Privacy
This page says what we store, for how long, and who sees it. The retention periods listed here are the ones the system enforces every day: they are not an intention, they are what the code does.
What we store
About the person filling in the form
They are a customer of a local business who scanned a QR code. They have no account with us and agreed to no terms, so we keep the minimum about them, for the shortest time we can. The only thing that lasts longer is the one thing they asked us to keep, by ticking a box.
A code derived from their IP address
To limit abuse of the form. We never store the IP address itself.
Deleted after 30 days
Their answers and the text of the review
It is what the system uses to draft the review, and what it later compares so that two customers of the same business don't publish similar text.
Kept: it is text written to be published on Google
The private message, if they chose to write one
It goes to the business, which is who it is addressed to.
Deleted after 365 days
The contact details they left for a reply
It is the only thing that lets the business get back to them.
Deleted after 90 days, before the message itself
The email address they left for the business to write to them, if they left one
We ask for it at the end, with a checkbox they have to tick: without ticking it, nothing is stored. It belongs to the business, which is who will write to them — Cruzar does not send those emails and does not use them for anything of its own.
Deleted after 730 days
About the business using Cruzar
Here there is a relationship: an account, an email address, someone we talk to. This data lives as long as the account does.
The email address used to sign in
It is the only way in: there is no password, we send a link.
As long as the account exists
What they wrote from this site to get in touch
To be able to reply and to carry on the conversation.
Deleted after 365 days
What we don't store
- No third-party cookies, no tracking pixels, no analytics tools.
- No IP address in the clear, for anyone.
- No payment data: we don't take payments here.
- No Google credentials belonging to our customers. We don't publish reviews on their behalf — publishing is always the person's own act, from their own account.
Who sees it, besides us
Each one has a specific job, and none receives data for its own purposes. This is the whole list: if we ever hire another one that sees something of yours, it shows up here.
Anthropic
Receives the form answers in order to draft the review, in the United States. It does not receive the email address, the contact details, or any account data.
Resend
Sends our email from the United States, so it sees the destination address and the contents — including the text of a private message, which travels inside the notification to the business.
Railway
Hosts the application and the database, in Europe (Amsterdam). It sees everything that is stored, at rest.
How to ask us to delete your data
Write to us and we will. There is no form and no process: at the volume we are at today, a person handles it.
What we cannot do, and why
If you filled in a form, we have no way of knowing which of the answers are yours. There is no account, the session is anonymous, and the code derived from your IP address is irreversible by design. There are two things we can delete, because both carry something you typed: the private message you left, by the contact details you wrote in it, and the email address you left for the business to write to you. For everything else we cannot identify what is yours without asking you for more data than we hold, and asking would make the problem worse. We would rather say so than promise a deletion we would be carrying out by guesswork.
Write to the address below using the email or phone number you left, so that we can find it.
We answer within 30 days at the latest, and usually within a few.