Privacy

Who is responsible

The controller for this website is Tugra Örscelik, TT HandelsLogistik.

The postal address of the controller is on the imprint page. Imprint

Write to contact@reloopcrm.com with any question about your data.

When you run Reloop CRM on your own server, you are the controller of everything inside it. Your mailbox, your contacts and your deals never reach us.

Reloop Cloud

Reloop Cloud is the hosted Reloop CRM at app.reloopcrm.com. There we run the software for you, so the data in your workspace is on servers we operate. What this page says about your own install does not apply to Reloop Cloud.

For the content of your workspace, your company is the controller and we are its processor under Article 28 GDPR. That covers your mailboxes, contacts, companies, deals and everything the AI derives from them. We use that data only to run your workspace. Read the data processing agreement

For the account itself we are the controller: the name and email address of each person who signs up or signs in, the company name, the plan, the billing records and the server logs. We process them to provide the service under the contract (Article 6(1)(b) GDPR), to keep it secure (Article 6(1)(f) GDPR) and to meet our duties under tax law (Article 6(1)(c) GDPR).

To run Reloop Cloud we use these processors: Contabo for the servers and Hostinger for the backups, both in the EU. Resend sends the system email. On the plans with AI included, OpenRouter routes the calls to the AI models. TypeSafe checks briefly whether a conversation matters to your business before the AI reads it. Resend, OpenRouter and TypeSafe process data in the USA, on the basis of standard contractual clauses, and for Resend also the EU-US Data Privacy Framework. Stripe processes payments.

We keep the data of a workspace while the contract runs. A workspace you delete is deleted after one last backup. A workspace that is suspended for lack of payment is deleted after 30 days. Backups are deleted after 60 days at the latest. A sign-up that is never confirmed is deleted after 48 hours. Billing records stay as long as tax law requires.

This website

The public pages load no analytics. There is no autocapture, no session replay and no tracking script on this site.

The web server that serves these pages writes the usual server log for each request. That log is used to keep the site up and to find abuse.

If you give us your email address to hear about the hosted version, we store that address and the date you gave it. We use it to tell you when the hosted version opens. Write to contact@reloopcrm.com to have it deleted.

Signing in sets a session cookie. That cookie keeps you signed in and is needed for the app to work. There is no advertising cookie. The fonts are served from this server, so no font service is called when you open a page.

Your own Reloop CRM install

Reloop CRM reads the mailbox you connect, over IMAP, Google Workspace or Microsoft 365. It stores the messages, the contacts and the companies in the Postgres database on your server. You choose how far back the first read goes. Nothing is copied anywhere else.

The AI parts run against an API key that you hold, from OpenRouter, OpenAI or Anthropic. The text of a conversation goes to the provider you picked, under your own contract with that provider. Without a key the CRM runs with the AI parts switched off, and no text leaves your server.

What an install reports

Reloop CRM can report one event a day about itself, plus a small number of setup events and one event for a failure. It sends them to the reporting project that you set up, not to us. No key means no client, and an install that sets none is silent. The event carries counts, never a value from a row. There is no contact name, no email address, no company domain and no deal amount in it.

The identifier is a single UUID made when your database was created. It is attached to nothing else. No IP address is sent, and the receiving project drops the address at ingestion. An allowlist in the source code names every property that may be sent, and anything else is dropped before the event is built.

Set CRM_TELEMETRY_DISABLED to 1 or DO_NOT_TRACK to 1 in your .env file, then restart. Nothing is sent after that. An install that never sets a reporting key sends nothing at all.

Who else sees it

This website uses only the processors needed to run it and its email signup. We sell no data and we share none for advertising.

Your rights

You can ask what we hold about you, ask for a copy, ask for a correction and ask for deletion. You can object to a use and you can withdraw a consent you gave. Write to contact@reloopcrm.com. You can also complain to your national data protection authority.

This page reflects the current version of this website. A change to it is published here.

Contact