Privacy Policy

Name

Novak Janković PR Sajtpress

Registration no. (MB)

66213706

Tax ID (PIB)

112590107

Address

Lipovički put 110, Barajevo 11460

Email

aisolutions@sajtpress.rs

We have not appointed a data protection officer. Write to us at the address above about anything concerning your data.

We are the controller of the data we collect for ourselves: visits to the public pages, demo requests, and the accounts of the people who sign in to the CRM.

We are a processor for everything an organization keeps in its own CRM workspace — its companies, contacts, leads, deals, emails, meetings, quotes and invoices. That organization is the controller of that data and decides what goes in it; we process it only to provide the CRM, on its instructions. If your details are in a client's workspace, that client is the one to ask first (section 12).

The landing page, the thank-you page and these legal pages use no analytics, advertising or tracking, and load nothing from other websites: fonts and images are served from crm.sajtpress.rs itself.

Your IP address is used for a moment to limit how often a form can be sent, and is not saved with what you send. Like any web server, our hosting provider’s server keeps technical access logs (IP address, time, address requested, browser) for security and troubleshooting, and replaces them on its own schedule.

When you request a demo we receive what you type in the form: your name, email, company, phone and message. It is saved as a lead in our own CRM workspace, and our team is notified in the CRM, and by email from our own mailbox if nobody has seen it there. If you write to us by email instead, we keep that correspondence.

We use it only to reply, to arrange the demo and, if you decide to use the CRM, to set up your workspace. The legal basis is taking steps at your request before a possible contract, and our legitimate interest in answering enquiries. We do not add you to a mailing list.

Businesses our team finds through the Sajtpress platform can be added to the same workspace. How that platform collects them is explained in its own privacy policy.

The live demo. “Try the live demo” creates a separate demo workspace for you, filled with fictional sample data, and signs you in to it with the session cookie (section 11) — we ask for no name or email. What you type into it stays in that workspace and is deleted with it: a day after your last visit, three days after you started it at the latest, or at once when you click End demo. Nothing is sent from a demo workspace — no email, AI request, webhook, calendar feed or API access — and its public links (quotes, invoices, forms, booking pages) open only for you. Please don’t enter real people’s data in it.

To keep the demo from being abused, the number of demos per IP address is limited: the address is the one already kept with the demo’s sign-in session (section 5), and it is deleted with the demo. To see how the demo is used, we count — under a random number that is not linked to you, your IP address or your browser — that a demo was started and in which language, which areas of the CRM were opened, which features that a demo leaves off were tried, resets, role switches, how it ended, and whether the request form was opened or sent. These counts hold no personal data and are kept for 90 days. If you send a demo request from inside the demo, the lead it creates notes that it came from the demo. The legal basis is our legitimate interest in letting people try the CRM, keeping it from being misused and improving it.

Accounts are created by the owner or an admin of a workspace — there is no public sign-up. For each account we keep:

• name, email address and role, and the time of the last sign-in;
• the password, only as a one-way scrypt hash;
• two-factor settings: the secret encrypted, the recovery codes hashed;
• sign-in sessions with the IP address and the browser and device description;
• an audit log of security-relevant actions (sign-ins, failed sign-ins to an existing account, changes to users, settings and exports) with the IP address and browser;
• notifications, notification and digest preferences, and an optional private calendar-feed link (stored only as a hash);
• Help Center use: articles read, searches, feedback, questions to the help assistant, support tickets and feature requests.

The legal basis is the contract with the organization you work for, and our legitimate interest in keeping the CRM secure (sessions, logs, alerts). When you open a support ticket or post a feature request, our support team sees it with your name, email and the workspace’s name — but not the records in your workspace.

What a workspace holds is decided by the organization that uses it. Some features move data outside the CRM, and each of them is switched on by that organization:

• Email is sent through the organization’s own mail server (SMTP). With IMAP access added, the CRM reads the sender and subject of new incoming messages to log replies from known contacts, and reads bounce notices to find addresses that bounced; it does not store message bodies.
• Email tracking: emails can carry a small image and tracked links. The CRM records whether and when an email was opened or a link clicked, and keeps automated opens (privacy proxies, link scanners) apart. The IP address and browser are used only to tell those apart and are not stored; which link was clicked is not stored either. The sender can switch tracking off. Every email carries an unsubscribe option, and an address that unsubscribes or bounces goes on that workspace’s do-not-email list.
• AI features use Anthropic’s API (USA) with the organization’s own API key. Anthropic receives the text a task needs — for example a deal’s or lead’s details and recent activity — and returns the generated text; the CRM does not log the request or the answer, except questions asked in the Help Center. Where a workspace has no key of its own and we have connected it to our Sajtpress platform, the request goes through that platform and the AI providers named in its privacy policy.
• Calendar links: when a user adds a calendar’s iCal address, the CRM reads the busy times and event titles from it, from 2 days back to 150 days ahead, to show busy times and offer free booking slots. The address is stored encrypted.
• Public links a workspace shares — a lead form, a quote, an invoice or a booking page — let people outside it send their details to that organization: a lead form sends name, email, company, phone and message; accepting or declining a quote records the decision and an optional name; booking a meeting sends name, email, company, a note and the time.
• Webhooks send a record’s data, or security alerts, to an address an admin of the workspace sets.
• Voice notes use your browser’s own speech recognition; in Chrome, Google processes the audio, and the CRM receives only the text.

• TrueFalse Hosting (Serbia) hosts the CRM, its database and its files, on a server in Hetzner’s data centre in Germany.
• Anthropic (USA), only for workspaces that use the AI features, as described in section 6.
• The organization’s own email provider, for the email that workspace sends and receives.
• Whatever a workspace connects: its webhook addresses, the calendar it subscribes to, and the calendar app that subscribes to its meetings.

We do not sell personal data and do not use it for advertising. We disclose it to public authorities only where the law requires it. People at Sajtpress who run the server can technically reach the database; we access a workspace’s data only to operate, secure and support the CRM, or where the law requires it.

The server is in Germany, an EU member state, which the ZZPL treats as providing an adequate level of protection. Anthropic is in the USA: data goes there only when a workspace uses the AI features with its own key, under that organization’s agreement with Anthropic and the safeguards Anthropic offers — or, for a workspace connected to our Sajtpress platform without a key of its own, to the AI providers that platform’s policy names.

• Demo requests: as long as we need them to answer and follow up, or until you ask us to delete them; if you become a client, for as long as we work together.
• Live demo workspaces, with everything typed into them and their sign-in session: deleted a day after the last visit, three days after the start at the latest, or when the visitor ends the demo. Anonymous demo usage counts: 90 days.
• Sign-in sessions: end at sign-out or after 30 days at most, and stop working after 7 days without use; the session record (with its IP address) is deleted by day 30.
• Notifications: 180 days. Error log: 30 days. Automation run history: 90 days.
• Deleted companies, contacts, deals and leads wait in the trash for 30 days, so a mistake can be undone, and are then removed for good.
• Audit log, security alerts, sent emails and the do-not-email list: for as long as the workspace exists. The do-not-email list is kept so that an address that opted out is not emailed again.
• Workspace data: for as long as the workspace exists. Its owner can delete the whole workspace at any time (section 12).
• Help Center tickets, feature requests and help searches: there is no automatic deletion; we delete them when you ask.
• Backups made by our hosting provider are replaced on its own schedule, so deleted data can remain in a backup until it is overwritten.

Where accounting or tax law requires us to keep a record for longer, we keep it for as long as that law requires.

The CRM is served only over HTTPS. Passwords are hashed with scrypt; two-factor secrets, mailbox passwords, AI keys and calendar addresses are encrypted with AES-256-GCM; session, password-reset, API-key and email-link tokens are stored only as SHA-256 hashes. Sign-in supports two-factor authentication, which a workspace can require; repeated attempts are rate-limited, and security-relevant actions are logged, the most important ones with an alert to the workspace’s owners and admins. Workspaces are kept apart in every query. No system is perfectly secure, but we take these and other reasonable measures, and if a breach affects your data we will act as the ZZPL requires.

We use only the cookies the CRM needs to sign you in. None is set for a visitor who does not sign in or start the live demo:

• __Host-crm_session keeps you signed in. With “Remember me” (on by default) it lasts up to 30 days; without it, until you close the browser. A session not used for 7 days stops working. In the live demo it lasts until the demo ends, three days at most.
• __Host-crm_mfa holds the two-factor step of signing in, for 10 minutes.
• __Host-crm_sso_state is set only when you choose “Continue with Sajtpress”, and protects that sign-in from forgery for 5 minutes.

All three are first-party, sent only over HTTPS, and cannot be read by scripts on the page.

Some choices are kept in your browser’s local storage and never sent to us: your light or dark theme (theme, only after you use the switch), that you have closed the cookie notice (crm-cookie-notice), and inside the CRM, display preferences such as the sidebar, list layouts, saved views and the notification sound.

We use no analytics, advertising or third-party cookies. Because the cookies above are strictly necessary for a service you ask for, we do not ask for consent; the notice on our pages only tells you about them.

You have the right to access your data and receive a copy, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to us at aisolutions@sajtpress.rs. We reply within 30 days; in complex cases this can be extended by up to 60 days, and we will tell you if it is.

If your details are in a client’s workspace, that organization decides about them: ask it first. If you write to us, we will pass your request on and help the organization answer it. To stop emails from a workspace, use the unsubscribe option in any of them.

If you use the CRM, your workspace’s owner or admin can change your role or disable your account; write to us or to them for anything else. A workspace owner can export the workspace’s data as one file (attachments are downloaded one by one) and delete the whole workspace in Settings → Organization.

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

We will publish any change to this policy on this page and update the date at the top.