Privacy policy

1. Who the controller is

InnerOs Technologies OÜ, registry code 17412965, registered at Tööstuse tn 75-71, 10416 Tallinn, Estonia. For any privacy matter, write to info@innerostech.com.

2. Two different roles

• We are the controller of your account data, billing data, technical usage data and visits to our website.
• We are a processor of the conversations, contacts and notes your business brings into the CRM by connecting its accounts. Your business is the controller of that data: we process it only to provide the service and following its instructions.

If you are a contact of one of our customers (someone who wrote to them on WhatsApp or Telegram), please contact that business first. If you write to us at info@innerostech.com, we will pass your request on to them.

3. What data we process

• Account: name, email, password (stored as a hash, never in plain text), business and role, language, time zone and last sign-in date.
• Connected accounts: the WhatsApp and Telegram number or username and the session credentials needed to keep the connection alive. If you connect Google, the Calendar, Gmail and Tasks permissions you grant; their tokens are stored encrypted.
• Content: messages, attachments, contacts and groups of the connected accounts, including the history imported when connecting them; the notes, tags, tasks and reminders your team creates; and the summaries and data the AI extracts from all of it.
• Billing: plan, subscription status, invoices and amounts. Card details are collected and stored by Stripe; we never see them.
• Technical usage: access and error logs (including IP address and browser) and each business's AI usage log (feature, model and cost).
• Push notifications: if you enable them, the subscription address your browser provides.

4. Purposes and legal bases

• Providing the service you signed up for: performance of a contract (Art. 6(1)(b) GDPR).
• Charging, invoicing and keeping invoices: performance of a contract and legal obligation (Art. 6(1)(c)).
• Security, abuse prevention and support: legitimate interest (Art. 6(1)(f)).
• Service emails (verification, invitations, account notices): performance of a contract.

We do not sell data, we do not use it for advertising and we do not use it to train artificial intelligence models.

5. Artificial intelligence

The CRM uses AI to summarise conversations, translate, classify and prepare drafts. Messages to your contacts are sent by a person on your team, or go out at the time that person scheduled: the AI prepares, it does not reply on its own.

To do this we send our AI provider the text each task needs, at the moment it runs. Semantic search (Voyage AI) is off by default for every business and is only turned on if the business accepts it.

The AI also reads the photos and documents your contacts send you in private chats (payment receipts, invoices, quotes, PDFs; Word, Excel or PowerPoint files are not read for now). To read them the file is sent to our AI provider, and we keep only what the chat summary needs: what kind of document it is, a short description and, if they appear, the amount, date and description of the payment, with ID, card and bank account numbers masked. Identity documents (ID card, passport, driving licence, residence card) are not read: we only note that one was sent. For personal photos we only keep that they are a photo, without describing them.

6. Who we share data with

Only with the providers we need to run the service, who process data on our behalf:

• Hetzner Online GmbH: servers, in Helsinki (Finland, EU).
• Supabase: database and files, hosted in Ireland (EU).
• Anthropic PBC: AI models (United States).
• Voyage AI: semantic search, only if your business turns it on (United States).
• Stripe: payments and subscriptions.
• Google: only if you connect your Google account.
• Your browser's notification service, if you enable push notifications.

WhatsApp and Telegram are the services you connect: your messages keep flowing through them as always. We will also disclose data to authorities where the law requires it.

7. Transfers outside the European Economic Area

The servers and the database are in the EU. Anthropic and Voyage AI process data in the United States; those transfers rely on GDPR safeguards: the European Commission's standard contractual clauses or the EU-US Data Privacy Framework where the provider is certified.

8. How long we keep data

• For as long as your account is active.
• If you close your account or ask us to erase your data, we delete it within 30 days at most, except what the law requires us to keep: invoices, for the period required by accounting law (7 years in Estonia).
• Backups are overwritten in their normal cycle.
• Technical logs are kept only as long as needed for security and troubleshooting.

9. Your rights

You can ask to access, rectify or erase your data, object to or restrict its processing, or receive it in a portable format. Write to info@innerostech.com from your account email; we reply within one month at most.

If you believe we have not handled your data properly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the authority in your own country.

10. Security

All connections are encrypted (HTTPS). Passwords are stored as hashes. Each business only sees its own data, each user only what their role allows, and sensitive changes are logged.

11. Cookies

We only use technical cookies the service needs to work:

• crm_session_id: keeps you signed in (7 days).
• crm_locale: remembers your language.
• g_oauth_state: protects the Google connection while you make it; it lasts a few minutes.

We do not use advertising or analytics cookies. The public website stores the language you choose in your browser.

12. Minors

The service is for businesses and professionals and is not aimed at anyone under 18.

13. Changes

If we change anything important in this policy, we will tell you by email or inside the CRM before it applies.