Snapshot 223634
Normalized text
Scripts and page chrome removed; this is what change detection compares.
← Back to Home Privacy Policy Version 2.2 · Last updated October 25, 2026 1 Who we are and when this policy applies Salted a.s. (Salted, we, us) provides customer-communication software and related services. Our registered address is Antala Staška 1859/34, Krč, 140 00 Praha 4, Czech Republic. Our company identification number is 17327008, and we are registered with the Municipal Court in Prague under file B 27458. This policy explains how personal information is handled in connection with our website, products and services that link to this policy, sales enquiries, business relationships and recruitment. Personal information means information relating to an identified or identifiable person, as defined by applicable law. Our role depends on why the information is processed: When Salted decides the purpose of processing. We act as a controller for activities such as handling enquiries, managing business contacts and accounts, billing, protecting our business and services, recruitment, and our own website and product-usage analysis. The sections below explain these activities and your choices. When Salted processes information for a customer. Our business customers use Salted to manage communications and workflows involving their customers, employees and other individuals. For that information, we act as a processor or service provider under the customer's instructions and our Data Processing Addendum (DPA). A customer may itself be processing information for another organisation. If you contact an organisation using Salted—for example by telephone, email or chat—its privacy notice explains the purposes for which your information is used. This policy supplements, but does not replace, that notice. Contact that organisation about its use of your information or to exercise your rights. If you contact us instead, we will assist with directing the request appropriately, subject to applicable law. This policy provides information; it is not a request for blanket consent and does not replace our customer agreements. Visiting our website does not, by itself, mean you consent to marketing or optional tracking. 2 Information we collect and its sources For activities where Salted is controller, the information we handle may include: Contact and business information: name, work email, telephone number, employer, job title and information about your organisation's needs. Account and transaction information: user and organisation identifiers, account settings, access roles, subscription details, billing contacts, invoices and payment-status information. Communications: enquiries, support requests, feedback and other information you provide when communicating with us. Technical and usage information: IP address, browser and device information, approximate location, referring pages, pages or features used, event timestamps, session identifiers, diagnostic information and security logs. The information collected depends on the service, its settings and applicable privacy choices. Recruitment information: contact details, CV, employment and education history, correspondence and other information relevant to an application. Business-interest information: information about your organisation or potential interest in our services, including information derived from website activity where permitted. We obtain information directly from you; from your employer or account administrator; through your use of our website and products; and, where applicable, from referrals, professional or publicly available business sources and service providers such as the visitor-identification provider described in Section 4. If information is necessary to answer a request, create an account or meet a legal requirement, we will identify the required information when collecting it. Without it, we may be unable to provide the requested service. Other information is optional. Customer-controlled communications and workflow information are described in Section 5. Their content does not become unrestricted Salted analytics data simply because it is generated by the product. 3 Our purposes and legal bases Where the GDPR or equivalent rules require a legal basis, we use the following bases for processing where Salted is controller: 3 Our purposes and legal bases Purpose Relevant information Legal basis Answer enquiries, arrange demonstrations and manage business relationships Business contacts, correspondence and stated needs Our legitimate interest in responding to requests and developing business relationships; steps towards a contract where you personally would be the contracting party Administer accounts, provide administrative support and communicate about the service Account information, business contacts and support correspondence Our legitimate interest in delivering and administering business services; performance of a contract where you personally are a party Issue invoices, maintain accounts and meet legal requirements Transaction and billing information Legal obligations; legitimate interests in collecting payments and maintaining business records Protect accounts and services, investigate misuse and resolve technical problems Access records, technical information and diagnostic logs Our legitimate interest in maintaining secure and reliable services; legal obligations where applicable Measure use of our marketing website and enable website visitor identification and advertising features Website activity, online identifiers and business-interest information Consent through our website privacy controls Understand product use and improve usability Product-use events, technical information and feedback Consent where required; legitimate interests in proportionate analysis and improvement where permitted and not overridden by your rights. Customer-directed processing remains governed by the DPA Send marketing and manage relevant business prospects Business contacts and business-interest information Consent where required; legitimate interests in relevant business marketing where permitted. Separate rules governing electronic communications also apply; accepting website tracking is not blanket permission to send unsolicited messages Recruit staff and assess applications Application details and correspondence Steps towards an employment contract at your request; legitimate interests in recruitment; legal obligations where applicable. Separate consent where required for retaining an application for future roles Establish, exercise or defend legal claims Relevant business records and correspondence Our legitimate interest in protecting our rights and applicable legal obligations Where we rely on legitimate interests, we assess the purpose, necessity and impact on individuals. You may object as explained in Section 10. Legitimate interests do not replace consent where consent is legally required for a particular activity. These bases concern Salted's own processing. They do not give us a separate permission to use customer-controlled conversation content for our own marketing or unrelated purposes. 4 Cookies, analytics and visitor identification We use cookies and similar technologies for functionality, measurement and, on our marketing website, visitor identification and marketing. Some storage supports a service you request, while other tracking is optional. On salted.cx, optional analytics and marketing technologies remain off until you opt in. This website setting applies worldwide. Select Accept all, Reject optional, or use Settings to choose categories. You can reopen Privacy settings from the website footer at any time. Closing the banner or continuing to browse does not grant consent. Refusing optional tracking does not prevent ordinary browsing. Your saved website choice is valid for 180 days in the browser and site origin where it was made. Changes apply to future website tracking; they do not automatically erase information already received by a provider or withdraw a separate marketing subscription. The Cookie Policy explains storage, expiry and withdrawal in more detail. If your browser sends Global Privacy Control (GPC), our website keeps Marketing & visitor identification off, including where you had previously enabled it. Analytics remains a separate choice. These website controls do not change telemetry or account settings in the Salted product. 4.1 Google Analytics When you allow Analytics, we use Google Analytics to measure website visits and interactions. Google receives information such as pages viewed, referring pages, browser/device details and online identifiers. Requests also disclose your IP address to the receiving service; this does not mean that Google Analytics stores it in reports. See how Google uses information from partner sites. Our Analytics property is linked to Google Ads. Allowing both Analytics and Marketing permits advertising measurement and personalisation through that link. Google and advertising partners may use first-party analytics identifiers together with advertising cookies or identifiers. Allowing Analytics alone does not grant permission for these advertising purposes. You can change your website choice here, use Google's advertising controls, or use the Google Analytics opt-out browser add-on. 4.2 Website hosting and enquiries Cloudflare hosts and delivers this website. Demo, Contact and Pricing forms save the contact details and message you submit in private Cloudflare storage in the EU, accessible to authorised Salted staff through our protected admin. Cloudflare Email Service supports internal notifications; a saved enquiry remains available if email delivery is delayed or unavailable. This processing is needed to handle your request and does not depend on optional Analytics consent. We no longer use Vercel Web Analytics on this website. 4.3 RB2B visitor identification When you allow Marketing & visitor identification, we use RB2B, provided by GetEmails, LLC, to identify business visitors. RB2B and its data partners may associate website visits and browser identifiers with information from other sources, including company details and email addresses. We may use this information to identify relevant business contacts and contact them about Salted, typically by email or LinkedIn, where legally permitted. Providers acting for us may assist with these communications. Consent to website tracking does not remove any separate requirement governing those communications. You can object to our direct marketing at any time, including by replying to a message or contacting privacy@salted.cx. We have enabled RB2B's international company-level identification. In addition to our own Privacy settings, RB2B provides an advertising opt-out and an international/GDPR collection opt-out. To object to Salted's own direct marketing or request deletion of information we hold, contact privacy@salted.cx. These are complementary choices: a browser setting does not automatically remove an existing contact from another system. 4.4 PostHog website analytics and session replay When you allow Analytics in our website Privacy settings, we use a separate PostHog EU Cloud project for our public website and documentation. It measures page visits, documentation search usage and result counts, recovery from missing pages, demo-link clicks, and whether contact or demo forms are started, successfully submitted or encounter an error. We use pseudonymous browser and session identifiers; we do not identify website visitors by name or email in PostHog or connect these identifiers to product accounts. We configure session replay to record 100% of consenting browsing sessions to understand usability problems. Replays can show public page content, navigation, clicks and scrolling. Form inputs and search text are masked before transmission. We exclude the documentation admin area, disable console-log and network-payload recording, and remove query strings and fragments from analytics and replay navigation URLs. We do not send contact-form contents or search text as analytics events. Authorised Salted team members can review these replays to improve the website and documentation; replay retention is 30 days. This optional processing relies on your Analytics consent and starts only after you allow it. You can withdraw it through Privacy settings in the footer. Withdrawal stops future collection and clears accessible website PostHog identifiers; it does not automatically erase previously collected data. Browser-cookie lifetime is up to 180 days, with session storage for the current browser session. See PostHog's privacy information. Our website choice does not control telemetry inside the Salted product, described below. 4.5 PostHog product analytics and diagnostics We use PostHog's EU Cloud service for product-use analysis and technical diagnostics. Depending on the application configuration, this includes feature and page-use events, performance measurements, interactions such as unsuccessful clicks, and error information. Events may be associated with a signed-in user's ID and email address, organisation/account ID and account domain. This is not necessarily anonymous information. PostHog also uses browser storage to maintain identifiers and session information. Error reports may include technical context associated with an error and can contain personal information. Customer-controlled content within diagnostics remains subject to the applicable customer agreement and DPA; this policy does not authorise its unrestricted reuse. The marketing website's Privacy settings do not control PostHog in the product. For questions about product telemetry or related rights, contact privacy@salted.cx and, where your organisation controls the processing, your account administrator. Optional session replay. Where enabled in the Salted product, PostHog session replay may capture navigation, clicks, scrolling, interaction timing and permitted interface content. Authorised Salted team members may occasionally review selected replays to understand usability problems, investigate technical issues and improve the product. This feature is not necessarily enabled for every deployment or user. Before activating it, we will define and test masking or exclusion of credentials, customer-message and patient content, and other sensitive information; restrict access; set an appropriate retention period; and provide applicable notices and obtain any consent required by law. Customer-specific agreements and the DPA continue to apply. Describing session replay here does not replace those requirements or authorise unrestricted review of customer communications. Using PostHog EU Cloud does not mean every Salted service or every provider activity takes place exclusively in the EU. See PostHog's privacy information and Section 7. Website analytics and visitor identification are separate from the cloud and AI services used to process customers' communications. The inclusion of a provider in our Subprocessor List does not, by itself, explain all of its website-marketing uses. 5 Information processed for our business customers Customers decide which Salted capabilities they use and how those capabilities fit their operations. Depending on the agreed service, information processed on their behalf can include contact details; call metadata and recordings; messages and attachments; transcripts and summaries; customer-service notes; knowledge content; workflow records; and information exchanged with connected systems. AI features may analyse or generate communications, retrieve approved knowledge, identify the subject of an enquiry, produce summaries or support actions in connected systems. These activities are performed within the agreed service and the customer's documented instructions. The customer is responsible for its processing purposes, lawful basis and required notices; Salted remains responsible for its own applicable obligations. Where the agreed service involves health information, its processing is subject to the conditions and safeguards in the DPA. Before that processing begins, the permitted scope, access restrictions, retention, subprocessors and locations must be documented as required by the DPA. Other special categories require the express written agreement specified there. This policy does not independently authorise additional sensitive-data uses. Our DPA prohibits using health and other special-category customer personal data to train or improve general-purpose or cross-customer AI models, including by our subprocessors. Customer-specific configuration, retrieval and evaluation remain subject to the agreed service and DPA. If your employer or another organisation provides your Salted account, its authorised administrators may control your access and view information associated with your work, depending on the service configuration and applicable law. Ask that organisation about its monitoring and retention practices. 6 Who receives information For the controller activities described in this policy, we share relevant information with providers supporting hosting, security, analytics, business communications, customer relationship management, billing and other business operations, as necessary for their roles. Website technology includes Cloudflare hosting, security, private enquiry storage and email notifications. Google Analytics, RB2B and PostHog are described above. We may also disclose relevant information to professional advisers; authorities or other parties when legally required; and parties involved in a proposed or completed corporate transaction, with appropriate confidentiality and other safeguards. Where an organisation manages your account, information relevant to that relationship may be available to its authorised representatives. Providers processing information solely for us are subject to contractual restrictions. Other recipients may act as independent controllers for specified activities, depending on their role and applicable arrangements. Section 11 explains possible US-law implications of website marketing disclosures. For customer-controlled information, our Subprocessor List identifies the providers engaged under the DPA. Providers are not necessarily used for every customer or capability. The DPA and customer agreement govern that processing, including applicable subprocessor-change arrangements. We may produce and use genuinely anonymous statistics that no longer identify individuals. Information does not cease to be personal information merely because names are removed or records are grouped. 7 International processing and residency commitments Salted serves organisations in Europe and the United States. Information may be stored, accessed or otherwise processed in the EU/EEA, the United States and other countries where Salted or the relevant providers operate. Applicable locations depend on the activity, provider and service configuration. Where personal information is transferred internationally and transfer safeguards are required, we use the applicable legal mechanism. This may include a relevant adequacy decision, Standard Contractual Clauses with any required supplementary measures, or another valid mechanism. We apply the relevant UK and Swiss requirements where applicable. You may contact us to ask about the safeguards relevant to your information and how to obtain a copy, subject to appropriate redaction. For customer-controlled information, processing locations and transfers are governed by the DPA, applicable Subprocessor List and any signed customer-specific commitments. We do not generally promise EU-only processing. Where we expressly agree regional restrictions in an Order Form or addendum, those restrictions apply to the data and services identified there. This privacy notice neither overrides those commitments nor grants additional transfer permissions. 8 How long information is kept We retain information for the relevant purpose, taking into account its sensitivity, applicable legal requirements and the need to resolve disputes or demonstrate compliance. Our retention approach distinguishes: Enquiries and business contacts: the period needed to handle the enquiry and maintain a relevant business relationship, considering the time since the last interaction, any objection to marketing, and any applicable recordkeeping or claims requirements. Account and support records: the duration of the relevant account or support need and a limited follow-up period for administration, security or disputes. Invoices and statutory records: the periods required by applicable accounting, tax and other recordkeeping laws. Analytics and security records: the purpose of measurement or investigation, sensitivity of the information and applicable service settings determine the period. A browser cookie's lifetime is not the same as retention of data already sent to a provider. Recruitment records: the recruitment process and an appropriate subsequent period for legal claims; any separate future-opportunity retention follows the notice and basis given at collection. Privacy choices and requests: the information necessary to honour an opt-out or demonstrate how a request or consent was handled. A minimal suppression record may remain after a marketing opt-out to prevent further contact. Customer-controlled information follows the customer's instructions, agreed retention settings and the DPA, including applicable return/deletion arrangements. Deletion from active systems and expiry of restricted backup copies may occur on different schedules; retained copies remain protected and are not available for unrelated use. Our current Google Analytics settings specify two months for event data and fourteen months for user data covered by those controls. User-identifier retention restarts with new activity. These settings do not set a universal expiry for all Google-held information or standard aggregated reports. Our website consent choice is valid for 180 days; its local browser record may remain until replaced or cleared, but an expired choice is not used to permit optional tracking. Provider-cookie lifetimes are listed in the Cookie Policy. 9 Security We use technical and organisational safeguards appropriate to the information and the risks of processing, and restrict access according to the relevant role and purpose. No system can eliminate all security risks. This does not limit our duties under applicable law or our customer agreements. Contact privacy@salted.cx about a privacy or personal-data security concern. 10 Your rights and choices Depending on the law that applies, you may request access to your information, correction, deletion, restriction of processing or a portable copy. You may also object to certain processing, including processing based on legitimate interests. You can object to direct marketing at any time, including related profiling. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. To unsubscribe from marketing, use the unsubscribe facility in the message or contact privacy@salted.cx. Necessary account, security and service messages may still be sent. Cookie and visitor-identification choices are described in Section 4. We may need proportionate information to verify a request, and rights can be subject to legal exceptions. Requests are generally free; any permitted charge or refusal must meet the conditions of applicable law. We respond within the applicable legal deadline. Under the GDPR, this is normally within one month; where a permitted extension is necessary, we explain the reason within that initial month. If we decline a request, we explain the reason and available complaint or review routes as required by law. You may complain to a competent data-protection authority. In the Czech Republic, this is the Office for Personal Data Protection (ÚOOÚ). Other rights to complain to your local authority remain available under applicable law. Where we process information on behalf of a customer, we refer requests to or assist that customer rather than independently deciding the request, except where law requires otherwise. Website analytics and visitor identification can involve automated matching and inferences about business interests. Where applicable, you also have rights concerning decisions based solely on automated processing that have legal or similarly significant effects, including the safeguards provided by law. Customer-directed AI workflows and their effects must be explained by the customer in its relevant notice; this policy is not a substitute for that notice. 11 Additional information for US residents State privacy rights depend on your state of residence and whether the relevant law applies to Salted and the processing concerned. These may include rights to know or access information, correct or delete it, obtain a portable copy, and opt out of targeted advertising, sale of personal information or certain significant profiling. California residents may also have a right to limit particular uses of sensitive personal information where the statutory conditions apply. 11.1 Website and business information The categories described in Section 2 include identifiers, business contact and professional information, commercial/account information, internet or electronic activity, communications and related inferences. Sources and purposes are described in Sections 2–4, recipient categories in Section 6, and retention in Section 8. Our website marketing setup permits disclosure of online identifiers and browsing activity to RB2B and, when both optional categories are enabled, to Google for advertising-related purposes. These uses can fall within state-law definitions of “sale”, “sharing” or targeted advertising even without payment for the information. We treat them as opt-out categories in our website controls rather than making a blanket claim that Salted never sells or shares any personal information. This is distinct from processing customer communications under the DPA. For future website collection, open Privacy settings, turn Marketing & visitor identification off and select Save my choices, or select Reject optional to disable both optional categories. We also honour GPC on our website by keeping marketing off, including where an earlier choice allowed it. These browser-level choices do not automatically identify you across other browsers or remove records already held in another system. Contact privacy@salted.cx for requests relating to those records or Salted's direct marketing. 11.2 Customer-controlled information Where Salted acts as a service provider or processor for a customer, the DPA restricts use of the customer's personal information and prohibits sale or sharing as specified there. This does not authorise using that information in Salted's own website-marketing activities. 11.3 Exercising rights Contact privacy@salted.cx. You may use an authorised agent where permitted, subject to appropriate verification. We do not discriminate unlawfully for exercising privacy rights. If your state's law provides an appeal right and we deny a request, you may appeal to that address; we explain the decision and available escalation route within the applicable deadline. 12 Children Our marketing website and customer accounts are intended for business use, not for children. This does not exclude processing information about minors on a customer's behalf where part of an agreed lawful service. In that case, the customer's instructions, notice and applicable safeguards govern. Contact us if you believe a child has provided information directly to Salted outside that context. 13 Other websites and services External websites and independently operated services have their own privacy information. Linking to them does not make this policy applicable to their processing. Our use of providers to process information for us remains subject to our applicable responsibilities. 14 Changes and contact We may update this policy to reflect changes in our activities or legal requirements. We identify the current version and last-updated date. Where required, we provide additional notice or obtain consent before introducing a relevant change. Publishing a new notice does not itself provide consent or amend a signed customer agreement. For questions or privacy requests, contact privacy@salted.cx, or write to: Salted a.s., Antala Staška 1859/34, Krč, 140 00 Praha 4, Czech Republic.