Privacy policy

Criba is a consumer site where people who work or worked at software companies write reviews about that employer. This policy explains what personal data we process and why. It is not legal advice.

What we store

• Your account: your Google identifier (sub) and your email address. We use these to identify you, let you sign in, and attach your reviews to your account. We do not request Gmail or any other sensitive Google scope. We do not store your profile photo.
• Your display name (optional): only if you set one in your profile. It is shown only on reviews you choose to sign. We never show your Google name or email on a review.
• Your reviews: the company, role area, years, scores, and any text you write. Reviews are personal data. The employment you claim is unverified.
• Requests and reports: if you ask us to add a company or report a review, we store that text and link it to your account so we can act on it.

Lawful basis

• Publishing your review: your consent. By publishing a review you consent to its content being shown publicly according to the visibility you choose (anonymous or signed).
• Running your account: necessary to provide the service you ask for.

Assistant

The assistant answers only from Criba reviews and always cites them. Its answers are generated from user-written content and may be wrong. It does not reveal who wrote a review. We do not log assistant conversations together with names or emails.

Processors and international transfers

To generate the assistant's answers and semantic search over reviews, we send review text to OpenAI, L.L.C. (United States), which acts as our data processor. This transfer outside the European Economic Area relies on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as applicable. We use the OpenAI API, whose current terms exclude this data from being used to train their models. We also use hosting and infrastructure providers to run the site, who process data only on our behalf and instructions.

Retention and deletion

You can delete your account at any time from your profile. Deleting your account also permanently deletes your reviews (including the internal representations the assistant uses). We do not keep an anonymised copy of the text.

Negative reviews

We do not remove negative reviews at a company's request. We do remove illegal content (for example, content that identifies a specific individual, defamation, harassment, or spam) via the report form.

Cookies

We use only a session cookie (HTTP-only) to keep you signed in. No marketing or third-party analytics cookies. See the cookies page.

Your rights

You can access, correct, delete, or port your data (receive your reviews in a structured format), and withdraw consent. For access and basic correction, use your profile and the review edit form; for anything else, contact us. If you are in Spain you may also complain to the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

Data controller and contact

The data controller is Rocío García Luque (Spanish tax ID 05304893N), address Galapagar, Madrid, España. You can reach us at info@criba.dev to exercise your rights or with any question about this policy.