Privacy Policy

Information security, data rights and artificial intelligence

The sections below summarise Crimbo.AI's information security and privacy procedures. They supplement the privacy policy above and do not replace it.

Information security and compliance

Crimbo.AI maintains an information security and privacy procedures file (edition 1) effective 15 March 2026, prepared in accordance with:

• The Protection of Privacy Law, 5741-1981.
• Amendment 13 to the Protection of Privacy Law, in force since 14 August 2025.
• The Protection of Privacy Regulations (Data Security), 5777-2017.

The measures set out in those procedures include:

• Permission management and access control, so that access to the database and its systems is limited to authorised holders on a valid permissions list, alongside logging of user actions.
• Two-factor authentication (2FA) wherever the database systems can be accessed, and secured remote access only.
• Transfer of data from the database over a public network or the internet using accepted encryption methods.
• Regular cloud backups, alongside physical and environmental security of equipment and endpoints.
• Confidentiality agreements and staff training, and engagement of holders and external providers under outsourcing and data security agreements pursuant to Regulation 15.

Information security and privacy incidents are recorded in a documentation log, including notifying the database controller of the incident, the identity of the person handling it, and an update on closure.

The procedures and the database definitions document are reviewed and updated once a year by 31 December, and also upon any significant technological or organisational change or following a security incident.

Right of access and correction

Under sections 13 and 14 of the Protection of Privacy Law and the Protection of Privacy Regulations (Conditions for Inspecting Information and Procedures for Appealing a Refusal of an Inspection Request), 5741-1981, a data subject or their representative may inspect information held about them. Anyone who has inspected their information and found it to be incorrect, incomplete, unclear or out of date may request that it be corrected or deleted.

How to submit a request Access, correction and deletion requests should be sent to us by email: support@crimbo.ai

When we approach a person to obtain personal information, we inform the data subject of the purpose of collection, the identity of the database controller and how to contact them, who the information will be passed to and for what purposes, whether there is a legal obligation to provide the information and the consequences of withholding consent, as well as of the right of access and the right to request correction.

Retention, deletion and data minimisation

• We apply the excess data minimisation principle: we collect and retain only the minimum information that is relevant and necessary for the purpose of collection and for the purpose of the database.
• Once a year we assess whether the information retained in the database exceeds what is required for its purposes, in accordance with Regulation 2(c) of the Protection of Privacy Regulations (Data Security).
• Retention periods are set in accordance with the law and regulations, proper management rules and statutes of limitation.
• Information that is no longer required for the original purpose of collection or for the purpose of the database, but whose retention derives from those purposes - for example for legal proceedings or under a statutory obligation - is not considered excess information.
• Deletion of data from storage media is carried out in a manner that prevents recovery, and the destruction of storage media is documented.

Transparency and artificial intelligence

An artificial intelligence system is an automated system that infers from its input how to produce predictions, content, recommendations or decisions, and operates at varying levels of autonomy and adaptiveness. The Protection of Privacy Law applies to an AI model that stores or processes personal information, both at the training stage and in actual use.

• Any use of AI technologies follows the procedure and requires explicit approval, and any processing or analysis of sensitive data using AI is subject to control and guidance.
• Sensitive data is not shared with or transferred to third parties, including AI technology vendors, without explicit written approval.
• AI is not used to make autonomous decisions concerning organisational or user data without prior written approval; every automated action is subject to approval and control.
• Data retained as part of AI use is managed securely and encrypted.
• Only employees who have completed dedicated training on privacy and information security when using AI technologies are permitted to work with AI systems; training takes place at least once a year and is updated in line with technological and regulatory changes.

Where collection or processing relies on consent, the notice also describes how the system processes personal information - including informing the data subject that they are providing information to a bot - as well as the purposes of collection and use, the risks involved and the types of information collected.

This application uses the following AI services: Google Gemini and OpenAI. These services power features such as conversational AI, task suggestions, and automation within the Service.