Controller and processor boundary
The legal controller identity and contact details must be confirmed by crewQI. A customer using the software may be a separate controller for its own employee and customer data. The public website must not imply that a visitor is entering a customer data-processing agreement by requesting a demo.
Current processor categories
- Supabase Cloud: authentication, database and server functions for consent choices, campaign origin, enquiries, privacy requests and chatbot conversations available only to authorised staff. The project region and data-processing agreement must be confirmed.
- Hetzner: hosting and reverse-proxy infrastructure for the static website. The server location, support access and contract status must be confirmed.
- Cloudflare Turnstile: automated-abuse protection when a visitor submits a public form. Turnstile receives the technical browser and network information required for the security decision, but crewQI does not send the completed form contents or first-party visitor ID to Siteverify. Contract and transfer safeguards remain subject to legal review. See the Cloudflare Data Processing Addendum.
- Email service: delivery of messages about enquiries and accounts when this service is enabled. The name, region, processed data and deletion options must be documented before use.
- AI service: processing of limited public chatbot questions, conversation history and published source information. The service, model, region, transfer safeguards, retention and use for training must be reviewed before use.
- Monitoring and DNS services: availability, certificate and website publication data only. Enquiry content and chatbot conversations are not included.
The browser does not receive access keys, internal AI instructions, customer documents, employee files or raw network data.
When this register is updated
crewQI updates this page and the processor register whenever a supplier, processing purpose, region, transfer mechanism or retention period changes. An item that still needs confirmation is not evidence that legal review is complete.