Privacy Policy

This policy explains which personal data Intrawebix SRL, company ID 1025600049858, registered in the Republic of Moldova (“we”), processes through the CRM service and what rights you have. The Service is used by customers in several countries. We comply with the applicable data protection law: the law of the Republic of Moldova (Law no. 195/2024 on personal data protection), Regulation (EU) 2016/679 (GDPR) for individuals in the European Union and the European Economic Area, the UK GDPR for the United Kingdom, and US state privacy laws that grant rights over personal data (for example the CCPA/CPRA in California).

1. Our role

• For account data (CRM users and their organizations) we are the controller.
• For data that organizations enter into the CRM (their customers and partners) we are a processor: we process it only on the organization’s instructions, to provide the service. That organization is the controller of this data and handles requests from data subjects.

2. Data we process

• Account: name, email, language, password (only irreversibly hashed), two-step verification settings.
• Security and operation: IP address and time of sign-in attempts, sessions, log of administrative actions.
• Subscription: plan, payment status, customer identifiers at the payment processor (we do not store card details).
• Connected integrations: encrypted access details for the mailbox or messaging channels chosen by the organization.

Company data from public registers. To fill in a company record from its tax code, the application uses public data about companies: the name, legal form, tax or VAT code, address, activity and status. The sources are the State Register of Legal Entities and Individual Entrepreneurs of the Republic of Moldova (Public Services Agency, open data from date.gov.md), Romania's National Agency for Fiscal Administration (ANAF), the European Commission's VIES system and Companies House in the United Kingdom. For individual entrepreneurs, sole traders and other forms without legal personality, the name may contain a person's name. We do not collect data about directors, founders or beneficial owners, and we do not publish this data: only the CRM user who looks up a specific code sees it, and what they save in a record becomes their organization's data (section 1). The legal basis is our customers' legitimate interest in correctly identifying their business partners, the same purpose for which the registers are public. We update the Moldovan register with each new publication by the Public Services Agency and keep data from the other sources for at most 7 days. You can object to this processing by writing to [email protected].

3. Purposes and legal bases

• providing the service and the account (performance of contract);
• security: preventing unauthorized access, limiting sign-in attempts (legitimate interest);
• billing and accounting obligations (contract, legal obligation);
• account communications: password reset, invitations, service notices (contract).

We do not use data for advertising and we do not sell it.

4. Who we share data with

• Cloudflare (USA, global network): all traffic to the application passes encrypted through its network (HTTPS, attack protection); it also sends service emails and checks public forms against bots (Turnstile);
• DeBounce (application servers in the EU, according to them): when you sign up with an email, it receives only the address you entered, so we can reject non-existent or disposable addresses before sending the code; they do not keep the address after responding;
• Leaseweb (Germany): the provider of the servers the application runs on;
• payment processors: Paddle (United Kingdom; Merchant of Record for subscriptions) and maib (Republic of Moldova, for payments in lei), only for payments;
• Anthropic (USA): the AI assistant, only if your company turned it on; it receives only the data in a user's request (for example the record they ask to summarize) and does not use it to train models;
• Google (USA), only if you choose “Continue with Google”: it confirms your name, email address, profile picture (if any) and Google account identifier; your Google password never reaches us;
• Google Calendar, only if you connect it in your Profile: your dated activities (title, time, location, description, client name) are written to a “CRM” calendar we create in your Google account, and events in that calendar are read back into the CRM; we cannot see your other calendars. Data received from Google is used only for this sync, in accordance with the Google API Services User Data Policy, including the Limited Use requirements: we do not sell it or use it for advertising or to train AI models. You can revoke access at any time from your Profile or your Google account;
• Microsoft (Microsoft Ireland Operations Limited; Microsoft Corporation, USA), only if you choose “Continue with Microsoft” or connect your Outlook / Microsoft 365 mailbox or Outlook calendar in your Profile: at sign-in it confirms your name, email address, profile picture (if any) and account identifier (your password never reaches us); a connected mailbox is read and sends mail over IMAP / SMTP only for correspondence with CRM records; calendar: your dated activities are written to a “CRM” calendar we create in your account, its events are read back, and from your main calendar we read only busy times (for the booking page). We keep only the refresh token for that access, encrypted; you can withdraw access at any time in your Profile or in your Microsoft account (Apps). The transfer to the USA relies on the EU–US Data Privacy Framework;
• services connected by the organization (Meta – WhatsApp / Instagram / Messenger, Telegram, Viber, the telephony provider chosen by the organization, the organization’s mail server), only at its request;
• authorities, when the law requires it.

5. Where and how we store data

Data is hosted on servers in Germany (European Union), with the provider Leaseweb. Daily backups and a replica of the database, used for disaster recovery, are kept on our server in the Republic of Moldova. We use encrypted connections (HTTPS), irreversibly hashed passwords, encryption of integration credentials, strict separation of data between organizations, server access only through a private network, automatic security updates and daily backups outside the data centre.

International transfers. The Service runs in the European Union (Germany). Backups, the replica and administration of the Service take place in the Republic of Moldova, so for customers in the European Union, the European Economic Area or the United Kingdom part of the processing happens outside those areas; transfers rely on the European Commission’s standard contractual clauses, included in the data processing agreement available on request at [email protected]. Cloudflare and Paddle also process data outside the EU (United States, United Kingdom), under adequacy decisions (including the EU–US Data Privacy Framework) or standard contractual clauses; the messaging services chosen by the organization under their own safeguards. For customers in the Republic of Moldova, data is hosted in the European Union, whose level of protection is recognized as adequate under the law of the Republic of Moldova.

6. How long we keep data

• account and CRM data: while the organization’s account is active; after the account is closed it is deleted from the application within 30 days, and from backups within at most another 30 days, through their normal rotation;
• security logs: up to 12 months;
• billing documents: as long as accounting law requires.

7. Your rights

Under Law No. 195/2024 and the GDPR, you have the following rights:

• the right to be informed about the processing of your data;
• the right of access to your data;
• the right to rectification;
• the right to erasure (“right to be forgotten”);
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing;
• the right not to be subject to a decision based solely on automated processing (we make no such decisions).

Where processing is based on your consent, you may withdraw it at any time, as easily as you gave it; withdrawal does not affect processing carried out before it.

You have the right to lodge a complaint with the supervisory authority in your country: in the Republic of Moldova, the National Center for Personal Data Protection (CNPDCP, datepersonale.md); in the EU or EEA, your national authority (in Romania, ANSPDCP); in the United Kingdom, the ICO. You may also go to court.

US residents (California — CCPA / CPRA — and other states with consumer privacy laws). In the past 12 months we have collected these categories defined by those laws: identifiers (name, email, phone, IP address), commercial information (plan and payments — card details stay with the payment processor), internet activity (access logs, pages visited on our website) and professional information (company, role). We get them from you, from your browser and from services you choose to connect, and use them only for the purposes in section 3; retention periods are in section 6. We do not collect sensitive personal information other than account login credentials, used only to give you access.

We do not sell personal information and do not share it for cross-context behavioural advertising. The Google Ads and Meta tags on the public pages only measure whether a sign-up came from one of our ads and load only with your consent (section 8; the Meta pixel runs in “Limited Data Use” mode for US states); we honour the browser’s Global Privacy Control signal as a refusal. We do not sell or share the personal information of anyone under 16.

You have the right to know what personal information we hold about you (categories, sources, purposes and the specific pieces), to request its correction, deletion or a portable copy, and not to be discriminated against (price, quality of service) for exercising your rights. You or an agent you have authorised in writing can send a request to [email protected]; to protect your data we verify your identity (usually from the account’s email address). We respond within 45 days (extendable once by another 45, with notice). If we deny a request we tell you why, and you can appeal by writing to the same address; we answer appeals within 45 days, and if you are not satisfied you may contact your state’s Attorney General.

Data that an organization enters into its CRM we process as that organization’s service provider (processor), only on its instructions; requests about that data go to the organization.

For data in an organization’s CRM, contact that organization; we pass the request on and help them answer. Write to us at [email protected]; we reply within the deadlines set by the law that applies to you.

8. Cookies and statistics

We use a strictly necessary cookie for the sign-in session and local storage of display preferences (language, theme). For aggregate visit statistics we use Cloudflare Web Analytics, which uses no cookies and does not track visitors across sites.

Ad measurement, only with your consent. On the public pages (home, pricing, sign-up) we ask for your consent to the Google Ads tag (Google Ireland Limited; Google LLC, USA). Only if you accept does the tag set Google cookies that tell us whether a sign-up came from a click on one of our ads (the click identifier, date and page). We do not send Google your name, email or any CRM data. If you decline, the tag is not loaded at all; you can change your choice at any time under “Cookie settings” at the bottom of the home page. The legal basis is your consent; Google processes this data under its own policy (policies.google.com/privacy), and the transfer to the USA relies on the EU–US Data Privacy Framework. Inside the app, after you sign in, no advertising tag is loaded.

The Meta pixel, also only with your consent. The same consent also loads the Meta pixel (Meta Platforms Ireland Limited; Meta Platforms, Inc., USA), which tells us whether a visit or a sign-up came from one of our ads on Facebook or Instagram (the click identifier, date, page and the “sign-up” event). We do not send Meta your name, email or any CRM data, and we do not use automatic collection of form fields. If you decline, the pixel is not loaded. Meta processes this data under its own policy (facebook.com/privacy/policy), and the transfer to the USA relies on the EU–US Data Privacy Framework.

9. Changes

A new version of this policy is published in the application with its publication date; users are informed at their next sign-in.

Last updated: 24.10.2026 (version 1)