Salesnivo Privacy Policy

1. Who is responsible for your data

Salesnivo is operated by WALL STREET INSIGHTS sp. z o.o., Aleje Jerozolimskie 109/70, 02-011 Warszawa, Poland, company register KRS 0001205492, tax ID NIP 7011286558, statistical number REGON 543251285, share capital PLN 50,000. The company is a controller where it determines the purposes and means of processing, particularly for accounts, its own billing and correspondence with us.

For privacy matters, email support@salesnivo.com with the subject “Privacy”, or write to the address above. You may contact us even without an account if your contact information appears in a lead list. The company has not appointed a data protection officer.

2. People and services covered

This policy covers website visitors, account holders, consumers, business customers, people acting for businesses and individuals identified in campaign data. It covers the website, dashboard and Find extension to the extent functions are actually activated. Announcing Prospect or another product does not mean its processing has started.

EU GDPR applies to processing in the context of the controller's Polish establishment even where the person is outside the EU. The Germany, Austria, Switzerland, UK and US supplements add requirements where their laws apply. No supplement reduces mandatory rights.

Language changes the document's translation. An IP address can only suggest a country; it does not determine residence or rights. The country may be corrected manually. An IP address must not be sent to an external location provider before the purpose, basis and transparency requirements for that disclosure are established.

3. Data that may be processed

Below is the information the system actually stores (checked on 10.10.2026). Not every category applies to every person.

• Account: name, email, password (stored only as a cryptographic hash), optionally phone, position, company name and planned team size, plus language, time zone, interface theme, last sign-in time, the time you accepted the Terms and the Terms version.
• Company profile: contact email, phone, website, billing email, industry, size, answers from the initial account setup and the Stripe customer identifier.
• Sign-in with Google or Facebook (only if you choose it): the provider account identifier, email, name, avatar URL and OAuth tokens, stored encrypted.
• Payments: amounts, currency, status, dates, refund deadline and Stripe identifiers. You enter card details on Stripe's page; Salesnivo never receives or stores card numbers. Invoices are issued by Fakturownia based on the payment data.
• Contact and support: messages, requests, correspondence, supplied attachments and information needed to resolve an issue.
• Technical information: the IP address and browser user agent of active sign-in sessions (refresh tokens), and an access log recorded whenever Salesnivo staff open a customer's lead data (who, when, from which IP address).
• Statistics and advertising (only after consent in the cookie banner): Google cookie identifiers, the addresses you visit, where the visit came from, browser and device, approximate location from the IP address, and dashboard events: account created, checkout started and paid purchase (plan, currency, net amount). Your name and email address are never sent to Google.
• Campaigns and leads: phrases and campaigns and, for each company: name, category, address, phone numbers, email addresses with the page they were read from, website, social profiles, opening hours, Google rating and review count, Google Maps link and identifier, register data (NIP, REGON, KRS, registered name, legal form, status, VAT status, PKD), scores, the customer's work status and notes.

Leads have no separate fields for owners' names. However, a sole trader's registered name often contains the person's name, and an email or phone number may be personal, so leads can contain personal data.

Do not send a full card number, CVC, password or unnecessary information about others in a support request. Do not include special-category or criminal-conviction/offence information in a campaign without a separate valid basis and agreed safeguards.

4. Purposes and legal bases

You may withdraw consent without affecting earlier lawful processing. You may object where legitimate interests are relied on. Reading this policy, registering or accepting terms is not consent to marketing or optional tracking.

5. Where lead information comes from

Find supports search-based campaigns. Company information comes from these sources:

• public Google Maps listings that the user opens in their own browser through the extension;
• the company's public website - read by the Salesnivo server, identifying itself as “SalesnivoBot/1.0”; the extension reads the website only when the server cannot;
• public registers: KRS (Polish Ministry of Justice), CEIDG, the VAT taxpayer “white list” (Polish Ministry of Finance), REGON (Statistics Poland, GUS) and VIES (European Commission).

This policy does not grant rights to third-party content or override source-platform conditions.

If we obtain personal data indirectly as a controller, we provide the information required by EU GDPR Article 14, including categories, source, purpose, basis, recipients, retention and rights: within a reasonable time, no later than one month, or earlier at first communication or first disclosure where that occurs sooner.

We do not assume an information-duty exception merely because records are public, numerous or notifying people takes work. Any exception needs a specific legal basis, assessment and required safeguards. Publishing a notice on a website alone is not always sufficient.

A listed number or email does not constitute marketing consent. Users must separately assess lawful outreach and the relevant channel and honour objections. When inaccurate information is reported, the recipients and correction or deletion of copies also need to be addressed.

6. Roles for campaign information

Roles follow actual decisions about purposes and means, not only a label in an agreement.

• Where a customer sets a campaign's purpose and Salesnivo processes personal data solely on documented instructions, the customer is the controller and Salesnivo the processor for that activity. This requires an EU GDPR Article 28 agreement covering instructions, scope, safeguards, sub-processors and rights assistance.
• If Salesnivo builds, combines, enriches or uses a lead database for its own purposes, an independent or joint-controller role and its duties must be assessed. A general clause cannot transfer all those duties to the customer.
• The controller role for accounts, own billing and own correspondence is separate from a possible processing role for campaigns.

You may make a request without an account. If a customer is the controller for a specific record, we help establish the proper route and fulfil our own duties rather than automatically redirecting every request without assessment.

7. Recipients and providers

Information may be disclosed to authorised service staff, providers of necessary functions, the customer controlling a campaign, and authorities or advisers where a justified basis exists. Access must reflect the actual role, scope and need. Processors need an appropriate agreement; independent controllers need their own purpose and transparency.

Analytics and advertising tools run only with consent (section 10). We use no third-party consent-management tool (the banner is part of our site), no error-tracking, CDN or AI providers. Fonts for the website and dashboard are served from our own server. We do not sell data.

8. Processing in other countries

We store data in Poland, within the EEA. Payment data may go to Stripe, Inc. in the USA under the EU-US Data Privacy Framework and European Commission standard contractual clauses. If you consent to statistics or marketing, data from Google Analytics and Google Ads may also be processed by Google LLC in the USA, on the same basis. If you choose to sign in with Google or Facebook, those companies also process the data needed for sign-in, including outside the EEA.

Processing under UK GDPR or the Swiss FADP needs a separate assessment of these transfers (for example a UK Addendum or IDTA, safeguards under the FADP); that assessment has not yet been completed.

You may request information about an actual transfer and a copy of the applicable safeguards, subject to protection of legally confidential information.

9. Retention

Information must not remain longer than the actual purpose and relevant obligations require. Closing an account, cancelling a subscription and deleting personal data are different operations. Subscription expiry does not justify retaining an entire campaign indefinitely or calling every lead an accounting record.

10. Cookies and device storage

Website (salesnivo.com, WordPress): without asking, it sets only strictly necessary cookies: pll_language (the chosen site language, 12 months), so you are not redirected again by your browser language, and sn_consent (your decision in the cookie banner, 6 months). Only the site's administrators receive WordPress sign-in cookies.

Without asking, the dashboard uses only technologies necessary for it to work:

• salesnivo-session - the sign-in session, strictly necessary; expires after 120 minutes of inactivity;
• XSRF-TOKEN - form security, for the session;
• remember_web_* - only if you tick “Remember me”;
• sn_consent - your decision in the cookie banner, 6 months; stored on the salesnivo.com domain, so the website and the dashboard ask only once;
• browser local storage - the chosen interface theme and collapsed menu groups.

Optional cookies, only with consent. The website and the sign-in, sign-up and payment screens of the dashboard use Google Tag Manager (Google Ireland Limited). Until you agree, the container does not load at all and your browser does not connect to Google; every Google Consent Mode v2 consent starts as denied. You consent separately to:

• statistics - Google Analytics 4: _ga and _ga_<id> (up to 2 years), which tell visits and sessions apart, so we know which pages are read and where visitors come from;
• marketing - Google Ads: _gcl_au (90 days) and Google cookies on Google domains (for example IDE, up to 13 months), which measure whether an ad led to a sign-up or purchase and allow ads to be tailored. Further providers will be added to section 7 before they are switched on.

The basis is your consent (Article 6(1)(a) GDPR and the rules on access to terminal equipment, in Poland Article 399 of the Electronic Communications Law). The banner has equal “Accept” and “Reject” buttons and “Settings” with the categories; refusing limits nothing. You can change your decision or withdraw consent at any time with the “Cookie settings” link in the footer of the website and the dashboard screens; after withdrawal we delete Google cookies from our domain. Withdrawal does not affect processing before it. We treat a Global Privacy Control (GPC) signal as an objection to marketing, even if “Accept” was chosen in the banner.

The Find extension keeps in the browser's extension storage the sign-in tokens, a queue of records not yet confirmed by the server (at most 7 days), an installation identifier, the chosen language and the campaign list. The extension contains no analytics or advertising tools.

11. Contact and marketing

Messages needed for an account, order, security or a support response must be distinguished from promotion. Optional marketing consent must be separate, specific to the sender/channel and withdrawable. It must not be hidden in policy or terms acceptance.

Where processing is for direct marketing, the objection to using information for that purpose is absolute. Such marketing must stop after objection; only a minimal justified record to honour that decision may remain.

We send no marketing emails. The only optional messages are launch notifications for products you explicitly subscribe to; each one has a one-click unsubscribe.

Find collects campaign results and does not contact leads for users; the Mailing product is not available. Public contact details are not consent for email, phone, SMS or WhatsApp. Each channel/country requires separate assessment; B2B rules are not identical in Poland, DACH, UK and the US.

12. Your rights and requests

Under EU GDPR you may request access/copies, rectification, erasure or restriction, portability in the specified cases and object to processing. You may withdraw consent, complain to a regulator and seek a court remedy. Rights depend on the basis and circumstances; erasure does not remove a duty to retain specific legally required records.

Email support@salesnivo.com or write to the company's address. Explain the request and supply the minimum information to locate the records. Listed contacts need no account. If there are reasonable identity doubts, we may request necessary verification; a full identity-document copy is not automatically required and excessive information should not be collected.

EU GDPR requests are handled without undue delay, generally within one month. A justified statutory extension may add two months; the reason must be communicated within the first month. A refusal needs reasons and information on remedies. Handling is generally free; exceptions require a statutory basis, not a paid subscription.

13. Data protection complaints

You may raise a data complaint at support@salesnivo.com or by post. Contacting us does not remove your complaint/court rights or become a condition for an otherwise legally available remedy.

Poland's regulator is the President of the Personal Data Protection Office (UODO). Under EU GDPR you may also contact the competent authority in your habitual-residence, workplace or alleged-infringement state. Regional supplements identify UK, Swiss and US authorities.

The privacy complaint process differs from product complaints and rights-request deadlines. UK-covered complaints require acknowledgment within 30 days and appropriate investigation, as described in the UK supplement.

14. Security and breaches

Controllers and processors must use safeguards appropriate to risk, scope and data type, including least access, appropriate authentication, secure communication, permission controls, backup procedures and incident response. Passwords are stored only as a hash, OAuth tokens are stored encrypted, and every time Salesnivo staff open a customer's lead data, it is recorded in an access log.

A breach requires assessment and, where statutory conditions apply, notification to the relevant regulator and the individual without undue delay. Under EU GDPR, required authority notification is normally no later than 72 hours after awareness; this is not a deadline for every ordinary customer report.

15. Minors

The intended service is for adult users aged 18 or over. An age statement alone does not establish effective age controls or prove that children's information cannot reach the system.

If you suspect a minor's account or children's data was supplied, contact support@salesnivo.com. The matter requires assessment, restriction of unnecessary processing and an appropriate response. Additional information should not be requested from a child beyond what is necessary.

16. Automation and future products

We make no automated decisions with legal or similarly significant effects on individuals. Lead scores only order the customer's list. We use no AI providers. Prospect is a future product; announcing it does not mean information is already sent to its AI providers.

Before profiling of individuals or AI is activated, including in Prospect, actual purposes, providers, sources, bases, countries, effects and required risk assessments must be established. Solely automated decisions with legal or similarly significant effects need the applicable basis, meaningful information and statutory safeguards, including human intervention where required.

17. Required information and policy changes

Information necessary for an account, order or invoice may be contractual or statutory; withholding it may prevent that specific action. Required fields and consequences must be explained when collected. Optional details/marketing consent must not be represented as necessary for every service.

Before using information for a new purpose, we provide the required additional information and establish an appropriate basis. A policy change does not automatically supply consent to a new purpose. Version/date must remain visible, material changes communicated as appropriate and older versions retained for accountability.