Privacy Policy

How RevOps Labs s.r.o. collects, uses, and protects personal data in Salescheck.io.

Effective date: August 18, 2026 · Last updated: August 18, 2026

Contents

1. 1. Who we are
2. 2. Scope
3. 3. What personal data we collect
4. 4. Why we process it, and on what legal basis
5. 5. Who we share data with
6. 6. Third-party providers you connect yourself
7. 7. Error monitoring (Sentry)
8. 8. International data transfers
9. 9. How long we keep data
10. 10. Security
11. 11. Your rights
12. 12. Self-service export & erasure
13. 13. Cookies
14. 14. Children's privacy
15. 15. Changes to this policy
16. 16. Contact & complaints

1. Who we are

RevOps Labs s.r.o. ("we", "us"), a company registered in the Czech Republic under IČO 21705534, with its registered seat at Hlaváčkova 1334/19, Košíře, 150 00 Praha 5, Czech Republic, is the data controller for the personal data described in this policy, unless stated otherwise below.

2. Scope

This policy covers the Salescheck.io website, dashboard, and API (the "Service"). Where you connect a CRM (HubSpot, Pipedrive, Salesforce) or a third-party data provider, that provider's own privacy policy also applies to how they process data — see §6.

3. What personal data we collect

Some of this — particularly CRM-derived business data — may itself be personal data about your own contacts and customers, not about you. For that data, you are the data controller and we act as your data processor; you're responsible for having a lawful basis to share it with us (see our Terms of Service, §5).

4. Why we process it, and on what legal basis

5. Who we share data with

We share personal data with the following processors, only as needed to provide the Service:

We don't sell personal data. We don't currently run advertising, but our cookie banner includes a "Marketing" consent category reserved for if that changes in the future — see §13.

6. Third-party providers you connect yourself

If you connect your own HubSpot, Pipedrive, or Salesforce account, or your own account with a third-party sanctions/risk data provider (ComplyAdvantage, Sanctions.io, OpenCorporates, TRM Labs), we send that provider only the specific data needed to fulfill the request you've configured (e.g. a company name or wallet address to screen). Each provider processes that data under its own privacy policy and its relationship with you, not with us.

7. Error monitoring (Sentry)

8. International data transfers

Most of our own infrastructure (Neon, and Sentry once added) runs in the EU. Two of our processors are US-based and rely on sub-processors spread across several countries:

Clerk, Inc. is a US company. Per its Data Processing Addendum, Clerk hosts and processes data primarily on Google Cloud Platform and Cloudflare infrastructure (both ISO 27001 / SOC 2 certified) without publicly committing to a specific region — the DPA states Clerk may store and process data "in any country in which Clerk or its subprocessors maintain facilities." For transfers of personal data from the EEA to the US, Clerk relies on its certification under the EU-US Data Privacy Framework. Clerk keeps its current sub-processor list separately rather than publishing it; it can be requested at [email protected].

Creem (operated by Armitage Labs OÜ, an Estonian company) distributes processing across several sub-processors:

• Germany — AWS (primary infrastructure)
• United States — Supabase, OpenAI, Sentry, Papertrail/SolarWinds, Google, Resend, PostHog, Vercel
• Ireland — OpenAI (EU processing)
• Estonia — FeatureBase, GitHub
• Netherlands — Discord
• EU and United States — Slack

For transfers outside the EU/EEA, Creem relies on the EU Standard Contractual Clauses.

9. How long we keep data

While your organization has an active account, we keep your account and Customer Data for as long as needed to provide the Service. After your account is closed, we keep your operational Customer Data for 30 days — to let you reactivate if the closure was accidental and to resolve any outstanding disputes — after which it's permanently deleted. You don't have to wait out this window: you can erase your organization's operational data yourself at any time — see §12.

Billing and invoicing records are the one exception: because they're also accounting and tax documents, we keep them for 10 years from the date of issue regardless of when your account closes. That's the longer of two Czech legal requirements — 5 years for accounting records generally under the Accounting Act (Act No. 563/1991 Coll.), and 10 years for VAT-relevant tax documents under §35 of the VAT Act (Act No. 235/2004 Coll.) — so we apply the longer period to the whole record rather than splitting an invoice into accounting vs. VAT components.

10. Security

We apply technical and organizational measures appropriate to the data we hold, including:

• encryption in transit (TLS) for all traffic to the Service;
• encryption at rest (AES-256-GCM) for third-party CRM and data-provider credentials stored in our database;
• role-based access control within your organization (Admin vs. Compliance) and a separate, email-allow-listed layer for our own staff's cross-organization admin access;
• a logged audit trail for both compliance scoring decisions and platform-admin actions like account impersonation;
• rate limiting on key API endpoints to reduce abuse.

No method of transmission or storage is 100% secure; we can't guarantee absolute security.

11. Your rights

If you are in the EEA/UK (and, as a matter of practice, wherever you are), you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten"), subject to legal retention obligations;
• Restrict or object to certain processing;
• Port your data to another provider in a structured, machine-readable format;
• Withdraw consent at any time, where we rely on it;
• Lodge a complaint with a supervisory authority — see §16.

To exercise any of these, contact us at [email protected], or use the self-service tools below.

12. Self-service export & erasure

Organization admins can, at any time, from Company & Billing → Data & privacy:

• Export everything Salescheck.io holds for your organization as a JSON file — risk categories, rules, scoring history, and CRM/provider connection metadata (never encrypted credentials);
• Erase that same data, after typing your organization's exact name to confirm. This resets your organization's data — your account and members stay intact, but you'll need to reconnect your CRM and rebuild your rules.

For full account/organization closure (removing the organization itself, not just its data), contact us at [email protected].

Separately, if you're a website visitor (not an app user), you can delete your cookie-consent record yourself at any time from the "Cookie preferences" panel on salescheck.io (see §13) — no need to contact us. If you'd rather email us to have it erased, that works too.

13. Cookies

On the app and dashboard (app.salescheck.io), we use only the strictly necessary cookies needed to keep you signed in, set by our authentication provider, Clerk.

On the marketing website (salescheck.io), a cookie banner asks for your consent before anything beyond strictly necessary storage is used. Nothing in the "Analytics" or "Marketing" categories below runs until you actively opt in, and you can change your choice at any time from the "Cookie preferences" link in the site footer — that reopens the same panel you saw on your first visit, with the same options.

Every consent decision (which categories you chose, when, and under which version of this policy) is logged to our backend so we can demonstrate what was consented to if asked — see §12 for how to have that record erased.

14. Children's privacy

Salescheck.io is a business-to-business service and isn't directed at, or knowingly used by, children.

15. Changes to this policy

We may update this policy from time to time. We'll notify you of material changes by email or in the Service before they take effect.

16. Contact & complaints

RevOps Labs s.r.o. · IČO 21705534 · Hlaváčkova 1334/19, Košíře, 150 00 Praha 5, Czech Republic
Email: [email protected]

You can also lodge a complaint with the Czech data protection authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz), or with the supervisory authority in your own EU/EEA country of residence.