Deus CRM Light

Privacy Policy

Effective date: 27 October 2026

1. General Provisions

1.1. This Privacy Policy (the "Policy") explains what data IE "DeusCode" (an individual entrepreneur registered in the Republic of Kazakhstan, Almaty; the "Operator", "we" or "us") collects and processes when you use the DeusCRMLight CRM system ("DCL"), why we do so, with whom we share data, how long we keep it and what rights you have.

1.2. This Policy applies to the website https://deuscrm.online, the web application, the Telegram bot @deuscrmlight_bot, the Telegram Mini App, integrations and the public REST API (together, the "Service").

1.3. This Policy has been prepared in accordance with Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection" dated 21 May 2013 (the "Personal Data Law"), the Law of the Republic of Kazakhstan "On Informatization" and other applicable law. For users in the European Union and the European Economic Area (the "EU/EEA"), we also take into account Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

1.4. This Policy applies together with our Personal Data Processing Policy, which contains the consent to processing, our Cookie Policy and our Terms of Service. Terms not defined in this Policy have the meanings given to them in those documents.

2. Who Processes Your Data

2.1. For data about users of the Service (registration data, account data and technical data), IE "DeusCode" is the personal data operator (controller). The Operator's details are provided in invoices and on request at info@deuscode.tech.

2.2. For data that users enter into the Service about their clients, counterparties and other individuals, the operator (controller) is the account owner: the company or independent professional that maintains its database in the Service. With respect to such data, the Operator acts as a processor: it processes the data on behalf of the account owner and solely to provide the Service. The account owner decides what data to enter and is responsible for having a lawful basis for processing it.

2.3. If one of our users has entered your data into the Service (for example, you are a client of a company that works in DeusCRMLight), please contact that company about the processing of your data. If you contact us, we will forward your request to the account owner and give the account owner the necessary assistance.

3. Data We Process

3.1. Account data: email address, name, password hash (we do not store the password itself), interface language and time zone. For Business accounts, also the company name and the data of employees added by the account owner (email address, name and role in the account).

3.2. Data entered by users: client contact details (full name, phone numbers, email addresses, messenger accounts), notes, deals and tasks, as well as data received through integrations and imports connected by the user: call data from IP telephony providers (phone numbers, duration, links to call recordings), data transferred from 1C and via the API, and the contents of uploaded CSV files.

3.3. Technical data: IP address, browser and device information (user agent), sign-in time, session data and the account activity log kept for security purposes.

3.4. Telegram data: your Telegram user ID and chat ID, if you have linked the @deuscrmlight_bot bot yourself or use the Telegram Mini App.

3.5. Push subscription data: the subscription endpoint and keys that your browser generates when you allow notifications.

3.6. Cookies and browser local storage data: see Section 9.

3.7. Payment data. Payments are accepted through third-party payment providers. The Operator does not receive or store bank card data. We may receive from the provider the payment details (date, amount, status, transaction ID) needed to activate your plan.

3.8. We do not request special categories of personal data (for example, health data or biometric data). Do not enter such data into the Service unless you have a lawful basis for processing it.

4. How We Use Data

4.1. We process data only for the following purposes:

  • registering, identifying and signing in users, and managing accounts and teams;
  • providing the features of the Service: client database, deals and pipelines, tasks, analytics and team collaboration;
  • sending service emails, browser push notifications and Telegram messages about account events;
  • operating integrations connected by the user (1C, IP telephony, CSV import and export, REST API);
  • managing the trial period, plans and payments, and handling refund requests;
  • ensuring security: preventing unauthorized access and abuse, and investigating incidents;
  • providing technical support and responding to requests;
  • analyzing website traffic in aggregated form to improve the Service (only with your consent);
  • complying with legal requirements.

4.2. We do not use data entered by users for advertising, we do not sell personal data, and we do not make decisions that produce legal effects concerning you based solely on automated processing.

5. Legal Bases for Processing

5.1. We process users' personal data on the following legal bases:

  • the consent of the data subject given at registration, and a separate consent to analytics given in the cookie banner;
  • entering into and performing the Terms of Service;
  • compliance with obligations imposed on the Operator by law;
  • the Operator's legitimate interest in keeping the Service secure and operational, provided that this does not override your rights and freedoms.

5.2. Our users' client data is processed on the instructions of the account owner. The account owner is responsible for ensuring a lawful basis for its processing, including the consent of the clients themselves.

6. Who We Share Data With

6.1. To operate the Service, we engage providers that process data on our behalf:

  • Vercel Inc. (USA): application hosting and, with your consent, Vercel Web Analytics;
  • Neon (cloud PostgreSQL database, servers in the EU and the USA): storage of Service data;
  • Resend: email delivery;
  • Telegram: notification delivery and the Mini App, if you have linked the bot yourself;
  • browser push notification services (Google, Apple, Mozilla): delivery of push notifications, if you have allowed them.

6.2. Payment providers are currently being connected. Their list will be published in this Policy once they are connected.

6.3. Providers receive only the data needed for the relevant function.

6.4. We disclose data to government authorities only in the cases and in the manner provided by law.

6.5. If a user connects an integration (1C, an IP telephony provider or an external application via the API), data is exchanged with that service on the user's instructions, and that service processes the data under its own rules.

7. Cross-Border Data Transfers

7.1. The infrastructure of the providers listed above is located outside the Republic of Kazakhstan, including in the USA and EU member states. Accordingly, users' data and the data they enter into the Service are transferred to and stored outside the Republic of Kazakhstan.

7.2. Cross-border transfers are made on the basis of the consent you give at registration, including transfers to countries that may not ensure the protection of personal data at the level provided by the law of the Republic of Kazakhstan. The Service cannot be provided without this consent.

7.3. When data of users from the EU/EEA is transferred to third countries, we rely on the contractual safeguards that the providers offer to their customers, including, where applicable, the standard contractual clauses approved by the European Commission.

8. Data Retention

8.1. We keep data no longer than necessary for the purposes of processing:

  • account data and data entered by users are kept while the account is active, including in read-only mode;
  • after the account is deleted, the data is deleted within 30 days, and from backups within no more than 30 additional days;
  • security logs are kept for up to 12 months;
  • Telegram identifiers and push subscription data are kept until the bot is unlinked or notifications are turned off, but no longer than the account exists;
  • payment records are kept for the periods required by law.

8.2. Before deleting your account, you can export your data in the Service interface (CSV and JSON export).

9. Cookies

9.1. The Service uses strictly necessary cookies: __Host-dcl_session (sign-in session, up to 30 days), dcl_lang (interface language, 1 year) and dcl_consent (your choice in the cookie banner, 1 year). The browser's local storage (localStorage) holds your theme preference and a flag showing that you have completed onboarding.

9.2. Vercel Web Analytics loads only after you click "Accept" in the cookie banner. We do not use marketing or advertising cookies. You can change your choice at any time via the "Cookie settings" link in the website footer.

9.3. For details, see our Cookie Policy.

10. Security

10.1. We apply organizational and technical measures to protect data, including:

  • encrypted connections (HTTPS, HSTS);
  • password hashing with the Argon2id algorithm;
  • two-factor protection of administrative access;
  • access control by role and by company: one company's data is not accessible to users of another company;
  • an activity log to detect and investigate incidents;
  • regular backups.

10.2. Access by the Operator's personnel to data entered by users is restricted and limited to what is necessary for technical support, for the security and operation of the Service, or for compliance with the law.

10.3. No method of transmitting or storing data over the internet is completely secure, so we cannot guarantee absolute security. For your part, keep your password and API keys confidential, do not share access with unauthorized persons, and notify us at info@deuscode.tech if you suspect unauthorized access.

10.4. In the event of an incident affecting personal data, we will take steps to remedy it and will notify affected users and/or the competent authorities where required by law.

11. Your Rights

11.1. Under the Personal Data Law, you have the right to:

  • obtain information on whether the Operator holds your personal data, and on the purposes, sources, methods and periods of its processing;
  • request that your personal data be changed or supplemented;
  • request the blocking of your personal data if there is information that the conditions for its collection and processing have been violated;
  • request the destruction of personal data collected and processed in violation of the law;
  • withdraw your consent to processing as described in the Personal Data Processing Policy;
  • appeal against the Operator's actions (or inaction) to the authorized personal data protection body or to a court;
  • protect your rights and legitimate interests, including compensation for damage.

11.2. Some actions are available in the interface: editing your profile data and exporting data. Please send other requests to info@deuscode.tech from the email address linked to your account. To protect your data, we may ask you to verify your identity. We respond within the time limits set by applicable law.

12. Rights of Users in the EU/EEA

12.1. If the GDPR applies to the processing of your data, you also have the right to:

  • access your personal data and obtain a copy of it (Art. 15 GDPR);
  • have inaccurate data rectified (Art. 16 GDPR);
  • have your data erased (Art. 17 GDPR);
  • restrict processing (Art. 18 GDPR);
  • receive your data in a structured, machine-readable format and transmit it to another controller (right to data portability, Art. 20 GDPR);
  • object to processing based on legitimate interests (Art. 21 GDPR);
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
  • lodge a complaint with the supervisory authority of the EU/EEA member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

12.2. We respond to such requests within the time limits set by the GDPR (generally within one month).

12.3. If you live in another country, you also have the rights granted by the law of your country to the extent that it applies to the processing of your data. Such requests are handled in the same way via info@deuscode.tech.

13. Age Restrictions

The Service is intended for persons aged 18 and over and for organizations. We do not knowingly collect data of persons under 18. If we learn that such a person has registered in the Service, we will delete their account and data.

14. Changes to This Policy

14.1. We may update this Policy, for example when payment providers are connected, new features are introduced or the law changes. The new version is published at /legal/privacy together with its effective date.

14.2. We give advance notice of material changes by email or in the Service interface. If the changes require your consent, we will ask for it separately.

15. Contact Us