Privacy Policy
Last updated: 2 November 2026
Your data stays in the European Union. Zwoot CRM is hosted, stored, backed up and monitored exclusively in data centres located in the EU. We do not transfer data stored in Zwoot CRM outside the European Economic Area.
1. Who we are
This Privacy Policy explains how Zwoot OÜ ("Zwoot", "we", "us") processes personal data when you visit zwootcrm.com, contact us or use the Zwoot CRM service (the "Service").
- Company: Zwoot OÜ
- Registry code: 14260963
- Address: Kursi 3, Tallinn 10415, Estonia
- Email: hello@zwootcrm.com
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Estonian Personal Data Protection Act.
2. Our role
Depending on the context, Zwoot acts in one of two roles:
- Controller for data about website visitors, people who contact us, and the account details of users of the Service (for example name, email address and sign-in data).
- Processor for the data that our customers store in Zwoot CRM about their own customers, leads and contacts ("Customer Data"). For Customer Data, our customer is the controller and we process it only on their documented instructions, as set out in our Terms and Conditions. If your data is stored in Zwoot CRM by one of our customers, please contact that organisation to exercise your rights.
3. Where your data is located
All infrastructure used to run the Service is located in the European Union. This includes application servers, databases, file storage, backups, transactional email, monitoring and AI processing.
- Application servers and databases are hosted by Hetzner in Germany and Finland.
- Backups and transactional email use Amazon Web Services in the Stockholm region (eu-north-1), Sweden.
- Service monitoring is operated by Better Stack using its European data region.
- Optional AI features are provided by Mistral AI, a French company, with processing in the EU.
Customer Data and account data are not transferred to or stored in countries outside the European Economic Area. The only exception is usage analytics on zwootcrm.com and in the Essentials package of the Service. Usage analytics never receives Customer Data, is used only with your consent and is described in section 7.
Customers with a Custom Project may choose to disable usage analytics or to replace any of the providers listed in section 6. In that case, the configuration agreed with the customer applies.
4. Data we collect and why
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering contact requests | Name, email, company, phone number, message | Steps prior to entering into a contract (Art. 6(1)(b)); legitimate interest in replying (Art. 6(1)(f)) |
| Creating and managing your account | Name, email, organisation, role, password hash, two-factor authentication settings | Performance of a contract (Art. 6(1)(b)) |
| Providing the Service | Customer Data entered by you or your organisation | Processed on behalf of our customer under Art. 28 |
| Sending service emails | Email address, message content (for example invitations, password resets, security notices) | Performance of a contract (Art. 6(1)(b)) |
| Security, abuse prevention and service monitoring | IP address, browser information, timestamps, technical logs | Legitimate interest in operating a secure service (Art. 6(1)(f)) |
| Backups and disaster recovery | Copies of account data and Customer Data | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| AI features | Content you submit to an AI feature | Performance of a contract (Art. 6(1)(b)); processed on behalf of our customer under Art. 28 |
| Usage analytics on the website and in the Service | Pages visited, interactions, device and browser information, approximate location, pseudonymous cookie identifiers, session recordings with all text and input masked | Consent (Art. 6(1)(a)) |
| Accounting and legal obligations | Contract and invoicing details for paid projects | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data and we do not use Customer Data for advertising.
5. AI features
Some features of the Service use artificial intelligence provided by Mistral AI SAS (France). When you use such a feature, the content you submit is sent to Mistral AI for processing in the EU and the result is returned to the Service. Mistral AI acts as our sub-processor and processes the content only to provide the requested feature. Customer Data is not used to train AI models.
6. Sub-processors
We use the following service providers to operate the Service. Each is bound by a data processing agreement. Only providers located in the EU process Customer Data.
| Provider | Purpose | Data location |
|---|---|---|
| Hetzner Online GmbH (Germany) | Application hosting and databases | Germany, Finland |
| Amazon Web Services EMEA SARL (Luxembourg) | Transactional email (Amazon SES) and backup storage (Amazon S3) | Sweden (eu-north-1) |
| Better Stack | Uptime and service monitoring | European Union |
| Mistral AI SAS (France) | AI features | European Union |
| Google Ireland Limited (Ireland) | Usage analytics (Google Analytics); no Customer Data | EU, with possible transfer to the United States |
| Microsoft Ireland Operations Limited (Ireland) | Usage analytics (Microsoft Clarity); no Customer Data | EU, with possible transfer to the United States |
Google Analytics and Microsoft Clarity are part of the Essentials package. In a Custom Project, the customer may disable them or have any provider replaced. We will inform customers in advance of any intended change to this list, giving them the opportunity to object.
7. Cookies and website analytics
Essential cookies
The Service uses cookies that are strictly necessary to sign you in, keep your session secure and remember your security settings. These cookies do not require consent and cannot be switched off.
Analytics cookies
With your consent, our public website zwootcrm.com and the Essentials package of the Service use Google Analytics (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited). They help us understand how the website and the Service are used and how to improve them. Microsoft Clarity records interactions such as clicks, scrolling and mouse movement.
Usage analytics never receives Customer Data. Microsoft Clarity is configured with strict masking, so all text and input on the screen is masked before a recording leaves your browser. Google Analytics receives only page views and usage events with pseudonymous identifiers. No names, record contents or other Customer Data are included.
These providers may transfer usage data to the United States. Such transfers rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
Analytics cookies are set only after you give consent. You can withdraw your consent at any time via the cookie settings, without affecting the lawfulness of processing before withdrawal. In a Custom Project, the customer may disable usage analytics for its organisation entirely.
8. How long we keep data
- Contact requests: up to 12 months after our last communication, unless a contract follows.
- Account data: for as long as your account is active.
- Customer Data: for the duration of the customer relationship. After termination it is deleted within 30 days, unless the customer requests earlier deletion.
- Backups: overwritten on a rolling basis and kept for no longer than 30 days.
- Technical and security logs: up to 90 days.
- Analytics data: up to 14 months.
- Accounting records: 7 years, as required by the Estonian Accounting Act.
9. How we protect data
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, encrypted backups, two-factor authentication, strict logical separation of data between organisations, role-based access control and restricted administrative access on a need-to-know basis.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interest;
- withdraw consent at any time where processing is based on consent.
To exercise your rights, contact us at hello@zwootcrm.com. We will respond within one month. If your data is stored in Zwoot CRM by one of our customers, we will forward your request to that customer.
11. Complaints
If you believe that we process your personal data unlawfully, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, Tallinn 10134, Estonia,www.aki.ee, or with the supervisory authority of your country of residence or work.
12. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available on this page. We will notify account holders of material changes by email or within the Service.
13. Contact
For any questions about this Privacy Policy or our processing of personal data, contact Zwoot OÜ at hello@zwootcrm.com or by post at Kursi 3, Tallinn 10415, Estonia.