Privacy policy

1. Who is responsible for your data

FOSSA, Inc. (“we”, “us”) operates craupdates.com and is the data controller for the personal data described in this policy. Our registered address is 595 Market Street, Floor 10, San Francisco, CA 94105. For any question about this policy or about how we handle your data, write to privacy@craupdates.com.

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. The contact address above reaches the person responsible for data protection.

2. What we collect

Data you give us

• Account details. When you create an account we collect your email address, a display name, and — optionally — the organisation you want shown beside your posts. Your password is handled by our authentication provider and is never stored or visible to us in readable form.
• Your agreements. A record, made when you create an account, of the version of the Terms of service and this policy you accepted and when. If you choose to receive email updates, a record of that choice, the wording you saw and when you made it, kept so we can show it later and so that withdrawing it takes effect.
• Content you post. Questions, discussions and replies, together with the display name and organisation attached to them. This content is public by design: anyone can read it without an account, and search engines index it.
• Correspondence. Anything you send us by email, including moderation appeals and data requests.

Data collected automatically

• Session cookies. Signing in sets cookies that keep you signed in and protect the session. They are strictly necessary for the site to function and are not used for advertising or tracking across other sites.
• Server and security logs. Our hosting provider records request metadata — IP address, timestamp, user agent, the page requested — to deliver the site, diagnose faults and detect abuse.
• Product analytics. We use PostHog to count page views and a small set of named actions — signing up, signing in, opening a discussion — so we can see which parts of the site are useful. It runs only if you accept statistics cookies in our cookie banner. If you are signed in, those events are linked to your account identifier; if you are not, no profile is created for you at all.

We do not run advertising networks, ad-tech tracking pixels or cross-site trackers, we do not sell or share data with advertisers, and we do not build behavioural profiles of signed-out readers.

3. What is public, and what is not

Your display name, your organisation if you gave one, any expert or staff badge you hold, and the content and timestamps of your posts are published on the site. They appear as the byline on every question and reply you write, so readers can weigh an answer by who gave it — that byline is the point of the community, and we rely on our legitimate interest in an attributable, trustworthy forum (Article 6(1)(f)) to publish it.

Because the community is open, that information is readable without an account, indexed by search engines, and carried in our RSS feed. Assume anything you post can be copied and cached elsewhere, including by systems we do not control.

Your email address is never published, and neither is anything you send us privately or any report you send a moderator. To change your display name or remove your organisation, write to privacy@craupdates.com and we will do it — a self-service settings screen is not available yet. If you would rather not be identified at all, choose a display name that does not identify you.

4. Why we use it, and on what legal basis

• Running your account and publishing your posts — performance of our contract with you (Article 6(1)(b) GDPR).
• Moderating the community, preventing abuse and keeping the service secure — our legitimate interests in a usable, lawful forum (Article 6(1)(f)).
• Service messages — for example a sign-in confirmation or a password reset — performance of our contract with you (Article 6(1)(b)).
• Optional updates by email — news from CRA Updates and from FOSSA, Inc., which operates this site, including occasional product news — are sent only with your consent (Article 6(1)(a)). It is a single, unticked checkbox that is never a condition of having an account. You may withdraw it at any time, from your settings or the unsubscribe link in any message, and doing so stops both.
• Understanding how the site is used, through the product analytics described above — your consent, given through the cookie banner (Article 6(1)(a)). You may withdraw it at any time from “Cookie settings” at the foot of every page.
• Meeting our own legal obligations, such as responding to a lawful request from an authority — Article 6(1)(c).

We do not ask for special-category data under Article 9, and you should not post it.

5. Who we share it with

We do not sell personal data. We share it only with processors who run the service on our behalf, under a written data processing agreement:

• Supabase — authentication and database hosting for accounts and community content.
• Vercel — application hosting, content delivery and server logs.
• PostHog — product analytics.
• Our email provider — delivery of the transactional messages described above.

We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

6. Where your data is held

Our database and authentication data are currently hosted in the United States (AWS us-east-1), and our hosting and email providers may process data outside the EEA. Those transfers rely on the European Commission’s Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguards in place. [Confirm the hosting region and each provider’s transfer mechanism before publishing.]

7. How long we keep it

• Account data — for as long as your account is open. To close it, write to privacy@craupdates.com; we delete the account within 30 days of the request, and hold it during that window so an accidental request can be reversed.
• Public posts — indefinitely. Discussions are a shared archive that other readers rely on, so when you close your account we detach your name from your posts rather than deleting the thread. If a specific post needs to come down, ask us and we will consider it.
• Server and security logs — a rolling period of no more than 12 months.
• Analytics events — [confirm the retention period configured in PostHog].

8. Your rights

Under the GDPR you may ask us to:

• confirm what data we hold about you and give you a copy (Article 15);
• correct data that is wrong or incomplete (Article 16);
• delete your data (Article 17), subject to the archive point above;
• restrict how we use it (Article 18);
• port it to another service in a machine-readable form (Article 20);
• object to processing we base on legitimate interests (Article 21), including any direct marketing.

Write to privacy@craupdates.com and we will respond within one month. If you are not satisfied with our answer you may complain to your national data protection authority — you can find yours through the European Data Protection Board.

9. Cookies

We use Cookiebot to ask for your consent before setting any cookie that is not strictly necessary. The session cookies that sign you in and keep that session secure are strictly necessary; blocking them stops sign-in from working but leaves the rest of the site readable. Cookiebot also sets a strictly necessary cookie to remember your choice, for up to twelve months.

Our analytics cookie belongs to the statistics category and is set only if you accept it; until then PostHog stores nothing on your device and sends nothing. We set no marketing or advertising cookies. You can change or withdraw your choice at any time from “Cookie settings” at the foot of every page.

The cookies currently set on this site, as last scanned:

10. Children

The site is intended for people working on regulatory compliance and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service changes. The date at the top always reflects the current version, and we will flag any material change on the site before it takes effect.

See also our terms of service and our community guidelines.