Privacy Policy

Effective Date: March 4, 2026 · Last updated: October 13, 2026

1. Introduction

This Privacy Policy explains how CallerPlugins ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our services, including:

• The CallerPlugins web dashboard at callerplugins.com
• The CallerPlugins browser extensions for CRMs ("CallerPlugins for Pipedrive", and for HubSpot, Teamleader, Zoho CRM, Odoo, Bitrix24 and monday CRM as they become available)
• The earlier CallerPlugins Viber Dialer and WhatsApp Dialer extensions for Pipedrive
• Our website at callerplugins.com

CallerPlugins is operated by Agenda 2050 (KVK 90748026), registered in the Netherlands. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable Dutch and European data protection laws.

2. Data We Collect

2.1 Account Information

When you register for an account or activate the browser extension, we collect:

• Full name
• Email address
• Password (stored as a bcrypt hash — we never store your actual password)
• Company/team name (derived from your email domain)
• Role within your team (admin, manager, or user)

When you activate a browser extension, we email a six-digit code to the address you enter, to confirm that it is yours. We store the code only in hashed form; it expires after 15 minutes. With the request we also record the IP address it came from, to prevent abuse. After you confirm, the extension keeps a random device key, which we also store only in hashed form, so we can recognise your confirmed address. We delete codes and IP addresses after 30 days.

To check that an email address can receive mail, we look up the mail servers of its domain (a public DNS lookup). No message is sent at that stage.

2.2 Billing & Payment Data

When you subscribe to a paid plan, payment processing is handled entirely by Stripe. We store:

• Stripe customer ID and subscription ID (references only)
• Subscription plan type, status, and billing dates
• Invoice amounts and payment status

We do not store your credit card number, CVV, or full payment card details. These are handled exclusively by Stripe in accordance with PCI-DSS standards.

2.3 Usage Data

We log the following when you use our services:

• Interaction logs: when you click a calling-tool button (WhatsApp, Viber, Telegram, Signal, Microsoft Teams, Zoom Phone, Google Voice or your softphone) in your CRM, we log the phone number, the contact's name as shown on that CRM page, the address (URL) of that page, which CRM and which CRM account it was (for example "yourcompany" in yourcompany.pipedrive.com, or your account number), the calling tool and whether it was a call or a message, direction, status and timestamp
• The extensions do not read, store or send the content of your messages or calls. They only open the app of the calling tool on your device with the selected number (and, if you choose a message template, with that text filled in).
• API request logs: endpoint, method, status code, and timestamp (for rate limiting and security)
• Whether a call was made on a free or pro plan

Free plan per company: all free usage of a calling tool within the same CRM account, or the same company email domain, counts toward one shared monthly allowance per tool. Other users in the same account can see how much of that allowance has been used, but not who used it or which numbers were called.

2.3a Message templates

Templates you create (name and text) are stored on our servers, linked to your account; team templates and rules are shared within your team. When you use a template, the extension fills in fields such as the contact's name, company or deal from the CRM page in your browser. Those field values are not sent to us.

2.3b CRM connection (Pro)

If a manager of your team connects your CRM in the dashboard, we store the access tokens the CRM gives us (encrypted with AES-256) and the CRM account identifier, until the connection is removed. For every Pro click we then send the CRM an activity with the phone number, the contact's name, the calling tool, the time and the email address of the user who clicked, so it appears on the contact in your CRM. For Odoo we store the Odoo address, database, login and API key you enter (the key encrypted). You can disconnect at any time in the dashboard; the tokens are deleted immediately.

2.3c Waitlist

If you ask to be told when CallerPlugins is available for a CRM, we store your email address, the CRM you asked for, your language and the page you used. We use this only to email you when that CRM is available, and delete it 12 months after that email or earlier at your request.

2.4 Session & Technical Data

• Session cookies (httpOnly, secure) for authentication
• Browser extension storage: your email address, device key, license keys, which calling tools you switched on and their settings (for example link type or button text), your free-allowance counters and a short-lived copy of your templates
• IP address (for rate limiting purposes only; not stored long-term)

2.5 License Key Data

• License key, type, activation status, and the associated user and team

3. How We Use Your Data

Purpose	Data Used
Provide and operate our services	Account info, usage data, session data
Process payments and manage subscriptions	Billing data (via Stripe)
Send transactional emails (welcome, payment confirmations, team notifications)	Email address, name
Enforce usage limits (free-tier limits) and show your interactions in your dashboard	Interaction logs, plan type
Security and abuse prevention	IP address, API logs, rate limiting data
License key validation	Email, license key
Weekly usage digest emails	Email, team usage statistics

We do not sell your personal data to third parties. We do not use your data for advertising or profiling purposes.

4. Legal Basis for Processing (GDPR)

We process your personal data on the following legal grounds:

• Contractual necessity (Art. 6(1)(b) GDPR) — Processing required to provide our services, manage your account, and fulfill subscriptions.
• Legitimate interest (Art. 6(1)(f) GDPR) — Security measures, rate limiting, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a) GDPR) — Optional marketing communications or weekly digest emails (you can opt out at any time).
• Legal obligation (Art. 6(1)(c) GDPR) — Tax and financial record-keeping requirements.

5. Third-Party Services

We share data with the following third-party processors, each operating under their own privacy policies and GDPR-compliant data processing agreements:

Service	Purpose	Data Shared
Stripe (USA)	Payment processing	Email, name, payment details
Hostinger (EU)	Transactional emails (confirmation codes, welcome and account emails)	Email address, name
Hostinger (EU)	Web hosting and database	All service data (stored on EU servers)
Google Chrome Web Store	Extension distribution	No user data shared by us
Your CRM provider (only if your team connects it, Pro)	Logging clicks as activities in your CRM	Phone number, contact name, calling tool, time, user email

Calling tools: the extensions open WhatsApp (Meta), Viber (Rakuten Viber), Telegram, Signal, Microsoft Teams, Zoom, Google Voice or the softphone you set up, on your own device or in your browser, with the selected phone number. We do not send any data to these providers. Your use of these tools is governed by their own privacy policies.

6. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data: Retained while your account is active and up to 12 months after deletion request, to allow for reactivation.
• Interaction logs (calls and messages of all calling tools): Retained for up to 24 months for usage analytics and billing verification.
• CRM connection tokens: Until the connection is removed in the dashboard or the account is deleted.
• Waitlist entries: Until 12 months after we told you the CRM is available, or earlier on request.
• API request logs: Retained for up to 90 days for security and debugging.
• Billing records: Retained for 7 years to comply with Dutch tax obligations.
• Session data: Automatically expires and is deleted upon session timeout.

7. Data Security

We take the security of your data seriously. Measures include:

• Passwords are hashed with bcrypt (never stored in plain text)
• Sessions use httpOnly and secure cookies (in production)
• Helmet.js for HTTP security headers
• CORS restricted to our frontend domain
• Rate limiting on authentication endpoints (15 requests/minute)
• Database access restricted and encrypted in transit
• CRM access tokens and API keys stored encrypted (AES-256-GCM)

8. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — Request deletion of your personal data.
• Right to restrict processing — Request that we limit how we use your data.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interest.
• Right to withdraw consent — Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at the address listed below. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

9. Cookies

Our services use a minimal set of cookies:

• Session cookie (essential) — Required for authentication on the dashboard. HttpOnly and secure. Expires when the session ends.
• CRM connection cookie (essential) — A random value kept for at most 15 minutes while you connect your CRM, so the connection can only be completed in the browser that started it.
• Chrome extension local storage — Stores your email address, license keys, tool settings and counters locally in your browser. This data is not transmitted to third parties.

We do not use advertising cookies, tracking cookies, or analytics cookies. For more details, see our Cookie Policy.

10. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or a prominent notice on our website. The "Effective Date" at the top reflects the most recent revision.

12. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, contact us: