LEGAL · LAST UPDATED 13 OCTOBER 2026

Privacy Policy

This policy explains what personal data CROaudits collects when you use croaudits.io, contact us or buy a CRO audit, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. Who is responsible for your data

The data controller is Bryan Gehrke, trading as CROaudits, a sole trader established in Ireland.

  • Address: Clogherane, Lauragh, Killarney, Co. Kerry, Ireland

  • Email: bryan@croaudits.io

  • Website: croaudits.io

We have not appointed a Data Protection Officer because we are not required to. For any question about this policy or your data, email the address above.

2. What we collect and why

We only collect the data needed to run the service. For each situation below we set out the data involved, why we need it, and the legal basis under Article 6 GDPR.

When you buy a CRO audit

  • Data: your full name, email address, website address and the details of your order. Payment is processed by Stripe on Stripe’s own checkout page. We never receive or store your card number.

  • Purpose: to take payment, issue your receipt, deliver the audit and keep the accounting records we are legally required to keep.

  • Legal basis: performance of a contract (Article 6(1)(b)) and compliance with legal obligations such as tax law (Article 6(1)(c)).

When you complete the audit brief

  • Data: your name, email, store URL, target customer, conversion goal, traffic mix, any notes you add, and the Stripe checkout session reference used to match the brief to your order.

  • Purpose: to scope and carry out your audit.

  • Legal basis: performance of a contract (Article 6(1)(b)).

While we carry out your audit

  • We review the public pages of your website and record a screen-capture video walkthrough of it. If you choose to share analytics access or reports, we use them only for your audit and remove our access when it is delivered.

  • Your website may contain personal data of your own customers (for example in reviews). We do not extract or store that data and we act only on your instructions in relation to it.

When you contact us

  • Data: your name, email address and the content of your message.

  • Purpose: to respond to you and keep a record of our correspondence.

  • Legal basis: legitimate interest in handling enquiries (Article 6(1)(f)) or performance of a contract where you are a customer.

When you visit the website

  • Our hosting provider, Framer, processes technical data such as your IP address, browser type and the pages you request in order to serve the site securely and keep server logs for a short period. Legal basis: legitimate interest in running a secure website (Article 6(1)(f)).

  • We use Framer’s privacy-friendly analytics to understand aggregate traffic (page views, referrers, countries). It does not use cookies or build a profile of you.

  • We use Microsoft Clarity to understand how the site is actually used. It records a playback of your visit - the pages you view, clicks, scrolling and mouse movement - and builds heatmaps from it, so we can find and fix the parts of the site that confuse people. Clarity masks the content of form fields, so what you type is not captured. It loads only after you accept optional cookies. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.

3. Cookies and similar technologies

croaudits.io uses two optional tools that set cookies: Microsoft Clarity, which shows us how visitors move through the site, and the Reddit advertising pixel, which lets us measure how well our Reddit ads work. Neither one is loaded until you accept optional cookies in the banner, never before. If you decline, no analytics or advertising cookies are set and the site stores only strictly necessary information in your browser, such as your cookie-banner choice, which needs no consent under the ePrivacy rules.

When you proceed to checkout you are taken to a page operated by Stripe. Stripe sets cookies on its own domain for fraud prevention and to operate the checkout. These are governed by Stripe’s cookie policy, not ours.

You can withdraw your consent at any time by clearing this site’s data in your browser, which brings the banner back. If we add further analytics or marketing tools, we will ask for your consent through the same banner before they are loaded, and this section will be updated.

4. Who we share your data with

We never sell your personal data. We share it only with the service providers we need to run the business, each of which processes data on our behalf under a data processing agreement:

  • Stripe Payments Europe Ltd (Dublin, Ireland) – payment processing, receipts and fraud prevention. Stripe is an independent controller for the payment data it collects at checkout.

  • Framer B.V. (Amsterdam, Netherlands) – website hosting, form submissions and analytics.

  • Microsoft Ireland Operations Ltd (Dublin, Ireland) – Microsoft Clarity, the session-recording and heatmap tool described above, and only if you accept optional cookies. Microsoft is an independent controller for that data.

  • Reddit Ireland Ltd (Dublin, Ireland) – advertising measurement, and only if you accept advertising cookies. The Reddit pixel tells Reddit that a visit or purchase happened so we can measure our ads. Reddit is an independent controller for that data.

  • Our email and productivity provider – for sending and receiving email and storing documents.

  • Video hosting and file-sharing services – used to deliver your audit video, report and checklist.

  • Our accountant and, where required, the Irish Revenue Commissioners – for bookkeeping and tax compliance.

We may also disclose data where the law requires it, or to protect our rights, for example in the event of a payment dispute.

5. International transfers

We are based in Ireland and store data in the European Economic Area wherever possible. Some of our providers (for example Stripe, Framer, Microsoft and Reddit) may process data in the United States or other countries outside the EEA. Where that happens, the transfer is protected by an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses together with appropriate additional safeguards.

6. How long we keep your data

  • Orders, receipts, briefs and audit deliverables: 6 years after the end of the tax year in which the order was placed, as required by Irish tax law.

  • Marketing emails: until you unsubscribe. We keep a minimal suppression record afterwards so we do not email you again.

  • General correspondence: up to 24 months after the matter is closed.

  • Server logs and analytics: handled by Framer under its own short retention periods.

When data is no longer needed we delete it or anonymise it.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy,

  • have inaccurate data corrected,

  • have your data erased where there is no longer a good reason to keep it,

  • restrict how we use your data in certain circumstances,

  • receive the data you gave us in a portable format,

  • object to processing based on our legitimate interests, including direct marketing at any time, and

  • withdraw consent at any time where consent is the basis for processing.

To exercise any of these rights, email bryan@croaudits.io. We respond within one month. We may ask you to confirm your identity first.

If you are unhappy with how we handle your data you can complain to the Irish supervisory authority, the Data Protection Commission (dataprotection.ie), or to the supervisory authority in the EU country where you live or work.

8. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS) across the site, payment handling by a PCI-DSS Level 1 provider, two-factor authentication on the accounts we use, and access limited to the person carrying out your audit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Children

Our services are intended for businesses and for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows when it was last revised. Significant changes will be highlighted on this page, and where appropriate we will notify existing customers by email.

11. Contact

Bryan Gehrke, trading as CROaudits · Clogherane, Lauragh, Killarney, Co. Kerry, Ireland · bryan@croaudits.io