1. Introduction
Zyrft is a web-based sales CRM for small businesses and sales teams. It helps teams manage leads, contacts and companies, track opportunities and activities, forecast revenue and, on the Pro plan, review financial performance.
This policy explains how personal data is handled when you visit our website, create or use a Zyrft account, subscribe to a paid plan or contact us. It also explains our role for the data our customers store in their Zyrft workspaces.
This policy does not cover websites or services of other companies, even if they are linked from Zyrft.
2. Who we are
Zyrft is operated by Frac CFO Jonas Tyrone Lobaton, pl. Ludwika Waryńskiego 2A/15, 60-579 Poznań, Poland ("we", "us"), a business registered in the Polish Central Register and Information on Economic Activity (CEIDG) as a sole proprietorship (jednoosobowa działalność gospodarcza), REGON 541535392, tax identification number (NIP) 7812088253. "Zyrft" is the name of our product, not a separate company. We are the controller of the personal data described in this policy, except Customer Data (see "Our roles").
For any question about privacy or this policy, email us at jonas.frac.cfo@gmail.com or call +48 453 238 451. We have not appointed a data protection officer.
3. Our roles: controller and processor
We have two different roles, depending on whose data it is and why it is processed.
We are the controller
We decide why and how personal data is processed for our own business purposes: creating and running user accounts, managing workspace memberships, billing and invoicing, answering support requests, keeping the service secure and meeting our legal obligations. This policy describes that processing.
We are a processor for our customers
A customer organisation (a "workspace") stores information about its own prospects, clients and partners in Zyrft: for example contacts, companies, opportunities, activities, proposals sent to its clients and submissions from website lead forms it publishes. For this Customer Data, the customer is the controller: it decides what to store and why. We process Customer Data only to provide Zyrft to that customer and on its instructions, under a data processing agreement as required by Article 28 GDPR. Our data processing agreement for customers is being finalised; customers can request it at jonas.frac.cfo@gmail.com.
If your details are stored in a Zyrft customer's workspace and you want to exercise your rights, please contact that organisation first. We will help it respond.
4. Personal data we process
Data we collect for our own purposes
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a one-way hash by our authentication provider; we never see it), time zone, language, and which version of the Terms of Service you accepted and when | You, at sign-up and in Settings |
| Workspace membership | Workspace name, your role (admin, sales manager or salesperson), job title, visibility settings, team assignments, invitations (invitee email and inviter) | You or your workspace admin |
| Preferences | Notification and daily digest settings | You |
| Subscription data | Plan, number of users, subscription status, trial dates, Stripe customer and subscription identifiers | You and Stripe |
| Payment data | Card and payment details are entered on Stripe's secure pages. We never receive or store full card numbers. | You, directly to Stripe |
| Communications | Emails you send us and our replies | You |
| Security and technical data | Sign-in and authentication events; your IP address (used briefly for rate limiting); request information such as IP address and browser type recorded in our hosting and authentication providers' logs; a record of changes made in a workspace (audit log) | Automatically |
| Email delivery data | Recipient address, subject, delivery status of emails we send, and the content of daily digest emails | Automatically |
Providing your name and email address is necessary to create an account. Without them we cannot provide the service.
Customer Data we process for our customers
Contacts and companies (for example name, job title, business email, phone number, city and notes), opportunities, products and prices, activities and next actions, sales targets, proposals and the name, email and note of a client who accepts or declines one, website lead-form submissions (the answers given, a one-way hash of the sender's IP address and the referring page), imported spreadsheets, and financial performance files (profit-and-loss and budget figures, which normally contain no personal data).
Customers must not store special categories of personal data (for example health data) in Zyrft.
5. Why we process data and our legal bases
We process personal data only where the GDPR gives us a legal basis. The table explains each purpose.
| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Creating your account, signing you in, providing workspaces, roles and features | Account, membership, preferences, technical data | Contract (b) with the person who signs up. For users invited by a customer: our legitimate interest (f) in providing the service our customer has contracted for |
| Subscriptions, payments, invoices and tax records | Subscription and billing data | Contract (b); legal obligation (c) under Polish tax and accounting law |
| Service emails: confirming your email, password resets, invitations, billing notices, the daily digest you can switch off in Settings | Account and email delivery data | Contract (b) or legitimate interest (f) in operating the service |
| Answering your questions and support requests | Communications, account data | Contract (b) or legitimate interest (f) in helping our users |
| Keeping Zyrft secure: authentication, rate limiting, preventing abuse, investigating incidents, audit logs | Security and technical data | Legitimate interest (f) in protecting our service, our customers and their data |
| Establishing, exercising or defending legal claims | Relevant records | Legitimate interest (f) |
| Processing Customer Data | Customer Data | On our customer's instructions under Art. 28 GDPR; the customer is responsible for its own legal basis |
About legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights. We only use the data needed, keep security data short-lived where we can, and limit who can access it. You can object to this processing at any time (see "Your privacy rights").
Marketing. We do not currently send marketing emails or newsletters. If we introduce them, we will ask for your consent where the law requires it, and you will be able to withdraw it at any time.
No automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
7. International data transfers
Our database is located in the European Union (Ireland). Some service providers listed above process personal data outside the European Economic Area, mainly in the United States. When that happens, the transfer is protected by:
- the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), which Supabase, Vercel, Stripe and Resend include in their data processing agreements; and
- where the recipient is certified, the EU-U.S. Data Privacy Framework, which the European Commission recognised as adequate on 10 July 2023. Stripe and Resend refer to it in their agreements.
You can ask us for more information about these safeguards at jonas.frac.cfo@gmail.com.
8. How long we keep data
We keep personal data only as long as we need it for the purposes above.
| Data | How long |
|---|---|
| Your account | While your account exists. If you ask us to delete it, we delete it unless we must keep certain data by law |
| Customer Data in a workspace | While the workspace exists. Workspace admins can delete records at any time; deleted records are removed from our live database. A Free workspace none of whose users has signed in for 12 months may be deleted after we warn its admins by email at least 30 days before |
| A cancelled paid subscription | Cancelling does not delete anything. The workspace returns to the Free plan with all its data. If it has more users than the Free plan allows, it becomes read-only until users are removed or it subscribes again |
| A deleted workspace | When a workspace is deleted at the customer's request, all its data is deleted from our live database |
| Backups | Our database provider makes a daily backup of the database, kept for 7 days. Deleted data disappears from backups when they expire |
| Audit log of workspace changes | While the workspace exists |
| Security data | Rate-limiting counters are replaced in each short time window. Our hosting and authentication providers keep their own logs for limited periods under their policies |
| Email delivery data | Daily digest content is kept with your account; our email provider keeps delivery logs for a limited period under its policy |
| Billing and accounting records | For the periods required by Polish tax and accounting law |
| Support messages | As long as needed to handle your request and any follow-up |
Admins can export workspace data at any time, including after a subscription ends.
9. How we protect data
We use technical and organisational measures appropriate to the data we handle, including:
- each customer's workspace is isolated in the database (row-level security on every table), and automated tests check that one customer cannot read another customer's data;
- access inside a workspace follows roles and visibility settings, and the workspace is always taken from the verified sign-in session;
- an email address must be confirmed before anyone can sign in, passwords are stored only as hashes and are checked against known data breaches, and sign-in, invitations and imports are rate-limited;
- all traffic is encrypted with HTTPS, and our database provider encrypts stored data;
- our staff have no standing access to Customer Data. A workspace admin can grant time-limited, read-only support access and revoke it at any time; every grant is logged;
- payments are handled by Stripe, so card details never reach our systems.
No system is completely secure. If a personal data breach occurs, we will act on it and notify the supervisory authority and affected people where the law requires. Read more on our Security page.
11. Artificial intelligence features
Zyrft does not currently offer AI features, and no account data or Customer Data is sent to AI providers.
We are developing optional AI tools. Before any of them become available, we will update this policy to explain which providers are used, what data is sent to them, how long it is kept and how workspace admins can switch AI features on or off.
12. Your privacy rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data, unless we must keep it, for example to meet legal obligations or defend legal claims;
- restriction of processing in certain cases;
- data portability: receive data you gave us in a structured, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time where we rely on consent, without affecting earlier processing.
How to use your rights
- In the app: Settings → Profile to correct your details; Settings → Privacy to download your data (JSON) or request deletion of your account. Workspace admins can export all workspace data under Import / Export.
- By email: write to jonas.frac.cfo@gmail.com. We may ask you to confirm your identity.
We respond within one month of receiving your request. If a request is complex or we receive many requests, we may extend this by up to two further months; we will tell you within the first month. Requests are free of charge unless they are manifestly unfounded or excessive.
Data in a customer's workspace. If a Zyrft customer stores your details, it controls that data. Please contact that organisation; we will assist it in responding to your request.
Complaints
You have the right to lodge a complaint with a data protection supervisory authority. In Poland this is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain in the EU country where you live or work. We would appreciate the chance to address your concern first.
13. Children
Zyrft is a service for businesses and their employees. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us at jonas.frac.cfo@gmail.com and we will delete it.
14. Changes to this policy
We may update this policy when our service or the law changes. The "Last updated" date at the top shows the latest revision. If we make material changes, we will tell account holders by email or with a notice in the app before the changes take effect.
15. Contact us
Questions or requests about privacy: jonas.frac.cfo@gmail.com
Phone: +48 453 238 451
Postal address: Frac CFO Jonas Tyrone Lobaton, pl. Ludwika Waryńskiego 2A/15, 60-579 Poznań, Poland
See also our Terms of Service and Security page.
Related: Terms of Service · Security · Contact