Privacy Policy

Salesling is a product of Codeks LLC, a Delaware limited liability company. For website visitors and workspace users, the controller is Codeks LLC, [Postal address — pending]. Privacy questions and requests: [Privacy email — pending].

For leads and prospects (section 4), the controller is the Salesling customer whose agent contacted you or whom you contacted; Salesling processes that data on the customer’s behalf.

For the Company Index (section 5), Codeks LLC is the controller.

• Server logs (IP address, browser, pages requested, time) — kept by our hosting provider to deliver the site and keep it secure. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
• No tracking. We use no analytics, advertising pixels or third-party tracking cookies. We only store what the site needs to work: a sign-in session cookie, your sidebar and theme preference, and — in our chat widget — a random session identifier so a conversation survives a page reload. These are strictly necessary and need no consent.

We process:

• Account data — name, work email, company, company website, how you heard about us, sign-in method. Basis: performing our contract with your company (Art. 6(1)(b)) and our legitimate interest in managing customer accounts (Art. 6(1)(f)).
• Billing data — billing contact, company address, VAT ID, payment method (held by Stripe, not us), invoices and usage counts. Basis: contract and legal obligations such as tax records (Art. 6(1)(b), (c)).
• Usage and audit data — actions in the app, approvals, settings changes, security logs. Basis: legitimate interest in security, abuse prevention (for example one trial per company domain) and support.
• Service emails— usage alerts, “drafts ready” and trial notices. Basis: contract. We do not send marketing email without consent.

We keep account data for the life of the workspace and delete it when the workspace is deleted — 60 days after an unconverted trial ends, or on request. Invoices and tax records are kept for the statutory retention period (up to 10 years).

Salesling customers use our AI agents to answer people who contact them (“Leads”) and to research and write to business contacts that fit their target profile (“Prospects”). If you received a message from a company through Salesling:

• Who decides: the company that wrote to you is the controller. It chose to contact you and is responsible for the lawful basis — typically its legitimate interest in business development (Art. 6(1)(f)). Salesling acts as its processor under a data processing agreement.
• What is processed:your name, business email address, job title, company and country; information about your company from public sources such as its website; and the messages you exchange. Prospect email addresses come either from public sources or from a list the customer uploaded; we may check that an address’s domain accepts mail. We do not buy contact data and do not process special-category data.
• AI disclosure: every message written by the AI says so, as required by Article 50 of the EU AI Act.
• Opting out:every outreach email has an opt-out link. Using it, or replying that you don’t want to be contacted, stops all further messages and adds your address (and for outreach, your company domain) to a suppression list so you are not contacted again by that customer. It also removes you from our Company Index (section 5), and no other Salesling customer will write to that address through Salesling. We keep only the minimum needed to honor the opt-out.
• Your rights:contact the company that wrote to you. If you can’t reach them, write to us and we will forward your request and help them answer it.

To help customers find companies that fit what they sell, Salesling keeps its own index of companies. Company facts (name, website, industry, city, size) come from open data and from the companies’ own websites. The index also lists people whom a company names on its own website.

• What we collect about you:your name and job title as your employer publishes them, the business email address the company publishes for you (if any), the address of the page where we found you, and whether that address accepts mail and when we last checked. We find people only on a company’s own legal notice, team, about and contact pages. We never collect from social networks, never buy contact data and never process special-category data.
• Checking an address:to avoid writing to addresses that don’t exist, we ask the company’s mail server whether it accepts the address, without sending a message. An address checked more than 90 days ago is checked again before anyone writes to it.
• Why, and on what basis:our legitimate interest, and our customers’, in business-to-business contact with the people a company itself presents as its contacts (Art. 6(1)(f) GDPR). We keep only what your employer published, record where it came from, and let you object at any time.
• Who sees it: a customer sees you only when your company matches what it sells and its agent picks you. From then on that customer is responsible for contacting you, as described in section 4.
• How long: for as long as the source page names you. We re-read company pages every 60 to 90 days and delete anyone a page no longer names.
• Objecting, access and deletion: write to [Privacy email — pending] with the address concerned. We send you what we hold, or remove you from the index and from every customer’s prospect list in one step. Opting out of any email sent through Salesling does the same for the index. To keep you out, we store only a one-way fingerprint (a hash) of your address and of your name at that company, never the address itself.
• Why we don’t write to tell you: we did not get your details from you. Contacting everyone in the index to say so would mean emailing people who never asked to hear from us. This notice is published instead (Art. 14(5)(b) GDPR).

We use service providers for hosting, AI model inference, email and payments. Each is bound by a data processing agreement and may only use the data to provide its service to us. The current list, with locations, is on our sub-processors page. We do not sell personal data. We disclose data to authorities only where the law requires it.

Our primary database is in Frankfurt, Germany. Some providers — including our AI model providers — process data in the United States, and Codeks LLCis itself a U.S. company. These transfers are protected by the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU-U.S. Data Privacy Framework. Our AI providers do not use the data to train their models.

Each customer’s data is isolated at the database level, all traffic is encrypted in transit, data is encrypted at rest by our database provider, connection secrets are inaccessible to app users, and security-relevant actions are written to an immutable audit log. Details are in Annex 2 of our Data Processing Agreement.

Under the GDPR you can ask for access to, correction or deletion of your data, restriction of processing, and a portable copy; you can object to processing based on legitimate interest, and withdraw any consent at any time. Write to [Privacy email — pending]. We answer within one month.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

We make no decisions with legal or similarly significant effects about you based solely on automated processing. The AI qualifies and replies to business inquiries; a person at the customer can take over any conversation.

We will update this policy when our processing changes and show the new effective date above. Material changes are announced to workspace owners by email.