Legal
Data Processing Addendum
Last updated July 24, 2026 · one page, in plain language
This summarizes how Cran processes data on your behalf. It supplements the Privacy Policy and Terms. For a countersigned copy for your vendor file, email privacy@trycran.in.
1. What we process, by default
Usage metadata — model, token counts, latency, cost, status — for every gateway call. Workflow metadata from codebase scans: file paths, model names, prompt shapes. The scan runs locally in your editor; your source code is never uploaded.
2. What we process only if you turn it on
Traffic captures (prompt/response samples for testing) are off by default, enabled per workflow, redacted before storage, and retention-limited. Send x-cran-no-store: true on any request and no content is persisted for it — only metering.
3. Where it flows (subprocessors)
| Subprocessor | Role | Data involved |
|---|---|---|
| Vercel | Application hosting & delivery | All traffic in transit through the app |
| Supabase (AWS) | Postgres database & storage | Account data, usage metadata, opt-in captures |
| Clerk / Supabase Auth | Authentication | Email, name, session data |
| OpenAI | Model inference & grading | Prompts routed to OpenAI models; test prompts during grading |
| Anthropic | Model inference & fallback grading | Prompts routed to Anthropic models |
| Model inference | Prompts routed to Google models | |
| Email delivery provider | Transactional email | Email address, alert contents (aggregates only) |
Model providers only receive prompts for calls you route to their models. We do not sell your data and do not use your prompts or outputs to train models.
4. Security
Data is encrypted in transit and at rest. Provider keys are held server-side, encrypted. Connection tokens are hashed at rest and scoped (read / propose / apply). Sensitive actions are written to an audit log. PII redaction (SSNs, card numbers) runs at the gateway before content reaches a provider.
5. Retention & deletion
Usage metadata is retained for billing and observability. Captures expire on a retention TTL. Deleting a project deletes its data; deleting your account removes account data. Deletion requests: privacy@trycran.in — honored within 30 days.
6. Your rights
Where GDPR/CCPA apply, you can request access, correction, export, or deletion. We notify you of subprocessor changes via this page’s changelog and of any breach affecting your data without undue delay.