Privacy Policy
Effective date: 30 September 2026
This policy explains how Crowie s. r. o. processes personal data when you visit namiru.ai, when you use Namiru as a customer, and when you chat with a Namiru assistant on a customer's website.
- Controller
- Crowie s. r. o.
- Registered office
- Lipovník 187, 049 42 Lipovník, Slovakia
- Company ID and VAT
- IČO 53 098 391, VAT ID SK2121269051
- Registration
- Business Register of the Municipal Court Košice, section Sro, insert no. 55334/V
- Privacy contact
- patrik@namiru.ai
1. Our two roles
We are the controller for our website, customer accounts, billing, support and our own marketing.
When a business adds the Namiru chat to its website, that business is the controller of its visitors' data. We process that data only on its instructions, under our Data Processing Agreement. If you chatted on a website that uses Namiru, please contact that website first; we help it answer your request.
2. What we process, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, email, password hash or Google sign-in, language, plan | Provide the service and secure your account | Contract (Art. 6(1)(b) GDPR) |
| Billing data: company details and invoices. Card details are handled by Stripe and never reach us. | Payments, invoices and tax records | Contract; legal obligation (Art. 6(1)(c)) |
| Your content: website pages we read for you, files, knowledge and assistant settings | Build and run your assistant | Contract |
| Support messages and chats with our own support assistant | Answer you and improve the service | Contract; legitimate interest (Art. 6(1)(f)) |
| Website analytics without cookies: pages viewed, referrer, campaign source, approximate country and a keyed hash of your IP address | Understand how the site is used and count signups | Legitimate interest |
| Analytics and ad measurement: Google Analytics, Google Ads and the OpenAI Ads Measurement Pixel, including SHA-256 hashes of your email and account ID for matching | Measure our marketing | Consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie Preferences |
| Security logs: IP address, browser details and security events | Protect the service against abuse | Legitimate interest |
| Business contact details from public websites and directories | Offer Namiru to businesses | Legitimate interest. You can object at any time and we stop. |
Account data: name, email, password hash or Google sign-in, language, plan
- Purpose
- Provide the service and secure your account
- Legal basis
- Contract (Art. 6(1)(b) GDPR)
Billing data: company details and invoices. Card details are handled by Stripe and never reach us.
- Purpose
- Payments, invoices and tax records
- Legal basis
- Contract; legal obligation (Art. 6(1)(c))
Your content: website pages we read for you, files, knowledge and assistant settings
- Purpose
- Build and run your assistant
- Legal basis
- Contract
Support messages and chats with our own support assistant
- Purpose
- Answer you and improve the service
- Legal basis
- Contract; legitimate interest (Art. 6(1)(f))
Website analytics without cookies: pages viewed, referrer, campaign source, approximate country and a keyed hash of your IP address
- Purpose
- Understand how the site is used and count signups
- Legal basis
- Legitimate interest
Analytics and ad measurement: Google Analytics, Google Ads and the OpenAI Ads Measurement Pixel, including SHA-256 hashes of your email and account ID for matching
- Purpose
- Measure our marketing
- Legal basis
- Consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie Preferences
Security logs: IP address, browser details and security events
- Purpose
- Protect the service against abuse
- Legal basis
- Legitimate interest
Business contact details from public websites and directories
- Purpose
- Offer Namiru to businesses
- Legal basis
- Legitimate interest. You can object at any time and we stop.
3. The chat on our customers' websites
We act as a processor here. This is what the Namiru chat does:
- Before a visitor opens the chat, it loads its look from our servers and stores nothing on their device. Website owners can also use a click-to-load button, so nothing loads until the visitor clicks.
- Once the chat is open, it stores a random visitor ID for 30 days after the last chat and a session ID for the current tab, so the conversation can continue.
- Messages are sent to our AI providers to write replies and a short summary for the website owner. The chat shows a note that replies are sent by AI.
- The visitor's IP address is used for security and to work out the country on our own servers. Chat records keep only a keyed hash of it.
- Contact details the visitor chooses to share, such as name, email or phone, go to the website owner.
- Website owners can view, export and delete conversations.
4. AI processing
Replies are generated through OpenRouter, Inc. (USA), which routes each request to the model provider. The chat model is run by Alibaba Cloud (Singapore, with data centres in Singapore and China). Conversation summaries use a model run by providers that OpenRouter selects, which may be outside the EU.
We do not use conversations to train models of our own. No decision with legal or similarly significant effect is made about anyone by automated means alone.
5. Where data is stored
Customer data is stored and hosted on servers in the European Union, at Hetzner in Germany. AI responses are generated through model-provider APIs as described above, under those providers' data usage terms. The visitor's country is worked out on our own servers from a local copy of the DB-IP Lite database (IP Geolocation by DB-IP), so IP addresses are not sent to lookup services.
6. Who receives data
We use these processors:
- Hetzner Online GmbH (Germany): hosting of our servers and databases
- OpenRouter, Inc. (USA) and selected model providers, including Alibaba Cloud (Singapore), for AI response generation
- Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA): payments. When the checkout shows a purchase as sold through Link, a Stripe service, Link is the seller (merchant of record) and handles the payment, tax, receipts and invoices under its own terms and privacy policy.
- Google Ireland Limited and Google LLC: Google sign-in, and Google Calendar or Drive when you connect them
- Google Analytics, Google Ads and OpenAI Ads Measurement Pixel, only if you consent to analytics cookies. OpenAI conversion matching may use SHA-256 hashes of your normalized email address and internal account ID; raw values are not sent through these matching fields.
- Instantly (USA): sending our business outreach emails
- Notification services you choose to connect, such as Slack, Discord, Telegram, WhatsApp, Messenger or browser push services
We disclose data to authorities only where the law requires it. Each provider also has its own privacy policy.
7. Transfers outside the EU
Some providers above are in the USA, Singapore or China. We rely on the EU-US Data Privacy Framework where a US provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
8. How long we keep data
We keep personal data only as long as it is needed:
| What | How long |
|---|---|
| Account and your content | Until you delete your account; deletion is immediate in our live database |
| Conversations, leads and bookings of your assistants | Until you delete them or your account |
| Chat visitor ID in the browser | 30 days after the last chat |
| Chat message logs | 90 days |
| Security events | 180 days |
| Website analytics | 13 months |
| Billing records | 10 years, as Slovak accounting law requires |
| Your cookie choice | Until you change it |
Account and your content
- How long
- Until you delete your account; deletion is immediate in our live database
Conversations, leads and bookings of your assistants
- How long
- Until you delete them or your account
Chat visitor ID in the browser
- How long
- 30 days after the last chat
Chat message logs
- How long
- 90 days
Security events
- How long
- 180 days
Website analytics
- How long
- 13 months
Billing records
- How long
- 10 years, as Slovak accounting law requires
Your cookie choice
- How long
- Until you change it
Deleted data can remain in database backups until those backups are deleted.
9. Cookies and browser storage
We use essential cookies and browser storage to operate the Service. Optional analytics and ad measurement technologies (Google Analytics and OpenAI Ads Measurement Pixel), and the campaign source of your visit, are only stored after you accept analytics under Cookie Preferences.
| Name | Purpose | Type |
|---|---|---|
| namiru_user_session, namiru_admin_session and short-lived sign-in security cookies | Keep you signed in and protect Google sign-in | Essential |
| cookieConsent, gaConsent | Remember your cookie choice | Essential |
| theme, namiru-ui-language | Remember a theme or language you picked | Preference |
| temp-crawl-session | Continue a website scan you started | Essential |
| affiliateLink, currentBlogId, currentBlogSlug, funnel-session-token, namiru-pending-registration-conversion | Campaign source and visit analytics | Analytics, with consent only |
| Google Analytics and OpenAI pixel cookies | Usage and ad measurement | Analytics, with consent only |
| namiru_visitor_id, namiru_visitor_id_expires, namiru-chat-session, namiru-ai (chat on customer websites) | Continue a chat the visitor opened and remember a dismissed greeting | Essential for the chat, set only after the visitor opens it |
namiru_user_session, namiru_admin_session and short-lived sign-in security cookies
- Purpose
- Keep you signed in and protect Google sign-in
- Type
- Essential
cookieConsent, gaConsent
- Purpose
- Remember your cookie choice
- Type
- Essential
theme, namiru-ui-language
- Purpose
- Remember a theme or language you picked
- Type
- Preference
temp-crawl-session
- Purpose
- Continue a website scan you started
- Type
- Essential
affiliateLink, currentBlogId, currentBlogSlug, funnel-session-token, namiru-pending-registration-conversion
- Purpose
- Campaign source and visit analytics
- Type
- Analytics, with consent only
Google Analytics and OpenAI pixel cookies
- Purpose
- Usage and ad measurement
- Type
- Analytics, with consent only
namiru_visitor_id, namiru_visitor_id_expires, namiru-chat-session, namiru-ai (chat on customer websites)
- Purpose
- Continue a chat the visitor opened and remember a dismissed greeting
- Type
- Essential for the chat, set only after the visitor opens it
You can change your choice at any time under Cookie Preferences at the bottom of every page.
10. Your rights
Under the GDPR, you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict processing, including direct marketing
- Data portability
- Withdraw consent at any time
To exercise these rights, contact us at patrik@namiru.ai.
We answer within one month. You can also complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk) or to the authority where you live.
11. Security
We encrypt data in transit with TLS, store the credentials you give us for data feeds, webhooks and notification channels encrypted (AES-256-GCM), limit access to production systems, hash IP addresses with a secret key and review the service regularly for security issues.
12. Changes to this policy
We may update this Privacy Policy from time to time. Significant changes will be communicated via the Service or email.
13. Contact
For privacy-related questions, contact us at patrik@namiru.ai.