Privacy policy

Who we are

windeal is provided by Adrian Wasielewski, ul. Rzeźnicza 10/26, 31-540 Kraków, Poland, VAT ID PL5492253949 (“we”). We are the controller for the personal data of people who visit this website or hold a windeal account. Write to us at [email protected] about anything in this policy. We have not appointed a data protection officer because the law does not require one for us; the address above reaches the person responsible.

Data in your workspace

The contacts, organizations, deals, leads, activities, notes and emails your team keeps in a workspace belong to your organization. For that data your organization is the controller, and we process it only on its behalf under our Data processing agreement. If your details are stored in someone’s workspace, please send requests about them to that organization. If you write to us instead, we pass your request on.

What we collect

Account data: your name, email address, password hash if you use a password, preferred language and time zone, and your role in the workspace.

Workspace content: the records you enter or import, including files you upload for an import, and the emails you send from windeal or save to it with Smart BCC.

Connection data: if you connect Google or an AI assistant, the data described in the two sections below.

Technical data: server logs with the IP address, browser, time and path of each request (without query strings), and audit records of who revealed or exported sensitive fields.

Why we use it and on what legal basis

To provide windeal under our Terms of service, including service emails such as invitations, password resets and notices about your workspace (Art. 6(1)(b) GDPR).

To keep windeal secure, prevent abuse and keep audit trails, based on our legitimate interest in a safe service (Art. 6(1)(f) GDPR).

To meet legal obligations, for example to answer authorities (Art. 6(1)(c) GDPR).

We do not sell personal data, show advertising or build marketing profiles, and we make no decisions about you by automated means that have legal or similarly significant effects (Art. 22 GDPR).

Google user data

Connecting Google is optional. Signing in with Google and each Google feature ask for permission separately, only when you choose them, and a connection belongs to you alone. windeal requests the following permissions and no others.

Sign-in (openid, email, profile): your Google account identifier, verified email address and name. We use them to sign you in, to match your Google account to your windeal account and to fill in your name when you create a workspace. We keep the identifier and the email address with your account.

Calendar access (calendar.events): windeal creates and updates an event in your Google Calendar for each activity you schedule, with a Google Meet link if you ask for one. It reads changes in your primary calendar to keep those activities in step, to add a meeting to windeal when one of its attendees is a contact you can see, and to show your own events next to your activities in the calendar view. Events without such an attendee are not stored, attendee addresses are only compared and never stored, and the calendar view reads your events live without storing them.

Calendar access (calendar.freebusy): windeal reads only the busy and free time ranges of your calendar, and of teammates who connected their own calendars, so you can pick a free slot. No event details are read through this permission.

Send email from Gmail (gmail.send): windeal sends the emails you write in windeal from your own Gmail address, and keeps a copy on the deal’s timeline. This permission cannot read, change or delete any email. windeal never reads your mailbox.

windeal’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data only to provide the features above, which you can see in windeal. We do not sell it, transfer it to advertising platforms, data brokers or information resellers, use it for advertising or to assess creditworthiness, or use it to develop, improve or train generalized AI or machine learning models. People do not read it, except with your explicit agreement, when it is needed for security such as investigating abuse, to comply with the law, or in aggregated, anonymized form for internal operations.

Your Google refresh token is encrypted with your workspace’s key, and access tokens are kept only in server memory until they expire. When you click Disconnect in Settings → Integrations, windeal revokes its access at Google and deletes the stored tokens. You can also remove windeal at any time at https://myaccount.google.com/permissions. Activities, meetings and emails already saved in windeal stay in the workspace until you or your organization delete them, and the events windeal created stay in your Google Calendar. Your Google account identifier and email address are deleted with your account. When a workspace is deleted, windeal first asks Google to revoke every connection of that workspace and then destroys the workspace’s keys, which makes any remaining token unreadable.

AI assistants

You can connect an AI assistant that supports the Model Context Protocol, such as Claude by Anthropic or ChatGPT by OpenAI. You approve each connection on windeal’s consent page. The assistant then acts as you: it can search and read the records you can see, and create or update deals, contacts, notes and activities when you ask it to. It cannot delete anything or change workspace settings.

What the assistant reads goes to its provider, which processes it as a separate controller under its own terms and privacy policy, on your instruction. windeal runs no AI model of its own: speech, photos and documents are processed by your assistant, and windeal receives only the resulting requests. We never use your data to train AI models.

For each connection we store the assistant’s registration (its name and return address), who approved it and when, and hashes of its tokens. An access token expires after one hour, and a refresh token after 60 days without use. You can disconnect an assistant at any time in Settings → Integrations, which ends its access at once. If you use an assistant with your organization’s data, follow your organization’s rules on AI tools.

Browser extension

windeal for Chrome is optional. You install it from the Chrome Web Store and connect it to your windeal account on windeal’s consent page. It signs in with its own, narrower permission than an AI assistant, and you can disconnect it at any time in Settings → Integrations.

It reads only the email, LinkedIn profile or LinkedIn conversation you have open, and only when you click a windeal button. While its panel is open in Gmail, it sends the addresses of the open email to windeal to show who they are; that lookup is not stored. When you save an email, the extension reads the email’s original from Gmail in your browser and sends it to your workspace without attachments. When you add a person from LinkedIn, it sends their name, headline and profile link; when you save a LinkedIn conversation, it sends the messages shown on screen. LinkedIn features are off until you turn them on.

It sends data only to your own windeal workspace, never to third parties. It has no analytics, runs nothing in the background and never reads your passwords or cookies. Its sign-in tokens stay inside the extension, where the pages you visit cannot read them.

Saved emails and messages are stored like Smart BCC emails: encrypted with your workspace’s key, on the timelines of the people they match, and deleted with the workspace. Messages you import from your LinkedIn data download are private to you until you share them, and conversations with people who are not in windeal are never stored.

Limited Use: the extension uses the data it reads only to provide the features described here, which you can see in windeal. We do not sell it, use it for advertising or to assess creditworthiness, or use it to train AI models, and people do not read it except with your agreement, for security or to comply with the law.

Cookies and this website

This website sets no cookies and loads no third-party scripts. We may count visits with Umami, a cookieless statistics tool that runs on our own domain: it stores no cookies and no IP addresses and records only anonymous page views (page, referrer, browser, device type and country), based on our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR). The app itself uses two strictly necessary cookies: windeal_session keeps you signed in, and windeal_rw lasts 5 seconds after you save a change so that you immediately see your own update. Because both are strictly necessary, they need no consent.

Who receives data

windeal runs on servers we operate ourselves. We use these service providers, each bound by data processing terms: Cloudflare, Inc. (USA), which carries and protects the traffic between your browser and windeal and receives emails sent to Smart BCC addresses (Cloudflare Email Routing); and Brevo (Sendinblue SAS, France), which delivers service emails.

Google and your AI assistant’s provider receive data only when you connect them, as described above. Otherwise we share personal data only when the law requires it.

Transfers to Cloudflare outside the European Economic Area rely on the adequacy decision for the Data Privacy Framework and on standard contractual clauses. Apart from that and the services you choose to connect, we do not transfer personal data outside the European Economic Area.

How long we keep data

Account data: while your account exists.

Workspace content: until you or your organization delete it. A deleted workspace is erased permanently 30 days after deletion, and backup copies are overwritten within a further 30 days.

Server logs: up to 14 days. PII-read access log (including access to sensitive contact fields): kept for the current UTC calendar month and the previous 12 months. Older entries are removed during maintenance, though removal may be delayed if it fails. Security log (sign-ins and account changes, with a shortened network address): kept for the current UTC calendar month and the previous 12 months. Google and AI assistant connections: until you disconnect them, as described above.

Your rights

You may ask for access to your data, its correction or deletion, restriction of its processing and a portable copy, and you may object to processing based on our legitimate interests (Art. 15–21 GDPR). Where we rely on your consent, you may withdraw it at any time. Write to us at [email protected]; we reply within one month. You also have the right to lodge a complaint with a supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority where you live or work.

Security

Sensitive contact fields are encrypted with a key per workspace and shown masked by default. Passwords and connection tokens are stored only as hashes, and Google tokens only encrypted. Access is limited to the people who need it and is recorded in an audit trail. All traffic is encrypted in transit.

Children

windeal is a business tool and is not intended for anyone under 16.

Changes to this policy

We publish changes on this page and tell account owners about material changes before they take effect. We will ask for your consent before we use Google user data in a new way.