. z o.o., ul. Młynarska 42/115, 01-171 Warszawa, Poland. Email: team@crang.ai.