Privacy policy
This policy explains what personal data crisplabs.ai and our email handle, why, and the rights you have. Our marketing pages set no cookies and run no analytics or advertising trackers.
Last updated 13 November 2026
Who we are
Crisp Labs OOD is the controller of the personal data described here.
- Registered office: 4 Diamant Blvd, Gorna Banya, 1614 Sofia, Bulgaria
- Postal address: M Plaza, ground floor, 32 Atanas Dukov St, 1407 Sofia, Bulgaria
- Commercial Register of the Bulgarian Registry Agency, UIC 207346722
- VAT number: BG207346722
- Email: contact@crisplabs.ai
- Phone: +359 888 509 772
Send any question about your data to contact@crisplabs.ai.
What we collect and why
Visiting the website
When you open a page, our host Vercel receives your IP address, browser and device type, the page you asked for and the time. We use this only to deliver the site and protect it from abuse. On larger screens the homepage project map connects your browser to our database provider, Supabase, for live updates, so Supabase also receives your IP address. If you type www.crisplabs.ai, Cloudflare receives the same request data to redirect you.
Legal basis: our legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)).
Emailing us
When you write to contact@crisplabs.ai, we receive your name, email address and whatever you put in the message. We use it to answer you and, if we work together, to prepare and carry out that work.
Legal basis: steps you ask for before a contract, and the contract itself (Art. 6(1)(b)); otherwise our legitimate interest in answering you (Art. 6(1)(f)).
Voting at our events
At some events we run a live poll at crisplabs.ai/vote. To allow one vote per device, the page reads technical traits of your browser and device and turns them into a one-way code in your browser. We store that code with your multiple-choice answers. We never ask for your name or email. Reading these traits is strictly necessary for the vote you choose to cast, and we use them for nothing else.
Legal basis: our legitimate interest in running a fair poll (Art. 6(1)(f)).
Signing in as staff
Our team signs in to the event tools with a Google account. We store the name, email address and role of each account.
Legal basis: our legitimate interest in securing our tools (Art. 6(1)(f)).
Cookies and local storage
Our marketing pages set no cookies and store nothing on your device. The event tools store only what they need to work:
- Theme (local storage): the light or dark theme you pick on the project map or voting pages, kept until you clear your browser data.
- Voting progress (local storage): your answers on the voting page, so a reload does not lose them, kept until you clear your browser data.
- Sign-in cookies: keep staff signed in, removed when you sign out and expired after at most 400 days.
- Admin settings (local storage): remember how staff arrange the admin pages.
While it reads the device traits described above, the voting page also writes a test cookie and deletes it at once. None of this is used for analytics or advertising, and each item serves a feature you chose to use, so we do not ask for cookie consent.
Who receives your data
We do not sell your data or use it for advertising. These providers process it on our behalf, under data processing agreements:
- Vercel Inc., USA: hosting and request logs.
- Supabase, with our database in London, UK, and support from Supabase Pte. Ltd., Singapore, and Supabase Inc., USA: votes, staff accounts and project map updates.
- Google LLC, USA: our email (Google Workspace) and staff sign-in.
- Cloudflare Inc., USA: our domain's DNS and the www redirect.
We share data with authorities or courts only when the law requires it.
Transfers outside the EU
Vercel, Google and Cloudflare are certified under the EU-US Data Privacy Framework. The United Kingdom, where our database runs, has an EU adequacy decision. Where Supabase staff in Singapore or the USA can reach the data, we rely on the European Commission's standard contractual clauses. Write to us for a copy of these safeguards.
How long we keep it
- Request logs: at most 30 days.
- Emails that do not lead to work: deleted within 2 years.
- Emails about a project: for the project, then as long as Bulgarian accounting and tax law requires for its records, up to 10 years.
- Job applications: 6 months, unless you agree to a longer period.
- Votes and their device codes: deleted within 12 months after the event.
- Staff accounts: until the person leaves our team.
Your rights
You can ask us for a copy of your data, and to correct it, delete it or restrict how we use it. Where you gave us data for a contract, you can also ask for it in a portable format.
Right to object. You can object at any time to processing based on our legitimate interests. We will then stop, unless we have compelling legitimate grounds or need the data for a legal claim.
Write to contact@crisplabs.ai and we will reply within one month. Votes carry no name, so we usually cannot tell which vote is yours.
Complaints
If you think we handle your data unlawfully, you can complain to the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, kzld@cpdp.bg, www.cpdp.bg, or to the data protection authority where you live or work. We would welcome the chance to sort it out with you first.
Other points
You never have to give us personal data: the website works without it, and emailing us or voting is your choice. We make no automated decisions about you and do no profiling.
Changes to this policy
If we change this policy in a way that affects you, we will update this page and its date and, where we can reach you, tell you directly.