Who is responsible for your data
The controller of personal data processed through crons.ai is the administrator of the crons.ai service (we, us). You can contact us about anything in this policy at support@crons.ai. This policy covers the website, the web application, the API and emails we send. When you use Crons to process data about other people inside your crons, you decide what that data is and why it is processed, and for that data we act as a processor on your behalf. Teams customers can sign a data processing agreement in the workspace.
What data we process
- Account data such as your email address, name, password hash, workspace name, role and team membership.
- Billing data such as plan, billing period, invoices and billing address and tax details you provide. Card details are entered on the payment operator page and are not stored by us.
- Workspace content such as cron descriptions, steps, prompts, memory, run logs, results and approval decisions.
- Connected account data such as OAuth tokens and API keys you store for integrations, which are encrypted at rest.
- Technical data such as IP address, browser type, request logs, error logs and security events.
- Communication data such as messages you send to support@crons.ai and our replies.
We do not ask for special categories of personal data, and you should not place them in crons unless you have a lawful basis to do so.
Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the service, including running your crons | Performance of a contract, Article 6(1)(b) |
| Billing, invoicing and keeping accounting records | Legal obligation, Article 6(1)(c), and contract, Article 6(1)(b) |
| Sending service emails such as verification codes, alerts, approval requests and receipts | Performance of a contract, Article 6(1)(b) |
| Security, fraud prevention, abuse detection and enforcing limits | Legitimate interests, Article 6(1)(f) |
| Improving the service using aggregated usage information | Legitimate interests, Article 6(1)(f) |
| Handling support requests and legal claims | Legitimate interests, Article 6(1)(f), and legal obligation where applicable |
Where we rely on legitimate interests, we have balanced them against your rights. You can object to that processing at any time, as described below.
Who receives your data
We do not sell personal data. We share it only with recipients who help us provide the service, under contracts that require them to protect it and use it only on our instructions. The categories of recipients are:
- a hosting provider in the European Union that runs our servers and databases,
- a payment operator that processes subscription payments and stores card details,
- an email delivery provider that sends verification codes, alerts and receipts,
- an AI model provider that processes the content of AI reasoning steps under business terms that do not allow training on customer data,
- integration providers you choose to connect, such as Slack, Gmail, HubSpot, Google Sheets or Notion, which receive the data your crons send to them,
- professional advisers and public authorities where the law requires it.
International transfers
Some recipients may process data outside the European Economic Area. In that case we rely on an adequacy decision of the European Commission or on standard contractual clauses approved by the Commission, together with additional safeguards where needed. You can ask for information about these safeguards at support@crons.ai.
How long we keep data
- Account data is kept while your account is active and deleted after it is closed and the paid period ends.
- Run logs are kept for 30 days on Starter, 90 days on Pro and 1 year on Teams, then deleted automatically.
- Cron memory is kept until you clear it, delete the cron or close the account.
- Billing records and invoices are kept for the period required by tax and accounting law.
- Security and request logs are kept for a limited period needed to investigate incidents.
- Support messages are kept as long as needed to resolve the request and handle possible claims.
How we protect data
Data is encrypted in transit. Tokens and credentials for connected accounts are encrypted at rest. Access to production systems is limited to people who need it. Workspaces are separated from each other, code steps run in a sandbox and browser sessions end with each step. More detail is on the security page.
Your rights
Under the GDPR and similar laws you have the right to:
- access the personal data we hold about you and receive a copy,
- have inaccurate data corrected,
- have data erased where there is no reason to keep it,
- restrict processing in certain situations,
- receive your data in a portable format,
- object to processing based on legitimate interests,
- withdraw consent at any time where processing is based on consent,
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.
To exercise a right, write to support@crons.ai from the email address on your account. We reply within one month and may ask you to confirm your identity. If your request concerns data you processed inside your own crons about other people, we will help you as your processor.
Children
Crons is a business service and is not intended for people under 16. We do not knowingly collect data from children. If you believe a child has created an account, write to support@crons.ai and we will delete it.
Changes to this policy
We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change is significant, we tell account owners by email before it takes effect. Earlier versions are available on request at support@crons.ai.