Privacy policy

This privacy policy explains how Chronic Agency S.R.L. (“Chronic”, “we”) collects, uses, and shares personal data when you use our platform and website.

Who we are

The controller of the personal data described here is Chronic Agency S.R.L., which operates chronic.digital. We act as controller for account, billing and usage data. For the prospects your campaigns contact, we process their data to run the outreach you set up and approve.

Registered office: to be added. Company registration number: to be added.

Data we collect

• Account data. Name, email, organization, and authentication details when you sign up.
• Your business. What you tell us and what we read on your website: your offer, customers, writing examples and the people you want to reach.
• Usage data. How you interact with the Service, device and log information, and analytics.
• Prospect data. Business contact details of the people your campaigns contact: name, job title, company, work email, public profile links, and what their company publishes about itself.
• Email in your sending mailboxes. The emails sent from the mailboxes we set up for you and the replies that come back to them.
• Billing data. Handled by Stripe; we do not store full card numbers.

How we use data

• to provide, operate, and improve the Service;
• to find prospects, research them, draft and send the outreach you configure, and handle replies;
• to communicate with you about your account and provide support;
• to secure the Service, prevent abuse, and comply with legal obligations.

Prospect data and lawful basis

Prospect data comes from commercial business contact databases (AI Ark and SmartProspect), from public web pages such as company websites, and from anything you add yourself. We collect business contact details only, for business-to-business outreach.

The lawful basis is legitimate interest: contacting a person in their professional role about something relevant to their work. Every email identifies the sender, and anyone can opt out by replying. An opt-out is honored on every mailbox and channel, for good: the person is kept on a do-not-contact list so they are never contacted again. A prospect can ask us what we hold about them, or ask us to delete it, at the address below.

Reading replies

Chronic reads the replies that arrive in the sending mailboxes it set up for you, so it can stop follow-ups when someone answers, sort out-of-office and unsubscribe messages, show you the replies that matter, and draft answers for your approval. It does not read your own company mailbox.

Calendar and LinkedIn

If you connect a scheduling account (Calendly or Cal.com), Chronic reads your available times and the meeting types you choose so it can offer real times, and books the meetings prospects agree to. If you connect a LinkedIn account, Chronic uses it through Unipile to send the invites and messages your campaigns include and to read the replies. You can disconnect either at any time in Email settings; disconnecting stops all access.

Sub-processors

These vendors process personal data on our behalf. Each is bound by contractual data protection obligations.

Sharing

We do not sell personal data. We share data with the sub-processors above, when required by law, or in connection with a corporate transaction, subject to appropriate safeguards.

Analytics and cookies

We ask before we measure. Analytics cookies are set only after you allow them in the consent bar; until then, nothing about your visit is tracked client-side. If you decline, the site works exactly the same.

• ch_consent (first-party, 12 months, or 6 when declined) remembers your consent choice. Strictly necessary to honor that choice.
• ch_vid (first-party, 12 months, only with consent) is a random visitor id used for analytics and to keep any page-variant experiments consistent between visits. It contains no personal details.
• ph_* cookies (first-party, only with consent) are set by our analytics tool, PostHog, hosted in the EU (Frankfurt). With consent we collect page views, clicks, and funnel events, and record sessions on the marketing pages with all typed input masked. Session replay is off inside the product app and during onboarding, because those screens show prospects’ details. Analytics traffic is proxied through our own domain; IP addresses are not stored as profile data.
• _ga and _ga_* cookies (first-party, up to 24 months, only with consent) are set by Google Analytics on the marketing and onboarding pages. Withdrawing consent removes them and stops measurement.

When you are signed in and have allowed analytics, PostHog links your activity to your account and email address, so we can see how the product is used and help when something goes wrong.

Separately from cookies, when you have an account we keep minimal service analytics server-side (for example that your workspace was created or a subscription started) on the basis of our legitimate interest in operating and improving the Service.

You can change your mind at any time. Current choice: not decided · change your cookie choice You can also clear cookies in your browser; the consent bar will ask again on your next visit.

Retention

We retain personal data for as long as needed to provide the Service and meet legal obligations, then delete or anonymize it. Opt-outs are kept for as long as we operate, so an opted-out person is never contacted again. You can request deletion of your account data as described below.

Security

We use technical and organizational measures to protect data, including encryption in transit, access controls, and scoped credentials. No system is perfectly secure, but we work to protect your information.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing (for example under GDPR or CCPA). You can also complain to your data protection authority; in Romania that is the ANSPDCP. To exercise these rights, contact us.

International transfers

Some sub-processors are outside the European Economic Area. Where required, we use appropriate transfer mechanisms such as standard contractual clauses.

Changes

We may update this policy. Material changes will be notified through the Service or by email.

Contact

Privacy questions or requests: privacy@chronic.digital.