Privacy Policy

Last updated: September 2026

1. General information

This Privacy Policy explains how Crata AI SL collects, uses, stores, and protects the personal data of users who access and interact with the Miranda website (miranda.crata-ai.com).

We strictly comply with applicable data protection laws, including Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Spanish Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"), and Law 34/2002 of July 11 on Information Society Services and Electronic Commerce ("LSSICE").

By accessing and using this website, you acknowledge that you have read and understood this Privacy Policy.

2. Data controller

Legal name: Crata AI SL
Tax ID (NIF): B55438493
Registered address: C/ Aribau 170, 1º 2ª, 08036 Barcelona, Spain
Email: [email protected]
Website: miranda.crata-ai.com

Miranda is a product of Crata AI SL. The data controller is Crata AI SL.

3. Personal data we collect

When you use this website or contact us, we may collect the following categories of personal data:

Information you provide directly to us: full name, email address, phone number, company name, job title, and any other information you voluntarily provide through contact forms, resource download requests, trial requests, or when booking a demo meeting.

Information collected automatically: when you browse the website, we may automatically collect your IP address, browser type and version, device and operating system information, browsing behavior and usage data, and cookies (see our Cookies Policy for more information).

We do not collect payment data. Crata AI SL does not process or store financial information of any kind through this website.

4. Your project data in Miranda

This policy covers the information you provide to us through this website. The documents and information your team works with inside Miranda remain yours: we process them solely to deliver the service and in accordance with your instructions, acting as a data processor.

Where Crata AI processes personal data on the customer's behalf, the specific terms — subject matter, duration, purposes, categories of data and data subjects, security measures, sub-processors, international transfers, retention, and return or deletion — will be documented in a data processing agreement compliant with Article 28 of the GDPR, either as an annex to the service agreement or as a separate agreement.

5. Purposes of processing

We process your personal data for transparent and legitimate purposes:

Managing inquiries and requests: responding to any inquiry or request you make through the website.
Managing demo meetings: organizing and confirming the meetings you book with our team.
Contract management: when you engage our services, we process your data to formalize and maintain our contractual relationship and deliver the service you requested.
Commercial follow-up: recording and managing qualified opportunities in our CRM to support the sales process.
Website analytics: analyzing user behavior on the website to improve its performance, content, and usability.
Digital advertising: measuring the effectiveness of our campaigns and showing relevant content to users who have previously visited the website.
Legal compliance: fulfilling the legal and regulatory obligations applicable to Crata AI SL.
Security: ensuring the security and proper functioning of the website and digital services.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Where you have consented to advertising or analytics cookies, we may create audiences or segments to measure campaigns and show relevant content; you may withdraw that consent at any time.

6. Legal basis for processing

The processing of your personal data is carried out on the following legal grounds:

Performance of a contract: when processing is necessary to provide the contracted services or to take pre-contractual steps at your request.
Consent: when you have expressly given your consent, such as by completing a contact form, downloading a resource, or accepting the use of non-essential cookies.
Legal obligation: when processing is necessary to comply with a legal obligation applicable to Crata AI SL.
Legitimate interest: to ensure the security, proper functioning, and continuous improvement of the website and services, provided that your fundamental rights and freedoms are not overridden.

7. Recipients and third parties

We do not share your personal data with third parties unless strictly necessary. In certain circumstances, we may disclose your information to the following trusted providers who assist us in delivering our services:

Third-party providers that process personal data on behalf of Crata AI
Provider	Purpose	Location
Webflow	Website hosting and storage of form submissions	USA (with appropriate safeguards)
Google Analytics / Google Ads	Website analytics and advertising campaign measurement	EU / EEA
Google Tag Manager	Management of website measurement tags	EU / EEA
Microsoft Clarity	User behavior analytics (session recording, heatmaps)	EU / EEA
LinkedIn	Advertising campaign tracking and conversion measurement	EU / EEA
HubSpot	CRM for managing and following up on sales opportunities	USA (with appropriate safeguards)
Calendly	Demo meeting scheduling	USA (with appropriate safeguards)
CookieYes	Cookie consent management and consent record keeping	EU / EEA
Google Workspace	Email communications	EU / EEA
Amazon Web Services (AWS)	Product cloud infrastructure and AI services through Amazon Bedrock	EU (primary region: Frankfurt, eu-central-1; certain inference profiles may process requests in other AWS regions within the EU)

All of these providers are contractually bound to process your data securely and confidentially, and solely for the intended purposes. Under no circumstances do we sell your personal data.

We may also disclose your data when required by law or by a competent authority.

International data transfers

Where a provider processes personal data outside the European Economic Area, the transfer will rely on a mechanism permitted by the GDPR, such as an adequacy decision or the Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary. You may request further information by writing to [email protected].

Data may be processed within the European Economic Area and, where providers located outside it are involved, under a valid transfer mechanism and the safeguards described in this policy. The specific location depends on the provider and service used.

8. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Retention periods by data type
Data type	Retention period
Contact data of unconverted opportunities	24 months from the last contact or interaction
Customer data (active contractual relationship)	For the duration of the agreement
Former customer data	For the applicable statutory retention and limitation periods, depending on the type of record and potential liabilities
Browsing and analytics data	According to each tool's configuration (maximum 14 months in GA4)
Cookie consent data	1 year from the date consent was recorded

Once these periods have elapsed, your data will be securely deleted or irreversibly anonymized.

9. Data security

Protecting your personal information is a priority for us. Crata AI SL implements appropriate technical and organizational measures to safeguard your data against accidental loss, unauthorized access, misuse, or disclosure.

No digital transmission or storage system can be considered invulnerable. That's why we take a continuous-improvement approach: we review our safeguards periodically and update them as threats and industry best practices evolve.

10. Your data protection rights

As a data subject, you have the following rights regarding the personal information we hold about you:

Right of access: to obtain confirmation of whether we process your data and to receive a copy of it.
Right to rectification: to request the correction of inaccurate or incomplete data.
Right to erasure: to request the deletion of your data when it is no longer necessary for the purposes for which it was collected.
Right to restriction: to request the restriction of processing in certain circumstances.
Right to object: to object to the processing of your data, particularly for marketing or advertising purposes.
Right to data portability: to receive your data in a structured, commonly used format, where processing is based on consent or a contract.
Right to withdraw consent: at any time, where processing is based on your consent, without affecting the lawfulness of processing carried out prior to withdrawal.

If you reside outside the European Economic Area, you may also use the same channel to exercise any rights granted by the data protection laws applicable in your place of residence.

To exercise any of these rights, write to us at [email protected]. We will respond without undue delay and, as a general rule, within one month of receiving the request; this period may be extended where permitted by applicable law.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its website at www.aepd.es, or with the competent supervisory authority in your country of residence, if you consider that the processing of your personal data does not comply with applicable regulations.

11. Changes to this Privacy Policy

Crata AI SL reserves the right to update this Privacy Policy whenever necessary to reflect changes in our practices, regulatory requirements, or for other operational reasons. Any substantial changes will be communicated through this website. We encourage you to review this policy regularly.

‍

Crata AI SL — miranda.crata-ai.com — [email protected]