Legal

Privacy Policy

Effective 4 October 2026

This policy explains what personal data we process when you visit www.salesdots.ai, contact us, subscribe to our newsletter or use the SalesDots app — and what data about people published in official registers we make available in our product.

We keep it concrete: who receives data, on what legal basis, where it is stored and for how long. Questions go to [email protected].

1. Data controller

The controller of your personal data is SalesDots (“SalesDots”, “we”). For anything about personal data, write to [email protected].

This policy covers processing where we decide the purposes and means. Data that customers put into the SalesDots app (e.g. contacts, notes, meeting recordings) we process on the customer’s behalf as a processor — see section 6.

2. What data, why and for how long

SituationDataLegal basisRetention
Visiting the websiteIP address, browser and device type, pages requested, time of visit (server and attack-protection logs)Legitimate interest: running and securing the website (Art. 6(1)(f) GDPR)Short-term, in our hosting and protection providers’ logs
Visit statisticsAggregated page-view data: page, referrer, country, device type — without cookies (Vercel Web Analytics)Legitimate interest: improving the website (Art. 6(1)(f))Aggregated
Error monitoringTechnical error data: browser, page address, error trace; in the app also the account ID (no name or e-mail)Legitimate interest: finding and fixing errors (Art. 6(1)(f))According to the retention set in Sentry
Session recordings (Session Replay)A record of your interaction with the page: clicks, scrolling, page changesYour consent — “Analytics” category (Art. 6(1)(a))Until you withdraw consent; recordings per Sentry retention
Visitor company identification (ZoomInfo WebSights)IP address and pages visited, from which ZoomInfo determines the company network the visit comes fromYour consent — “Marketing” category (Art. 6(1)(a))Until you withdraw consent
Demo or offer request, contact formName, work e-mail, phone (optional), company, number of users, chosen packages and modules, message, language, page, the consent text you agreed to, a hash of your IP addressSteps at your request before a contract (Art. 6(1)(b)) and legitimate interest: replying and B2B sales contact (Art. 6(1)(f))Up to 24 months after the last contact, unless we sign a contract
NewsletterE-mail, name, company (if given), subscription confirmation and IP address at sign-up, open and click statisticsYour consent (Art. 6(1)(a) GDPR; Polish Act on Providing Electronic Services, Art. 10)Until you unsubscribe or withdraw consent
App accountName, e-mail, phone and photo (if added), role, language, last login, security settings (e.g. 2FA)Performance of the contract with your organisation (Art. 6(1)(b) and (f))While the account exists; after an organisation is deleted its archive copy is erased within 30 days
App securityActivity log (event, IP address, browser), personal-data access log, security eventsLegitimate interest: security and accountability (Art. 6(1)(f))Activity log 180 days; security events 180 days; personal-data access log 90–365 days
BillingInvoice data and payment historyLegal obligation (Art. 6(1)(c)) — tax and accounting law5 years from the end of the tax year
Legal claimsData needed for the matterLegitimate interest (Art. 6(1)(f))Until limitation periods expire

Providing data is voluntary. Without the fields marked as required we cannot answer a request, send the newsletter or run an account.

3. Data from official registers (Art. 14 GDPR)

SalesDots helps companies check counterparties and the public-procurement market. For this we process data about people holding positions in companies that has been published in official, publicly available sources.

Who
Management and supervisory board members, commercial proxies, partners and shareholders, beneficial owners, officers and directors of foreign companies.
What data
Name, position, company, appointment and resignation dates; where the register publishes them — e.g. year of birth, nationality, shareholdings.
Sources
Polish National Court Register (KRS), Central Register of Beneficial Owners (CRBR), REGON register, GLEIF, UK Companies House and other business registers, public-procurement notices, listed-company reports.
Purpose and basis
Counterparty verification and market analysis by our customers — our and our customers’ legitimate interest (Art. 6(1)(f) GDPR). We do not build profiles of people for consumer marketing.
Retention
As long as the data is publicly available at the source and needed for the purpose; we update it when we read the register again.
You can object to the processing of data about you at any time — write to [email protected]. Once we accept the objection, we hide your data in the product.

4. Who receives data

We do not sell personal data. We use providers that process data on our behalf under data-processing agreements, only as far as needed to run the service:

ProviderPurposeData location
Supabase (on Amazon Web Services)Database, sign-in, filesEU — Frankfurt
VercelHosting www.salesdots.ai, cookie-free visit statisticsServer functions in the EU (Frankfurt); global content delivery network
CloudflareAttack and bot protection (Turnstile), content delivery networkGlobal network
LovableHosting the app interfaceGlobal network
Sentry (Functional Software)Error monitoring, session recordings with consentEU — Frankfurt
ResendSending e-mails (notifications, newsletter)EU — Ireland (sending); US company
OVH@salesdots.ai mailboxesEU
AI model providers: OpenAI, Google, Perplexity — via our AI gateway odnogaAI features in the app: document analysis, summaries, researchUSA
AssemblyAI, ElevenLabsTranscribing meeting recordings and voice notesUSA
Tavily, Serper, SerpAPI, GNewsWeb search for company informationUSA
Google, MicrosoftSigning in to the app, if you choose itUnder their terms
HubSpot, GmailIntegrations your organisation connects itselfUnder their terms
ZoomInfoVisitor company identification — with consent onlyUSA; ZoomInfo also processes data for its own purposes

We may also disclose data to public authorities where the law requires it, and to legal and accounting advisers bound by professional secrecy.

5. Transfers outside the European Economic Area

We store the database, sign-in data and files in the EU (Frankfurt). Some providers in section 4 are based in the USA or process data outside the EEA. Such transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for providers certified under it, or on the Commission’s standard contractual clauses (Art. 46 GDPR).

You can obtain a copy of these safeguards by writing to [email protected].

6. Data in the app — when we act for the customer

An organisation that uses SalesDots is the controller of the data it puts into the app: contacts, stakeholders, notes, e-mails, meeting recordings and transcripts. We process that data only on its instructions, under a data-processing agreement (Art. 28 GDPR).

  • Audio recordings are deleted after transcription; unprocessed ones within 72 hours at the latest, unless the user chooses to keep them.
  • We do not use customer data to train AI models.
  • When the contract ends we delete the organisation’s data; the archive copy is erased within 30 days.

If your data reached SalesDots through one of our customers (e.g. you are their business contact), please contact that organisation about your rights. We will help them fulfil your request.

7. Your rights

  • Access to your data and a copy of it (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Portability of data processed on the basis of consent or contract (Art. 20)
  • Objection to processing based on legitimate interest — and at any time to direct marketing (Art. 21)
  • Withdrawal of consent at any time, without affecting the lawfulness of earlier processing — e.g. via “Cookie settings” in the site footer or the unsubscribe link in the newsletter

To exercise your rights, write to [email protected]. We reply without undue delay and within one month at the latest. We may ask for information needed to confirm your identity.

You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your country.

8. Automated decision-making

We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Scores and recommendations generated in the app concern tenders and companies and support decisions made by people.

9. Cookies and similar technologies

Strictly necessary mechanisms always run. Analytics and marketing tools are switched on only after you consent in the banner. You can change your choice at any time via Cookie settings in the site footer.

NameProviderPurposeCategoryDuration
NEXT_LOCALE (cookie)SalesDotsRemembers your languageNecessary12 months
salesdots_cookie_consent (browser storage)SalesDotsRemembers your cookie choiceNecessary12 months
TurnstileCloudflareProtects forms against botsNecessaryWhile you fill in a form
__cf_bm (cookie)CloudflareTells human traffic from botsNecessary30 minutes
nudge_dismissed, status-banner-dismissed (session storage)SalesDotsRemembers messages you closedNecessaryUntil the tab is closed
Vercel Web AnalyticsVercelAggregated visit statistics — no cookies, nothing stored on your deviceNothing stored on device—
blog_session_id (session storage)SalesDotsCounts article views as one sessionAnalyticsUntil the tab is closed
Sentry Session ReplaySentryRecords sessions to understand and fix errorsAnalyticsPer Sentry
ZoomInfo WebSightsZoomInfoDetermines the company network a visit comes fromMarketingPer ZoomInfo

The SalesDots app (app.salesdots.ai) stores the sign-in session and interface preferences (e.g. sidebar state, list view) in your browser — these are necessary for it to work. Google analytics tools in the app run only on public pages and only with consent.

10. Security

We protect data with, among other things, database-level isolation of each organisation’s data, encrypted connections, masking of personal data in admin panels and a log of every access to it. Details: www.salesdots.ai/security.

11. Changes to this policy

We update this policy when our services, providers or the law change. The current version is always on this page, with its effective date at the top. We inform customers of material changes by e-mail.

Questions about personal data?

We reply without undue delay, within one month at the latest.

Write to [email protected]