Privacy Policy

1. Who is responsible for your data

The controller of personal data processed through the website and application at onboardingcustomers.com is the administrator of the onboardingcustomers.com service (referred to as "we" or "us"). You can reach us about anything in this policy at [email protected].

Our customers are businesses that use OnboardingCustomers to onboard their own clients. When a customer invites its clients into a portal, uploads their documents or imports their details from a CRM, the customer decides what data goes in and why. For that customer content we act as a processor on behalf of the customer, and the customer is the controller. If you are a client contact invited to a portal, the company that invited you is your first point of contact for questions about your data, and we will help them answer.

2. Data we collect

Account and workspace data

• Name, email address and password (stored only as a one-way hash) of each team member.
• Workspace name, branding settings, role of each member, plan and billing period.
• Onboarding templates, plans, tasks, notes and comments your team creates.

Customer contacts invited to portals

• Name, email address and role of each contact your team adds, the personal magic link token, and the time the contact last opened the portal.
• Answers to intake forms, comments, task completions and kickoff bookings made in the portal.

Files and signatures

• Documents uploaded by your team or by customer contacts, together with file name, size and type.
• For electronic signatures, the signer name and email, the IP address, browser details, the time of each signing event and a hash of the signed document.

CRM data

• When you connect HubSpot, Salesforce or Pipedrive, deal and contact fields you choose to import, such as deal name, amount, products, stage, close date and contact details. OAuth tokens for these connections are stored encrypted.

Text submitted for plan generation

• Statements of work, order forms or deal descriptions you paste or sync so a plan can be generated, and the generated plan. The anonymous demo on the homepage stores a short excerpt of the submitted text, the generated plan and a hashed form of the IP address, to apply the daily demo limit.

Usage and technical logs

• Sign-ins, actions in the application, an audit log of changes, IP addresses, browser type and error logs.

Payment data

• Payments are handled by a payment processor. Card numbers are entered directly with that processor and never reach our servers. We receive the billing name, email, country, tax identifier if given, the last digits and expiry of the card, and the status of each payment and subscription.

3. Why we use data and our legal bases

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases.

• Providing the service (account, workspace, plans, portals, files, signatures, CRM sync, emails such as reminders and magic links): performance of the contract with the account holder, Article 6(1)(b) GDPR. For customer content, processing on documented instructions of our customer under Article 28 GDPR.
• Billing, invoices and tax records: compliance with legal obligations, Article 6(1)(c) GDPR, and performance of the contract.
• Security, fraud and abuse prevention, audit logs and the signature audit trail: our legitimate interests and those of our customers in keeping the service and their records secure and provable, Article 6(1)(f) GDPR.
• Service emails about your account, such as payment receipts, limit warnings and changes to these policies: performance of the contract and legitimate interests.
• Improving the product using aggregated usage information: legitimate interests. We do not use customer content to train AI models.

We do not sell personal data and we do not use it for advertising.

4. Who receives data

We share data only with service providers that help us run OnboardingCustomers, under contracts that bind them to confidentiality and data protection obligations. These are the categories of recipients:

• a hosting provider in the European Union, which stores the application, database and files;
• a payment processor, which handles card payments and subscriptions;
• an email delivery provider, which sends service emails such as reminders, magic links and receipts;
• an AI model provider, which receives the text submitted for plan generation and returns the plan;
• the CRM providers you choose to connect (HubSpot, Salesforce or Pipedrive), which exchange deal data with the service under your own agreement with them.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and the service.

5. International transfers

Application data and files are hosted in the European Union. Some providers listed above, such as the payment processor, the email delivery provider, the AI model provider and the CRM you connect, may process data outside the European Economic Area. Where they do, transfers rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses with appropriate additional safeguards.

6. How long we keep data

• Account and workspace data: for as long as the account exists. After an account is closed, workspace content is deleted within 90 days, except where a longer period is required below.
• Customer content (contacts, files, forms, plans): while the workspace exists or until your team deletes it. Backups are overwritten on a rolling schedule.
• Signature audit trails and signed documents: for the life of the workspace, because they serve as evidence of the signature, unless the customer deletes them.
• Invoices and billing records: for the period required by tax and accounting law.
• Anonymous demo records: up to 30 days, unless you create an account and claim the demo plan.
• Security and usage logs: up to 12 months.

7. Your rights

Subject to the conditions in the GDPR and other applicable law, you have the right to access your personal data, to have it corrected, to have it deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. You can also lodge a complaint with a data protection supervisory authority in the country where you live or work.

To use any of these rights, email [email protected]. If your data was added by one of our customers, for example because you were invited to an onboarding portal, we will pass your request to that customer and support them in answering it. We may ask you to confirm your identity before acting on a request.

If you live in a US state with a consumer privacy law, you have similar rights to know, correct and delete your data, and you will not be treated differently for using them. We do not sell or share personal data for cross-context behavioral advertising.

8. Children

OnboardingCustomers is a business service. It is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We use role-based access for team members, an audit log, personal revocable magic links for customer contacts, file checks on upload, encryption of CRM tokens, HTTPS for all traffic, EU hosting and regular backups. More detail is on our security page. No system is perfectly secure, and we will notify affected customers and authorities of a personal data breach where the law requires it.

10. Cookies

We set only cookies that are strictly necessary for the service to work. The details are in our Cookie Policy.

11. Changes to this policy

We may update this policy when the service or the law changes. Material changes are announced by email to account owners or in the application before they take effect. The version published at this address is the one that applies.

12. Contact

For any question about this policy or your data, write to [email protected].