$ cat privacy-policy.md_

Privacy Policy

Last updated: 2 July 2026

This Privacy Policy explains how Kraft Fabrik Media Ltd. processes personal data in connection with Sally: the website at usesally.com, the hosted service at app.usesally.com, contact requests, and billing.

1. Controller

The controller responsible for processing personal data described in this policy is Kraft Fabrik Media Ltd., REG-NR: HE 388979, VAT ID: CY10388979R.

Address:
Kountourioti 6, Coral Elite Residences Building 1
8560 Peyia
Cyprus

Contact for privacy questions: hello@usesally.com

2. Controller and processor roles

For the website, your account, and billing, we act as controller.

For content that you and your team store inside the Service — projects, tasks, CRM records, marketing contacts, consent records, memory, uploaded files, and similar — you (or your organization) are the controller and we act asprocessor on your behalf. We process this content only to provide the Service. A data processing agreement (Art. 28 GDPR) generated for your account can be downloaded by account owners and admins in the billing settings of the app; for questions, contact us at hello@usesally.com.

When you connect a third-party store (such as Shopify or WooCommerce), Sally receives order and customer information from that store — including customer names, email addresses, phone numbers, and order details — and processes it on your behalf and under your instructions to provide the marketing, CRM, and automation features you enable. You are the controller of this data and we act as processor. We use it only to provide the Service, never sell it, and delete it when you disconnect the store, delete the records, or close your account. We honour data-erasure requests, including automated deletion requests received from connected platforms.

3. Categories of data we process as controller

  • server and technical data such as IP address, browser type, operating system, referrer, timestamps, and device information
  • account data such as name, email address, company name, and password hash
  • subscription and billing data necessary to manage your plan and process payments
  • usage and analytics data about how the website and Service are used (see section 7)
  • contact data and message content if you contact us, and records of communication and support history
  • any other information you voluntarily provide to us

4. Purposes of processing

  • to provide and operate the website and the Service
  • to create and manage accounts, workspaces, and subscriptions
  • to process payments and maintain financial records
  • to send service and account emails (for example trial, billing, and security notifications)
  • to maintain stability, security, and abuse prevention
  • to respond to inquiries and communicate with you
  • to understand usage and improve the website and the Service
  • to comply with legal, tax, accounting, and regulatory obligations

5. Legal bases under the GDPR

  • Art. 6(1)(b) GDPR — performance of a contract or steps prior to entering into a contract (account, subscription, Service operation)
  • Art. 6(1)(c) GDPR — compliance with legal obligations
  • Art. 6(1)(f) GDPR — legitimate interests, including Service security, fraud prevention, product improvement, and communication
  • Art. 6(1)(a) GDPR — consent, where consent is required

6. Payments

Subscription payments are processed by Stripe. We do not store full payment card details on our own systems. Stripe may process personal data such as billing details, transaction metadata, and fraud-prevention information in accordance with its own legal obligations and privacy notices.

7. Analytics and event tracking

We use PostHog Cloud (EU region, hosted in Frankfurt, Germany) for product and website analytics, collecting usage events (for example page views and button clicks with anonymous or pseudonymous identifiers). PostHog acts as a data processor on our behalf under a data processing agreement, and analytics data is processed within the European Union. We use this data to understand how the website and Service are used and to improve them. Analytics on the website only runs after you accept it in the cookie banner (Art. 6(1)(a) GDPR); if you decline, no analytics identifiers are set and no events are collected. You can change your choice at any time via “Cookie settings” in the footer.

8. Hosting and data location

The website, the Service, and all content stored in the Service are hosted on servers operated byHetzner Online GmbH in the European Union (data centers in Germany). Customer workspace content — projects, tasks, CRM records, marketing contacts, memory, and files — is stored and processed exclusively on this EU infrastructure.

9. Recipients and processors

We share personal data with service providers only where necessary to operate the website and the Service:

  • Hetzner Online GmbH (Germany) — hosting and infrastructure
  • Stripe — payment processing (see section 6)
  • PostHog (EU region, Frankfurt, Germany) — website and product analytics (see section 7)
  • email delivery infrastructure used to send service and account emails

Providers act under contracts that restrict their use of the data. We may also disclose personal data if required by law or where necessary to establish, exercise, or defend legal claims.

10. International transfers

We host all Service data within the European Union and do not ourselves transfer customer workspace content outside the European Economic Area. Two exceptions can involve non-EEA processing:

  • Payment processing: Stripe may process billing-related personal data outside the EEA, in which case the transfer is protected by appropriate safeguards such as adequacy decisions or standard contractual clauses.
  • Integrations you connect: if you connect your own third-party services to your workspace — for example your own Amazon SES or SMTP sender for marketing email, or your own Google Drive, Microsoft 365, or Dropbox account for file search — data you send through or retrieve from those services is processed by the respective provider under your agreement with them. You choose whether to enable these integrations.

11. Retention periods

We retain personal data only for as long as necessary for the relevant purpose, including to meet legal, tax, accounting, security, and documentation obligations. Content stored in the Service is retained for as long as your account exists or as instructed by the controller; payment and accounting records may be retained for longer where required by applicable law.

12. Your rights

Subject to applicable law, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, objection to processing, and data portability. Where processing is based on consent, you may withdraw consent at any time with effect for the future.

If your personal data is stored inside a Sally workspace operated by one of our customers, please direct your request to that customer as controller; we will support them in responding as their processor.

You may also have the right to lodge a complaint with a competent supervisory authority.

13. Cookies and similar technologies

We use cookies and browser storage where necessary for website and Service operation (for example sessions, security, and remembering your cookie choice), and — only with your consent — for analytics as described in section 7. You can change your analytics choice at any time via “Cookie settings” in the footer.

14. Security

We implement technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access — including encrypted transport, access controls, two-factor authentication options, and audit logging in the Service. However, no system can be guaranteed to be completely secure.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version published on this page is the current version.

16. Contact

For privacy-related questions or requests, contact hello@usesally.com.