Privacy Policy

Last updated October 13, 2026

This policy explains how [Company legal name] (“we”, “us”) handles personal data in Redock CRM (the “Service”). It covers two kinds of data:

  • Account data about our customers and their team members. We are the controller of this data.
  • Contact data that customers upload or collect about their own subscribers and contacts. The customer is the controller and we process it only on their instructions, as their processor.

1. Data we collect

Account data: name, email address, password (stored hashed), timezone, profile photo, workspace and team membership, roles, and two-factor settings. Billing details (plan, subscription status, invoice amounts, card brand and last four digits) come from our payment partner; we never receive or store full card numbers.

Usage and security data: IP address, browser and device information, sign-in times, actions recorded in the audit log, and API/MCP token usage.

Contact data (on behalf of customers): whatever fields a customer stores about their contacts, such as email address, name, company and custom fields, plus email engagement events (deliveries, opens, clicks, bounces, unsubscribes, complaints) and form submissions.

2. How we use account data

  • To provide, secure and support the Service, including verifying email addresses, preventing abuse and spam, and enforcing plan limits.
  • To process payments and send receipts, invoices and service notices.
  • To improve the Service using aggregated, non-identifying usage information.
  • To comply with legal obligations and respond to lawful requests.

Our legal bases are performance of our contract with you, our legitimate interests in running a secure and reliable service, and compliance with law. We do not sell personal data, and we do not use contact data for our own marketing.

3. Email tracking

When a customer enables tracking, emails sent through the Service may include a small image to record opens and rewritten links to record clicks. We record the time, approximate location derived from IP address, and device/email client of these events for the customer. Recipients can unsubscribe or manage preferences through the link in every marketing email.

4. Cookies

The app uses essential cookies only: a secure session cookie to keep you signed in and a cookie remembering your current workspace. We do not use advertising cookies. Embedded signup forms may store a small flag in the visitor’s browser so a pop-up isn’t shown again after it was dismissed or submitted.

5. Sub-processors and sharing

We share data only with service providers that help us run the Service, under contracts that protect it:

  • Hosting and infrastructure for the application, databases, backups and our managed sending servers.
  • Lemon Squeezy for payments, invoicing and tax (merchant of record).
  • Error monitoring (when enabled), which receives technical error reports with personal data scrubbed.
  • Email providers you connect (for example Amazon SES, SendGrid or Mailgun) when you choose to send through them, and integrations you enable such as WordPress.

We may disclose data if required by law, or to protect the rights, safety and security of our customers, recipients or us.

6. International transfers

Data may be processed in countries other than yours. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. Retention

We keep account data while your account is active and delete it after you delete your account, except for records we must keep for legal, tax or accounting reasons (such as invoices) and limited security logs. Customers control how long contact data is kept and can delete contacts at any time; contact data is deleted when the workspace is deleted. Backups roll off on a fixed schedule.

8. Security

We protect data with encryption in transit (HTTPS), encryption of stored credentials and secrets, hashed passwords, optional two-factor authentication, role-based access controls, workspace isolation, audit logging and regular backups. No system is perfectly secure; if a breach affects your personal data we will notify you as required by law.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a data-protection authority. You can download your account data and delete your account from your profile settings, or contact us at privacy@[your-domain].

If you are a contact of one of our customers (for example, you received a newsletter sent through the Service), please contact that sender directly; you can always unsubscribe through the link in their emails. We will help our customers respond to your request.

10. Children

The Service is not directed to children and we do not knowingly collect their personal data.

11. Changes and contact

We may update this policy and will notify you of material changes by email or in the app. Questions or requests: privacy@[your-domain] · [Company legal name], [Registered address].

See also our Terms of Service.

See also our Terms of Service.