Privacy · v2026-08-12
Privacy Policy
Last updated: 2026-08-12 · Cookie Policy · DPA · AI Transparency
1. Controller
The Controller is Engineering Factory. Privacy contact: info@centropic.ai.
Full company details (address and VAT ID) will be published as soon as they are available in the business register / operational configuration.
2. Scope and Roles
- Controller — for accounts, authentication, billing, platform security, analytics, and our own marketing.
- Processor — when we process site content and analysis outputs on behalf of the Customer (B2B). See DPA.
3. Categories of Data
- Identity and contact: email, name, phone (optional), language, time zone.
- Account and authentication: password hashes, sessions, session versions, access logs.
- Billing: plan, subscription status, Paddle ID, credit history, digital withdrawal waiver.
- Product usage: monitored sites, analysis runs, findings, SoV, job status, preferences.
- Customer Content: URLs, text/HTML captured for analysis, generated AI outputs.
- Technical: IP, user-agent, preference cookies/localStorage and, with consent, analytics/ads.
- Support: messages sent to info@centropic.ai.
4. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Provision of the SaaS Service and account management | Contract (Art. 6.1.b) |
| Billing, credits, tax obligations | Contract / legal obligation (Art. 6.1.b/c) |
| Security, abuse prevention, debugging | Legitimate interest (Art. 6.1.f) |
| Analytics / advertising cookies | Consent (Art. 6.1.a) — manageable in the banner |
| Service and legal communications | Contract / legal obligation |
| Product improvement (aggregated/anonymized data) | Legitimate interest, with safeguards |
5. Retention Periods
- Active account: for the duration of the relationship + 30 days after closure (except where legal obligations apply).
- Billing and tax data: up to 10 years where required by law.
- Security and access logs: typically 12 months.
- Analysis runs and associated content: until account/site deletion or Customer request; residual backups up to 90 days.
- Cookie preferences: up to 12 months, then consent is reviewed.
- Support tickets: up to 24 months after closure.
6. Recipients and Sub-processors
We process data with strictly necessary providers (hosting, database, email, payments, AI models). Active list: Sub-processors. Paddle processes payment data as an independent controller for checkout.
7. International Transfers
Some providers may process data outside the EEA (e.g., the United States). In those cases, we use appropriate safeguards (Standard Contractual Clauses / equivalent provider mechanisms) and minimization. Provider-specific details are available on the Sub-processors page and in their respective DPAs.
8. Automated Decisions and AI
The Service generates scores, findings, and recommendations through AI models. We do not make solely automated decisions that produce significant legal effects for a data subject under Art. 22 GDPR without human involvement. More details: AI Transparency.
9. Cookies and Tracking
See the Cookie Policy. You can change your consent at any time through “Manage consent” in the footer.
10. Data Subject Rights
You have the right to access, rectification, deletion, restriction, portability, objection, and withdrawal of consent. Write to info@centropic.ai. You may lodge a complaint with the Italian Data Protection Authority or the authority in your EU/EEA country.
11. Minors
The Service is intended for adult professional users. We do not knowingly collect data from children under 16. If you believe a minor has provided us with data, contact us for deletion.
12. Security and Data Breaches
We adopt appropriate technical and organizational measures (encryption in transit, access controls, tenant segregation, backups). In the event of a personal data breach that creates a risk to rights and freedoms, we will notify the competent authority and, where required, affected data subjects within the legal deadlines. Overview: Trust & Security.
13. International Notes (Where Applicable)
- UK GDPR — if you process data of UK data subjects, rights and legal bases remain substantially aligned; the privacy contact is unchanged.
- CCPA/CPRA (California) — we do not sell personal data. Access/deletion/opt-out rights: contact info@centropic.ai. Identify yourself as a California resident in the request.
14. Changes
We may update this policy. The current version and date are shown at the top. For material changes, we will provide in-app notice or email where appropriate.
Document versions: Privacy v2026-08-12 · Cookie v2026-08-12 · Terms v2026-08-12 · DPA v2026-08-12 · AI v2026-08-12