Privacy policy

Who we are

Savicor is business software for small and medium sized companies, made and run from the Netherlands. In this policy "we" and "us" mean Savicor; "you" means the person whose data it is, and "your organisation" means the company that uses Savicor.

You can reach us about anything in this policy through the contact form on this website. Choose Privacy and my data as the topic so your message reaches the right person.

Two roles

We are the controller for the data of account holders and website visitors: we decide why and how it is used.

For the data your organisation stores in Savicor, such as contacts, companies, emails, deals, invoices, projects and staff schedules, your organisation is the controller and we are its processor. We handle that data only on your organisation's instructions and only to provide the service. Questions about that data, such as a request to see or delete it, go to the organisation that holds it first; we help them answer.

What we collect

Account data:

• Name and email address, and optionally a profile photo and phone number.
• Your password, which our authentication provider stores in hashed form. We never see or store it in readable form.
• Two-factor settings and the devices you are signed in on.
• The organisations you belong to and your role in each.

Data created while you use the service:

• What you and your colleagues put in: records, notes, files, emails, invoices and so on.
• An audit log of important changes inside your organisation, such as who changed a role, exported data or deleted a record.
• Technical data needed to run and protect the service: IP address, browser type, sign-in times and error reports. We use it for security, rate limiting and fixing faults, not for profiling.

If you connect a personal Gmail or Outlook mailbox:

• The emails that belong to contacts in your CRM, so they can show on the right record. We ask for the narrowest access the provider offers and keep the connection token encrypted. You can disconnect at any time, which stops all access.

On this website:

• What you type into the contact form, used only to answer you.
• No analytics or advertising tracking. See Cookies below.

Why we use it, and on what basis

• To provide the service you or your organisation signed up for: performance of a contract.
• To keep the service and your data secure, prevent abuse and fix faults: our legitimate interest in a safe and working service.
• To send service email, such as sign-in codes, invitations, security alerts and notices about changes to these terms: performance of a contract and legitimate interest.
• To answer questions you send us: legitimate interest, or steps you ask for before entering a contract.
• To meet legal duties, such as keeping financial records: legal obligation.

We do not sell personal data, do not use it for advertising, and do not use the data your organisation stores to train AI models.

Who else handles data

We use a small number of service providers to run the service. Each one is bound by a data processing agreement and may use the data only to provide their part of the service:

• Supabase: database, authentication and file storage, in Frankfurt, Germany.
• Vercel: hosting of the application and this website, in the EU region (Frankfurt).
• Resend: sending and receiving email for the service.
• Upstash: rate limiting, in the EU.
• Inngest: running background jobs, such as scheduled emails and automations.
• Google or Microsoft: only when you connect your own mailbox, under that provider's terms.

When paid plans open we will add a payment provider and list it here. We tell organisations in advance when the list changes in a way that matters to them.

We share data with authorities only when the law requires it, and we push back on requests that go further than that.

Where data is stored

Savicor is set up to store your organisation's data in the European Union. Some providers above are companies based in the United States. Where data could reach them outside the EU, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses, with extra safeguards such as encryption.

How long we keep it

• Account data: for as long as your account exists. When you ask us to delete your account, we remove it within 30 days, except what we must keep by law.
• Your organisation's data: for as long as the organisation uses the service. Archived records stay restorable until someone deletes them. When an organisation is deleted, its data is removed from the live database straight away and from backups when they expire, within 30 days.
• The audit log: for as long as the organisation exists, so owners and admins can see who changed what. Technical logs at our hosting providers are kept only briefly.
• Contact form messages: as long as needed to handle the question.
• Invoices and other records that tax law requires us to keep: 7 years.

How we protect it

Data is encrypted in transit and at rest. Every table with organisation data is protected by Row Level Security, so one organisation can never read another's data, and automated tests check this on every change. Every user signs in with two-factor authentication. Access by our own staff is limited to what is needed to run and support the service. More detail is on the Security page.

If a breach affects your personal data, we tell the organisations involved and, where the law requires it, the Dutch Data Protection Authority, without undue delay.

Your rights

Under the GDPR you have the right to:

• See the personal data we hold about you and get a copy.
• Have incorrect data corrected.
• Have your data deleted, unless we must keep it by law.
• Limit how we use it, or object to use based on our legitimate interest.
• Get your data in a common format to take elsewhere. Owners and admins can export their organisation's records as CSV from the app at any time.
• Withdraw consent, where we asked for it, without affecting what happened before.

Send your request through the contact form. We answer within one month and may ask you to confirm who you are first. If the data belongs to an organisation that uses us, we pass your request on to them.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or to the authority in the EU country where you live.

Cookies

We only use cookies and similar storage that the site and the app need to work. There are no analytics, advertising or third-party tracking cookies, so we do not ask for consent; we tell you about them once, the first time you visit.

• sb-…-auth-token: Keeps you signed in to the app, set by our authentication provider. Kept until you sign out.
• ankor_org: Remembers which organisation you opened last. Kept for one year.
• ankor-setup-dismissed-…: Remembers that you hid the getting started checklist. Kept for one year.
• ankor_mailbox_connect: Protects the step where you connect your Gmail or Outlook mailbox. Kept for 10 minutes.
• theme (browser storage): Remembers whether you chose light or dark mode. Kept until you clear it.
• savicor-cookie-notice (browser storage): Remembers that you have seen the cookie notice. Kept until you clear it.

You can remove them at any time in your browser settings. If you do, you are signed out. Should we ever want to use cookies that are not strictly needed, we will ask for your consent first and you can say no.

Children

Savicor is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect data from children.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters to how your data is used, we tell account holders by email or in the app before it takes effect.