Privacy Policy

1. Who we are

Ricoberi ("we", "us") provides a lead-recovery CRM. We are the data controller for the personal data described in this policy. For any privacy matter, contact our data protection contact at privacy@ricoberi.com.

2. What data we collect

• Account data - name, email address, password (hashed), role, and security settings such as two-factor authentication.
• Contact data you import - names, companies, emails, phone numbers, notes, deal values and interaction history of your business contacts. You are the controller of this data; we process it on your behalf.
• Usage data - log entries, audit trails and technical data (IP address, browser type) needed to secure and operate the service.

3. Why we process it (legal bases)

• Contract (Art. 6(1)(b) GDPR) - to provide the CRM service you signed up for.
• Legitimate interest (Art. 6(1)(f)) - security, fraud prevention, audit logging and service improvement.
• Consent (Art. 6(1)(a)) - optional cookies and marketing communications. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) - where retention is required by law.

4. AI processing

Contact data may be processed by AI models to produce recovery scores, insights and message drafts. Your data is never used to train models and never shared with third parties for their own purposes. No automated decision produces legal effects - every outgoing message requires your explicit approval.

5. Sharing and transfers

We share data only with processors needed to run the service (hosting, email delivery, AI providers), under data processing agreements. Where data leaves the EEA, we rely on adequacy decisions or Standard Contractual Clauses.

6. Retention

Account and contact data are kept while your account is active and deleted within 30 days of account deletion, except where a longer period is required by law. You can export all of your data at any time.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erasure - "right to be forgotten" (Art. 17)
• Restrict processing (Art. 18)
• Data portability - receive your data in a machine-readable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, without affecting prior processing
• Lodge a complaint with your local supervisory authority

To exercise any right, email privacy@ricoberi.com. We respond within 30 days.

8. Cookies

We use strictly necessary cookies for login sessions and security. Optional analytics cookies are set only with your consent via the cookie banner, and you can change your choice at any time by clearing your browser storage for this site.

9. Security

Data is encrypted in transit, access is role-based, sensitive actions are audit-logged, and two-factor authentication is available on all accounts.

10. Changes

We will notify you of material changes to this policy by email or in-app notice before they take effect.