Privacy Policy

1. Who we are, and our two roles

Elypt is a web design studio, run by CAMPOS SOLUTIONS, UNIPESSOAL LDA (NIF 518831183), Rua Capitão Leitão, 2800-133 Almada, Portugal. The Elypt app at app.elypt.io is where our clients follow their project and run their CRM. You can reach us at [email protected].

We hold personal data in two different roles, and the difference matters:

If you are someone whose details a business keeps in its Elypt CRM (for example you sent a message through their website, or received a proposal from them), that business is responsible for your data. Ask them first; we help them answer you.

2. What we keep

Your account

Your name, your email address and a password, which we keep only as a one-way hash (nobody can read it back, us included). If you sign in with Google, Google tells us your name, your email address and an ID for your Google account. For each signed-in session we keep a hashed form of your IP address and the name of your browser, so a session can be checked and ended.

Your project

What you and we put in your space: the steps of your project, the list of content we need, the documents we share with you, and the messages between you and the studio. The content for your site (photos, texts, logos) reaches us by email, usually as a Google Drive, Dropbox or WeTransfer link; it is not uploaded to the app.

Your CRM (kept on your behalf)

• The contacts, companies, deals, tasks, notes and custom fields you or your team add, or import from a CSV file.
• The messages sent through the form on your website, with the page and the campaign link they came from, if your site sends them.
• The emails you copy to your CRM address (the BCC address in Settings): the sender, the recipients, the subject and the text, up to 4,000 characters. Attachments are not kept.
• Your proposals, and what happens on their page: when it is first opened, and the name and note the recipient types when they accept or decline. We do not store their IP address.

What we do not do

The app has no statistics or advertising trackers and no third-party analytics. We do not read your CRM for our own purposes, and we never use it to contact your leads, to market to anyone, or to train any AI model.

3. The emails the app sends

The app sends emails to you and your team only, never to your leads:

• Account emails: confirming your address, resetting your password, invitations to a team, a sign-in code for the studio.
• Notices you need: a new lead from your website form, a proposal opened, accepted or declined, a message or a step in your project.
• A short morning reminder of the tasks due that day, to whoever looks after them.

When you write to a lead or send them a proposal, the email goes from your own mailbox (Gmail, Outlook or your email app), not through us. The app only prepares it.

4. Why we use it, and on what basis

• To provide the app you or your business signed up for (Art. 6(1)(b) GDPR, performance of a contract): your account, your space, your CRM and the emails above.
• To keep the app secure (Art. 6(1)(f), legitimate interest): the session records, the robot check at sign-in, and short-lived records that limit repeated attempts.
• For your CRM data, the legal basis is your business's to establish, as the controller. We process it under Art. 28 GDPR.

5. Who helps us run it

These providers process data for us, under contract, only to run the app:

We do not sell personal data, share it for marketing, or give it to data brokers.

Some of these providers are based in the United States. When data leaves the European Economic Area we rely on the EU-US Data Privacy Framework where it applies, and on the European Commission's Standard Contractual Clauses.

6. The studio's access to your space

Elypt's own team can open a client's space to set it up, fix a problem or answer a question. We do it only for that, and the app shows a bar saying so while we are in. Nobody outside the studio can.

7. How long we keep it

• Your account: until you ask us to delete it.
• Signed-in sessions: until they end (15 days for the studio, 30 for everyone else), or you sign out.
• Records that limit repeated attempts: about two days, then deleted automatically.
• Your project and your CRM: while you use the app. When you stop, we send you a copy if you want one and delete the rest within 30 days of your request, unless the law requires us to keep something longer.

8. Your rights

Under the GDPR you can ask to see the data we hold about you, correct it, delete it, limit how we use it, receive it in a portable format, or object to a use based on legitimate interest. Email [email protected]; we answer within 30 days.

You can also complain to the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) or to the authority where you live.

9. Cookies

The app only uses cookies it needs to work, so it does not ask for consent:

• __Host-elypt_session keeps you signed in, up to 30 days.
• elypt_in, beside it, only tells the pages where your account starts. It holds nothing about you.
• __Host-elypt_google lives for ten minutes while you sign in with Google, to check the answer really comes from Google.

The robot check at sign-in is Cloudflare's, and Cloudflare may use its own technical data for it.

10. Security

The app is served only over HTTPS. Passwords are kept as one-way hashes and checked against known data breaches when they are chosen; repeated wrong attempts are blocked for a while; the studio's panel asks for a second step, a code sent to the studio's email, in every session; and each business's CRM is kept apart, so nobody sees another's data. If a breach ever affected your data, we would tell you without undue delay.

11. Children

The app is for businesses and is not meant for anyone under 16. We do not knowingly keep data about children.

12. Changes

When the app changes how it handles data, this page changes too, and the date at the top with it. We tell our clients about any change that matters to them.

13. Contact

For anything about this policy or your data, email [email protected].