Privacy Policy
Last updated: 25 October 2026
1. Data Controller
The data controller for the processing of personal data described in this Privacy Policy is:
KCraft Studio LTD
Neofytou Nikolaidi & Theod. Kolokotroni
ONISIFOROU CENTER, 2nd floor, Agios Theodoros
8011 Paphos, Cyprus
Email: hello@callrix.io
Website: callrix.io
We have not appointed a data protection officer because we are not required to under Art. 37 GDPR.
This Privacy Policy applies to the Callrix website (callrix.io) and the business relationship between Callrix and its Licensees (B2B customers). The platform at app.callrix.io (sign-up, console and licence billing) has its own privacy notice in German. For End Users of a Licensee's branded platform, the Licensee is the data controller and must provide their own privacy policy; Callrix processes that data only as the Licensee's processor.
2. What Data We Collect
2.1 Account Data
When you sign up as a Licensee, we collect:
- Full name and company name
- Email address
- Phone number (if provided)
- Billing address
- The version of the licence terms and the data processing agreement you accepted, with time and IP address
2.2 Payment Data
Licence fees and the revenue share are billed through Stripe Payments Europe, Limited, Dublin, Ireland. Callrix does not store credit card numbers, CVVs, or full bank account details on its own servers. For the revenue share, we send Stripe only the net amount of each completed call and each answered chat message with its time and your Stripe customer ID, no data about your End Users or advisors. Stripe processes payment data in accordance with Stripe's Privacy Policy.
2.3 Usage Data
We collect data about how you use the Platform:
- Login timestamps and frequency
- Features accessed and actions taken in the admin dashboard
- Number of advisors, End Users, and calls on your platform
2.4 Communication Data
We store communications between you and Callrix, including emails, support requests, and onboarding call notes. If you book a demo through our booking page (appointment.kcraft.io), we process the details you enter there to arrange and hold the meeting.
2.5 Technical Data
When you visit our website or use the Platform, our servers automatically process:
- IP address
- Browser type and version
- Operating system and device type
- Pages visited and time spent
- Referring URL
3. Legal Basis for Processing (Art. 6 GDPR)
| Purpose | Legal Basis |
|---|---|
| Providing the Platform and fulfilling the license agreement | Contract performance — Art. 6(1)(b) |
| Processing payments and billing | Contract performance — Art. 6(1)(b) |
| Proof of the accepted terms and data processing agreement | Contract performance and legitimate interest — Art. 6(1)(b) and (f) |
| Security monitoring, fraud prevention, and abuse detection | Legitimate interest — Art. 6(1)(f) |
| Website statistics without cookies (Matomo) | Legitimate interest — Art. 6(1)(f) |
| Marketing communications | Consent — Art. 6(1)(a) |
| Tax records and accounting obligations | Legal obligation — Art. 6(1)(c) |
4. How We Use Your Data
- To provide, operate, and maintain the Callrix Platform
- To process payments, issue invoices, and manage subscriptions
- To communicate with you about your account, support requests, and service updates
- To monitor and improve Platform performance, reliability, and security
- To detect and prevent fraud, abuse, or unauthorized access
- To comply with legal obligations (tax, accounting, regulatory)
5. Data Sharing & Sub-Processors
We do not sell, rent, or trade your personal data. We share data only with the following service providers:
| Recipient | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting, including our self-hosted call infrastructure (LiveKit), error logging (GlitchTip), statistics (Matomo) and demo booking | Germany (EU) |
| Stripe Payments Europe, Limited | Billing of licence fees and the revenue share | Ireland (EU) |
| Plus Five Five, Inc. (Resend) | Sending system emails | USA (EU-U.S. Data Privacy Framework, EU SCCs) |
6. International Data Transfers
The Platform and all primary data storage are hosted in the European Union (Hetzner, Germany). System emails are sent through Resend in the USA. This transfer is based on the EU-U.S. Data Privacy Framework, under which Resend is certified, and additionally on the EU Standard Contractual Clauses (Chapter V GDPR).
7. Data Retention
- Active account: Data is retained for the duration of the license agreement.
- After termination: Account data is retained for 30 days to allow for data export, then permanently deleted.
- Financial records: Invoices, payment records, and tax-relevant data are retained for 7 years as required by applicable tax and accounting laws.
- Communication records: Support correspondence is retained for 2 years after the last interaction.
- Technical logs: Server logs and access logs are retained for 90 days, then automatically purged.
8. Your Rights (Art. 15–22 GDPR)
As a data subject under the GDPR, you have the following rights:
- Right of access (Art. 15): You may request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations.
- Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
- Right to data portability (Art. 20): You may request your data in a structured, machine-readable format (JSON).
- Right to object (Art. 21): You may object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at hello@callrix.io. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (www.dataprotection.gov.cy). You can also contact the authority in the country where you live or work.
9. Cookies & Tracking
The Callrix website (callrix.io) does not set cookies. The platform at app.callrix.io only uses technically necessary cookies and local storage, for example to keep you logged in.
We measure visits with a self-hosted Matomo instance on our own servers in the EU. Matomo runs without cookies, only records the page address without query parameters other than campaign tags (utm_, mtm_, pk_), respects the Do Not Track setting of your browser and does not share data with third parties. You can object to this at any time by turning on Do Not Track.
We do not use third-party tracking cookies, advertising cookies, or retargeting services. We do not use Google Analytics, Facebook Pixel, or similar third-party tracking services.
10. Security Measures
We implement appropriate technical and organizational measures to protect your personal data:
- All data transmitted between your browser and our servers is encrypted via TLS (HTTPS).
- Passwords are hashed using BCrypt with a cost factor of 12.
- Authentication uses JWT tokens with expiration and refresh mechanisms.
- Rate limiting is applied to all sensitive endpoints to prevent brute-force attacks.
- Stripe webhook signatures are verified to prevent tampering.
- Wallet operations use pessimistic database locking to prevent race conditions.
- All infrastructure is hosted within the EU on Hetzner servers in Germany.
- TLS certificates are issued automatically by Let's Encrypt.
11. Children
Callrix is a B2B service directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected data from a minor, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. For material changes that affect how we process your data, we will notify you via email at least 30 days before the changes take effect.