1. Data controller
The controller of your personal data is SalesDots (“SalesDots”, “we”). For anything about personal data, write to [email protected].
This policy covers processing where we decide the purposes and means. Data that customers put into the SalesDots app (e.g. contacts, notes, meeting recordings) we process on the customer’s behalf as a processor — see section 6.
2. What data, why and for how long
| Situation | Data | Legal basis | Retention |
|---|---|---|---|
| Visiting the website | IP address, browser and device type, pages requested, time of visit (server and attack-protection logs) | Legitimate interest: running and securing the website (Art. 6(1)(f) GDPR) | Short-term, in our hosting and protection providers’ logs |
| Visit statistics | Aggregated page-view data: page, referrer, country, device type — without cookies (Vercel Web Analytics) | Legitimate interest: improving the website (Art. 6(1)(f)) | Aggregated |
| Error monitoring | Technical error data: browser, page address, error trace; in the app also the account ID (no name or e-mail) | Legitimate interest: finding and fixing errors (Art. 6(1)(f)) | According to the retention set in Sentry |
| Session recordings (Session Replay) | A record of your interaction with the page: clicks, scrolling, page changes | Your consent — “Analytics” category (Art. 6(1)(a)) | Until you withdraw consent; recordings per Sentry retention |
| Visitor company identification (ZoomInfo WebSights) | IP address and pages visited, from which ZoomInfo determines the company network the visit comes from | Your consent — “Marketing” category (Art. 6(1)(a)) | Until you withdraw consent |
| Demo or offer request, contact form | Name, work e-mail, phone (optional), company, number of users, chosen packages and modules, message, language, page, the consent text you agreed to, a hash of your IP address | Steps at your request before a contract (Art. 6(1)(b)) and legitimate interest: replying and B2B sales contact (Art. 6(1)(f)) | Up to 24 months after the last contact, unless we sign a contract |
| Newsletter | E-mail, name, company (if given), subscription confirmation and IP address at sign-up, open and click statistics | Your consent (Art. 6(1)(a) GDPR; Polish Act on Providing Electronic Services, Art. 10) | Until you unsubscribe or withdraw consent |
| App account | Name, e-mail, phone and photo (if added), role, language, last login, security settings (e.g. 2FA) | Performance of the contract with your organisation (Art. 6(1)(b) and (f)) | While the account exists; after an organisation is deleted its archive copy is erased within 30 days |
| App security | Activity log (event, IP address, browser), personal-data access log, security events | Legitimate interest: security and accountability (Art. 6(1)(f)) | Activity log 180 days; security events 180 days; personal-data access log 90–365 days |
| Billing | Invoice data and payment history | Legal obligation (Art. 6(1)(c)) — tax and accounting law | 5 years from the end of the tax year |
| Legal claims | Data needed for the matter | Legitimate interest (Art. 6(1)(f)) | Until limitation periods expire |
Providing data is voluntary. Without the fields marked as required we cannot answer a request, send the newsletter or run an account.
3. Data from official registers (Art. 14 GDPR)
SalesDots helps companies check counterparties and the public-procurement market. For this we process data about people holding positions in companies that has been published in official, publicly available sources.
- Who
- Management and supervisory board members, commercial proxies, partners and shareholders, beneficial owners, officers and directors of foreign companies.
- What data
- Name, position, company, appointment and resignation dates; where the register publishes them — e.g. year of birth, nationality, shareholdings.
- Sources
- Polish National Court Register (KRS), Central Register of Beneficial Owners (CRBR), REGON register, GLEIF, UK Companies House and other business registers, public-procurement notices, listed-company reports.
- Purpose and basis
- Counterparty verification and market analysis by our customers — our and our customers’ legitimate interest (Art. 6(1)(f) GDPR). We do not build profiles of people for consumer marketing.
- Retention
- As long as the data is publicly available at the source and needed for the purpose; we update it when we read the register again.
4. Who receives data
We do not sell personal data. We use providers that process data on our behalf under data-processing agreements, only as far as needed to run the service:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, files | EU — Frankfurt |
| Vercel | Hosting www.salesdots.ai, cookie-free visit statistics | Server functions in the EU (Frankfurt); global content delivery network |
| Cloudflare | Attack and bot protection (Turnstile), content delivery network | Global network |
| Lovable | Hosting the app interface | Global network |
| Sentry (Functional Software) | Error monitoring, session recordings with consent | EU — Frankfurt |
| Resend | Sending e-mails (notifications, newsletter) | EU — Ireland (sending); US company |
| OVH | @salesdots.ai mailboxes | EU |
| AI model providers: OpenAI, Google, Perplexity — via our AI gateway odnoga | AI features in the app: document analysis, summaries, research | USA |
| AssemblyAI, ElevenLabs | Transcribing meeting recordings and voice notes | USA |
| Tavily, Serper, SerpAPI, GNews | Web search for company information | USA |
| Google, Microsoft | Signing in to the app, if you choose it | Under their terms |
| HubSpot, Gmail | Integrations your organisation connects itself | Under their terms |
| ZoomInfo | Visitor company identification — with consent only | USA; ZoomInfo also processes data for its own purposes |
We may also disclose data to public authorities where the law requires it, and to legal and accounting advisers bound by professional secrecy.
5. Transfers outside the European Economic Area
We store the database, sign-in data and files in the EU (Frankfurt). Some providers in section 4 are based in the USA or process data outside the EEA. Such transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for providers certified under it, or on the Commission’s standard contractual clauses (Art. 46 GDPR).
You can obtain a copy of these safeguards by writing to [email protected].
6. Data in the app — when we act for the customer
An organisation that uses SalesDots is the controller of the data it puts into the app: contacts, stakeholders, notes, e-mails, meeting recordings and transcripts. We process that data only on its instructions, under a data-processing agreement (Art. 28 GDPR).
- Audio recordings are deleted after transcription; unprocessed ones within 72 hours at the latest, unless the user chooses to keep them.
- We do not use customer data to train AI models.
- When the contract ends we delete the organisation’s data; the archive copy is erased within 30 days.
If your data reached SalesDots through one of our customers (e.g. you are their business contact), please contact that organisation about your rights. We will help them fulfil your request.
7. Your rights
- Access to your data and a copy of it (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Portability of data processed on the basis of consent or contract (Art. 20)
- Objection to processing based on legitimate interest — and at any time to direct marketing (Art. 21)
- Withdrawal of consent at any time, without affecting the lawfulness of earlier processing — e.g. via “Cookie settings” in the site footer or the unsubscribe link in the newsletter
To exercise your rights, write to [email protected]. We reply without undue delay and within one month at the latest. We may ask for information needed to confirm your identity.
You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your country.
8. Automated decision-making
We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Scores and recommendations generated in the app concern tenders and companies and support decisions made by people.
10. Security
We protect data with, among other things, database-level isolation of each organisation’s data, encrypted connections, masking of personal data in admin panels and a log of every access to it. Details: www.salesdots.ai/security.
11. Changes to this policy
We update this policy when our services, providers or the law change. The current version is always on this page, with its effective date at the top. We inform customers of material changes by e-mail.
Questions about personal data?
We reply without undue delay, within one month at the latest.
Write to [email protected]