Operator and scope
Redomon is operated by Manuel García Nicastro, an individual operator, CUIT 20-50046009-2, based in La Plata, Buenos Aires, Argentina. Contact hello@redomon.com for privacy requests and to obtain copies of applicable safeguards.
This notice covers our global business-to-business SaaS, including business representatives and individuals whose data a customer lawfully processes. Rights and obligations depend on the laws applicable to the person and activity; a business-use service is not exempt from privacy law. References to Argentina identify the operator’s jurisdiction and any applicable local duties, not the service’s target market.
Controller and processor roles
We distinguish service administration from customer-controlled content. We are the controller of account, contact, billing-administration and security data used for our own legitimate service operations. A business customer is normally the controller of personal data it puts into CRM or collects through Product Analytics, and Redomon is its processor under the DPA. If a customer acts for another controller, Redomon is a subprocessor. Polar independently determines processing for its merchant-of-record sale, payment, tax and fraud responsibilities. Provider roles depend on the actual activity, not just the provider’s name.
This notice covers Redomon CRM and Redomon Product Analytics, together with the workspace Hub, mail integration, AI, documents and file storage. It distinguishes the content a customer instructs us to process from our own account, support, billing and security administration.
Account and operational data
Account data includes your email, name or profile information you provide, authentication identifiers, organization membership and assigned roles. Clerk manages authentication and organizations. We receive billing customer and subscription identifiers, plan, seats, transaction references and usage summaries through Polar. Polar and its payment providers collect payment details directly. We do not collect full payment card numbers in Redomon’s interface.
Hosting and security operations may process IP addresses, request time, browser and device information, authentication events, error details and limited request metadata. Support messages contain your contact details and what you choose to share. We ask you not to include credentials or sensitive customer content in support tickets.
CRM, mail and product analytics
CRM customer data may include contact names, business email addresses and phone numbers, employers, companies, deals and pipelines, notes, case histories and attachments. Mailbox synchronization may copy message bodies, subjects, headers, sender and recipient details, attachments and synchronization metadata into Redomon. We obtain this data from the customer, its authorized users and connected mailbox providers, not necessarily directly from the people described in it. A customer may store information about prospects, customers, suppliers, staff, correspondents and people mentioned in messages.
Product Analytics data includes customer-defined event names, timestamps, page or product usage, properties, user or visitor identifiers and associated device, browser, network or referral context supplied by the customer integration. Funnels and retention reports organize those events. A customer can associate activity with a CRM contact, making otherwise pseudonymous activity identifiable. Customers control event collection, identification and CRM linking, must disclose those practices and obtain any legally required consent, and must not send passwords, payment-card details or sensitive information in event properties or URLs. Product Analytics is customer-instructed processing, not permission for Redomon to track people across customers for its own advertising.
Connecting a mailbox is an instruction to process the disclosed mailbox data, not consent on behalf of every correspondent. Customers must establish an appropriate lawful basis, provide notices including indirect-collection notices where required, respect correspondence secrecy and workplace rules, and minimize imported data. Sensitive personal data, criminal-offence data and regulated records are not an intended use unless specifically agreed in writing with appropriate safeguards. Accidental inclusion in email does not create permission to use that information.
Purposes and lawful bases
We use account details to create and secure accounts, manage access and provide requested service. Where EU GDPR or UK GDPR applies, the basis is performance of a contract with an individual subscriber, or legitimate interests in providing business services and managing relationships with a corporate customer and its personnel. Our legitimate interests also cover proportionate security, abuse prevention, troubleshooting and responding to inquiries, subject to balancing those interests against individual rights. Legal obligations justify required tax, accounting and compliance records. Optional processing requiring consent will be separately explained and will not be inferred from accepting these terms. Where Argentine privacy law applies to the processing, we use consent or its applicable statutory exceptions, including necessary contractual processing. GDPR legitimate interests are not an automatic substitute for a lawful basis required by another applicable law.
Customer content is processed only on documented customer instructions to supply the enabled service, maintain its security and comply with applicable law, as the DPA explains. We do not sell personal information, use CRM or email contents for advertising, or use customer data to train general-purpose AI models. We do not use AI to make solely automated decisions about individuals with legal or similarly significant effects.
AI processing
For customer-requested AI features, the necessary prompt and selected context may be sent to a provider identified to the customer before processing. AI inference uses zero data retention: the provider does not store inputs or outputs or use them for training. Redomon may retain source CRM records and outputs saved by the customer as customer data. Provider zero retention is not zero retention throughout Redomon. Provider disclosure and applicable transfer safeguards follow the DPA and subprocessor notice procedure.
Recipients and international transfers
Authorized service providers receive data necessary for their functions. Cloudflare provides hosting, request delivery and object storage; Neon provides PostgreSQL infrastructure; Clerk provides accounts and organizations. Polar processes purchases and related administration. The subprocessors page distinguishes customer-data subprocessors from providers processing our controller data. We may share necessary data with professional advisers under confidentiality, competent authorities where legally required, or a successor taking over the service subject to equivalent protections and prior notice where required. We do not give an acquirer permission to repurpose customer content.
Argentina benefits from an EU adequacy decision for covered transfers while that decision remains applicable. Other transfers requiring safeguards under GDPR must use an appropriate mechanism, such as applicable European Commission standard contractual clauses with completed annexes and necessary supplementary measures, or a valid adequacy framework where the recipient and processing qualify. Acceptance of these terms is not a blanket transfer waiver. Argentine-protected data separately requires compliance with Ley 25.326 and applicable AAIP rules, using recognized adequate destinations, approved model clauses or another lawful route. Ask us for the applicable safeguards; confidential commercial details may be redacted.
Primary database storage and application Workers are hosted in Frankfurt, Germany. This is a service-region commitment, not a guarantee that all processing occurs in the EU. Cloudflare edge delivery, provider operations and support, customer-selected mailbox services, separately disclosed AI processing and necessary operator access from Argentina may involve other countries. Object storage, backup and onward-processing locations are governed by the disclosed provider configuration and applicable transfer safeguards; no EU-only processing or Frankfurt object-storage guarantee is made.
Retention, export and deletion
We keep account and workspace administration data while needed to provide active service. We keep customer content for the customer’s instructed service duration and follow the DPA when it requests deletion or ends service. Disconnecting a mailbox stops new sync but does not erase imported copies or originals at the mailbox provider. Saved AI outputs follow the same customer-content rules. You can request a usable export and deletion through hello@redomon.com even where self-service controls are not available.
Customer data is retained for the enabled service, documented customer instructions and applicable legal obligations. You may request return or deletion at hello@redomon.com. Applicable rights deadlines take priority. Any legally retained copies must remain restricted to their permitted purpose, and deletion instructions must be reapplied following restoration. This notice does not promise a fixed active-system cleanup or backup expiry schedule.
Unless you request earlier deletion, the post-termination export window lasts 30 days and permits retention solely to return your data. We delete customer content from active systems within 30 days after that window ends. A validated deletion instruction is carried out without undue delay and within the shortest applicable legal deadline; the routine cleanup period does not extend those deadlines. Restricted backup copies expire within a further 90 days after active-system deletion, only where that limited retention is lawful. They remain isolated from ordinary use, and deletion instructions are reapplied after restoration. Legally required retention is limited to relevant records, restricted to its lawful purpose, and ends when its justification ends.
Your rights and requests
You may ask for access, correction, updating and deletion, and for an explanation of processing. Under Ley 25.326 access requests are answered within ten calendar days and rectification, updating or deletion requests within five business days where applicable. Access is free at intervals of at least six months, and more often where a legitimate interest justifies it. Where EU GDPR or UK GDPR applies, you may also request restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. We normally respond within one month under EU GDPR or UK GDPR, with a permitted extension explained in time for complex requests. A shorter applicable Argentine deadline is not replaced by the GDPR period.
Send requests to hello@redomon.com. We may request proportionate identity and authority verification, not unnecessary identification documents. Exceptions may apply to protect others’ rights or satisfy legal retention duties; we will explain relevant limits. If a business holds your information in its workspace, contact that business first. We will forward or assist with a request we receive concerning its data and will not independently disclose its records without authorization or a legal obligation.
Complaints
You may complain to the Agencia de Acceso a la Información Pública, the authority responsible for enforcing Ley 25.326, through https://www.argentina.gob.ar/aaip/datospersonales. Complaint guidance is available at https://www.argentina.gob.ar/servicio/denunciar-incumplimientos-de-la-ley-de-proteccion-de-datos-personales. You may also use applicable habeas data remedies. If EU GDPR applies, you may complain to your competent supervisory authority, especially where you live or work or where the alleged infringement occurred. If UK GDPR applies, you may complain to the UK Information Commissioner at https://ico.org.uk/make-a-complaint/. You do not have to contact us before exercising complaint rights.
Children and account information
Required account and security information is necessary to provide access. Without it we may be unable to create or maintain an account. Optional profile information is voluntary. Redomon account holders must be 18 or older. We do not knowingly solicit children’s data; report an underage account or inappropriate child data so we can investigate with the relevant controller.
Changes and contact
Material changes are communicated through account email or a prominent notice, in addition to updating the version. A changed notice does not itself authorize a new incompatible use of existing customer data. Questions, rights requests and privacy concerns can be sent to hello@redomon.com.
Browser storage
We use necessary authentication and security storage and a local appearance preference on our own website and workspace. We do not use customer CRM content, email or Product Analytics events for Redomon advertising. Product Analytics integrations on a customer website or application are separately controlled by that customer; the customer must assess cookies, identifiers and consent for its integration. Any optional tracking on Redomon’s own pages requires its own disclosure and consent where applicable. Our cookie notice explains browser-storage controls.
Additional safeguards
Routine post-termination cleanup does not establish an additional retention entitlement. It does not extend the deadline for a valid data-subject rights request or a controller deletion instruction. Such instructions must be carried out without undue delay and within the shortest applicable legal deadline. Any residual backup copy must remain isolated from ordinary use, must not be restored without reapplying deletion, and may be retained only where that treatment is lawful. A technical backup schedule is not a blanket exception to erasure rights.
An adult-only account policy does not mean that customer records never concern minors. Customers remain responsible for any lawful processing of such records and applicable heightened safeguards. We do not authorize child-focused or sensitive-data processing merely because an adult operates a workspace.
For Argentine outbound-transfer analysis, recognized adequate EU/EEA destinations may support covered transfers without separate model clauses while the relevant recognition applies. Onward processing, provider support and non-adequate destinations must be assessed separately. Crossing the Argentina/EU border alone does not establish that SCCs are required.
International privacy rights
EU GDPR means Regulation (EU) 2016/679. UK GDPR means the GDPR as it forms part of UK law, together with the Data Protection Act 2018 and applicable amendments. Where either applies, the lawful bases, controller/processor distinctions, security obligations and rights explained above apply under that regime. Where other national or US state privacy laws apply, we honor their applicable access, correction, deletion, portability, consent, objection and appeal rights, without claiming every law applies to every user.
Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to our processing, California residents may request disclosure of the categories and specific pieces of personal information collected, sources, purposes and recipient categories; correction; deletion; and portability, subject to lawful exceptions. They may exercise applicable rights to opt out of sale or sharing for cross-context behavioral advertising and to limit legally defined uses of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising and do not use sensitive personal information to infer characteristics or for purposes requiring a limitation choice. This is not a claim that Redomon meets the statutory thresholds for a regulated business.
The categories, sources, purposes, provider disclosures and retention criteria are described in this notice, including for the preceding twelve months to the extent the service operated. We do not offer financial incentives for personal information. Business contact and workforce information are not automatically exempt from CCPA/CPRA. We do not discriminate for exercising applicable privacy rights.
Send requests to hello@redomon.com. An authorized agent may act with evidence of authority; verification must be proportionate. For applicable California requests to know, correct or delete, we normally respond within 45 calendar days; a permitted extension of up to a further 45 days will be explained within the initial period. Applicable opt-out requests are handled as soon as feasibly possible and no later than 15 business days. We honor legally applicable opt-out preference signals, including Global Privacy Control, for any processing to which those signals apply; there is currently no sale or advertising sharing to opt out of. Customer-controlled workspace data is handled under the DPA and through the relevant business, without using that role to evade our own controller obligations.
For UK restricted transfers, current UK adequacy regulations, including Argentina where covered, may provide the lawful route. Where adequacy does not apply, an applicable UK International Data Transfer Agreement or the UK Addendum to the EU SCCs must be completed and validly adopted, with the legally required transfer risk assessment and supplementary measures. EU SCCs alone do not establish a UK transfer safeguard. Swiss transfers, if applicable, require an appropriate Swiss-law mechanism or adaptations. No global-market statement is a promise of EU-only storage or processing.