PetalCRM Terms of Service

Last updated: 2 November 2026. An agreement between you and PetalCRM, of HaPodim 20 St., Ramat Gan, Israel ("we"), privacy@petalcrm.ai.

1. Acceptance. You accept by creating or setting up a workspace; accepting for a business confirms you may bind it. We record who accepted, when, and which version of these terms and the DPA.

2. Your data. What your workspace holds is your data: you are its controller, and we process it for you under the Data Processing Agreement (DPA), which is part of these terms and wins on personal data. We never sell it, advertise with it, or train AI on it. Apart from running, fixing and securing PetalCRM for you, we use your data only to improve the product, by analysing anonymised data and chat conversations (DPA clause 3A).

3. Use. For business only, with work email accounts: you use PetalCRM for your business or work, not as a consumer; no unlawful use, spam, attacks or reaching another workspace. You answer for your users and their sign-ins.

4. Your duties. You decide whose data enters your workspace and which mail is captured, and as controller you need a lawful basis and must inform them. A new workspace starts with its AI features on, including email reading, which keeps the text of captured email for 12 months; suggestions of people to add, from senders not yet in your CRM, start off. An administrator can turn each AI feature on or off, or change that period, at any time. While email reading is on, a model reads captured mail to suggest updates a person approves and, at a user's request, summarises a thread, drafts a reply or rewrites their draft, shown only to them; only users send. Accepting these terms gives these instructions and DPA clause 9's.

5. Ending. You may leave and have your workspace deleted at any time. We may end these terms on 30 days' notice, or at once for serious breach or where law requires. We keep your data for 60 days after the end so you can export it, and then delete it (DPA clause 10). If we end these terms, or stop the service, before the end of a period you have paid for, we refund the unused part.

6. Price. The free plan includes every feature and costs nothing. We charge you nothing unless you choose a paid plan: a free workspace needs no card; you add a card only when you add your first paid seat, and your paid plan starts then. We give 30 days' notice of a price change, including a change to what the free plan includes. A new price applies only from your first renewal after that notice period, whether you pay monthly or yearly, and never within a period you have already paid for; you may cancel before it applies. A change to our prices or plans, or a move between the free plan and a paid plan, deletes nothing: your workspace and its data carry on. A paid plan renews automatically, monthly or yearly, until you cancel. You can cancel at any time. A monthly plan stays active until the end of the month you paid for, and a yearly plan until the end of the year you paid for; neither is refunded. Paid plans are sold by our reseller, Polar (Polar Software, Inc.), as merchant of record; Polar takes payment, issues invoices and handles refunds and cancellations, and refunds follow section 6A.

6A. Refunds. Payments are not refunded, in full or in part, except as this section says below.

Cancelling. You can cancel your subscription at any time, and you are not charged again.

• Monthly plan: it stays active until the end of the month you have paid for. That month is not refunded.
• Yearly plan: it stays active until the end of the year you have paid for. That year is not refunded.

If we end the service before the end of a period you have paid for, we refund the unused part.

How to ask. Ask Polar by writing to support@polar.sh.

7. Support and liability. A real person answers your support emails. We aim to reply as soon as possible, and within 7 business days at most; we make reasonable efforts to meet that, and the reply times on our help page are targets. PetalCRM keeps improving, so it may change as we develop it. As far as the law allows: we have no liability for a free workspace; otherwise our total liability is capped at the fees you paid in the 6 months before the claim; and we are not liable for indirect or consequential loss. These limits do not cover our deliberate misconduct or liability the law does not allow to be limited.

8. Changes. 30 days' notice by email or in the product; sooner only where law or a sub-processor requires, saying why. Use of data already held changes only under the DPA.

9. General. Israeli law; Tel Aviv-Yafo courts; non-waivable protections of your country's law remain. An unenforceable clause leaves the rest standing. No assignment without our consent. These terms and the DPA are the whole agreement.

PetalCRM Data Processing Agreement

"Data protection law" includes the EU and UK GDPR and Israel's Privacy Protection Law and Data Security Regulations.

1. Roles. For personal data in or captured by your workspace you are controller (בעל שליטה), we are processor (מחזיק). Annex 1 sets subject, duration, nature, purpose, data types and people; your controller rights and duties are as this DPA states. Clause 3A's product improvement and clause 3B's requests and ratings are the exceptions. This DPA does not cover data we control ourselves, such as your users' sign-in records, our security logs, records of which features your users use and when, and the requests and ratings your AI agents send us under clause 3B, none of which include your workspace content. Our privacy policy covers those.

2. Instructions. We process only on your documented instructions, including on transfers: this DPA, the Terms, your administrators' settings (reading, retention, mailboxes, erasure, approvals), and agreed written instructions. Setting changes are recorded. If a law requires other processing we tell you first unless it forbids that. We tell you at once if an instruction seems to break data protection law.

3. Confidentiality. Everyone at PetalCRM who can access your data (today our founder, and any future employee or contractor) has signed a confidentiality undertaking. Each sub-processor is bound to confidentiality by its data processing agreement with us (clause 5). We view content only at your request, to investigate security, abuse or faults, where law requires, or as clause 3A permits.

3A. Product improvement. (a) You instruct us to anonymise or aggregate your data so that it identifies no one, and to use the result to improve PetalCRM. (b) You permit us to keep chat-assistant conversations (what a user typed, the reply and the steps taken) for 90 days, with content derived from captured email removed first, and we may read them to improve the product, fix faults, answer feedback and keep it secure. We analyse them. We open one only through a tool that logs who, when, which and why; we give you that log on request. (c) For (b) we decide the purpose, so we are its controller (בעל שליטה) under our privacy policy; you confirm the use is compatible with why you collected the data and will tell your users, with text we provide; we answer requests about review copies. (d) Your workspace owner can opt the workspace out, and any user can object, by writing to privacy@petalcrm.ai. Either way nothing new is kept and kept copies are deleted within a day. (e) Google user data stays within the privacy policy's Google limits.

3B. Requests and ratings from AI agents. (a) Your administrators may turn on or off the sending of feature requests and ratings by AI agents connected to your workspace; this setting is your instruction under clause 2. (b) For what is sent, we are the controller (בעל שליטה) and clause 1 does not apply to it. (c) The purpose is deciding what to build and measuring the quality of tools, with no sale, advertising, training of AI models or joining to your workspace records. (d) The data is the agent's text, the agent's name, the user ID and the workspace; the period is as our privacy policy states. (e) Administrators can see everything sent in the app. (f) You confirm that this use is compatible with your purposes and that you will tell your users, with text we provide. (g) We answer requests from the people concerned ourselves.

4. Security. Annex 2 measures, appropriate to risk (GDPR Art. 32), never weakened during the term; Israeli holder duties (reg. 19(א)) met at your database's security level.

5. Sub-processors. You authorise Annex 3. We email you 14 days before adding or replacing one; you may object on reasonable data-protection grounds and, if unresolved, end the Terms with deletion. Each is bound by written contract to equivalent duties, and we stay responsible for it. We promptly forward its notices of its own sub-processor changes or of legal requests for your data.

6. Transfers. You instruct and consent in writing to transfers to Annex 3 sub-processors and their listed sub-processors, under adequacy or Standard Contractual Clauses (with the UK Addendum); safeguards on request. For data from Israel, we have asked our AI providers for a written Israeli-law undertaking and will tell you as each signs.

7. Assistance. We pass on rights requests and help answer them, and help with security, breach notices, impact assessments and prior consultation. If a person asks us directly to exercise rights over your data, we pass the request to you promptly, tell the person that we have, and do not otherwise answer it ourselves unless you instruct us. The exception is a person to whom Israeli law owes an answer from us because they asked us first: we tell them whether we hold personal data about them and name the workspace that is its controller and how to reach it, we pass their request to that workspace, and we give no copy of the data.

8. Breaches. We notify you without undue delay after becoming aware of a breach affecting your data: what happened, who and what is affected, likely consequences, our response. An uninstructed deletion is a breach.

9. Mail held before reading is on. (a) A new workspace starts with email reading on. In a workspace that started with it off, no mailbox connects and no forwarding address shows until an administrator turns it on. (b) For filtered mail (Annex 1) reaching the forwarding address earlier, unless an administrator declined, you instruct us to keep its headers and hold its plain-text body unread; this covers its senders, recipients and people mentioned. (c) Each text is held at most 14 days, except that while a request under clause 7 about one of its people is open in your workspace, we keep it until you close the request; none new is held 30 days after the first. (d) No model reads and no one sees it, save under clause 3. (e) Turning reading on, an administrator chooses whether held text is included, and included text is kept and read like any email. Declining deletes it at once; silence or dismissal is no answer. Turning reading off ends holding. (f) Held text is stored apart, without backups or versions, and deleted automatically: when the request closes, where (c) keeps it, and otherwise within one day after its 14 days. (g) Accepting the Terms gives this instruction, recorded with who, when and version.

10. End. You have 60 days after the end to export your data (a machine-readable export), or you may ask for deletion sooner. At the end of those 60 days we delete all copies, unless a law requires keeping something, which we name; if you ask, we confirm the deletion in writing. Backups keep deleted data until they expire, for recovery only; a restore re-applies deletions.

11. Audits. We provide the information needed to show that we meet our obligations under this DPA: we answer your reasonable questions, complete one security questionnaire a year, and share our processing record and security documents. If you reasonably need more, you or an auditor you choose may audit us, including by inspection, on 30 days' notice, under confidentiality and at your cost, once a year unless a breach or a regulator requires more. We report to you at least yearly on meeting this DPA and the Israeli regulations.

12. Israel. For reg. 15(א): systems we access are your workspace and connected mailboxes and calendars; the other elements are Annex 1 and clauses 3–5, 8, 10 and 11.

13. Changes. Changes reducing your protection need your agreement.

Annex 1 — Processing

Purpose: running your sales CRM, including the AI processing below. Nature: collection, storage, organisation, retrieval, display, filtering, holding, AI reading and generation, erasure. Duration: the Terms, then clause 10. People: your users, contacts, customers and prospects; people sending, receiving or mentioned in captured mail; people named in records or setup. Data: user accounts; CRM records and the files you import; email headers, identifiers and automation signals, and plain-text body only while reading is on or under clause 9; owned calendar events. Sources and filter: connected Gmail and Microsoft 365 work mailboxes (read-only) and the workspace address; kept only if involving someone in your CRM or a known domain. AI: on from the start in a new workspace, except suggestions of people to add from senders not yet in your CRM, which start off; an administrator can turn each AI feature on or off at any time, and turning one off stops that processing from then on. AI models process the workspace data you put into the service (email text while reading is on, records, imported files, chat messages and setup input), sending each request only the data its task needs, to suggest updates, drafts, summaries, field mappings and answers that a person reviews; results reach only the user who asked, summaries are not stored, a draft is kept only if saved, and AI never sends email; no training on your data; the providers and locations are in Annex 3, with storage off as Annex 2 says. Product improvement (clause 3A): anonymised or aggregated data; chat conversations, email-derived content removed, kept 90 days for review as controller; we may read them to improve the product, fix faults, answer feedback and keep it secure. Special categories: only incidentally. Retention: email text for 12 months, unless your administrator chooses another period; held text per clause 9; the rest until deleted or the end.

Annex 2 — Security

TLS in transit, database certificate verified; encryption at rest; mailbox tokens under a Google Cloud KMS key in Germany, undecryptable by the internet-facing service; row-level workspace separation; least-privilege secrets and service accounts; logs exclude addresses and content; OpenAI data-sharing and storage off; security events kept 24 months; Israeli security procedure and database inventory.

Annex 3 — Sub-processors

Each with its own sub-processor list: Google Cloud, Supabase, Cloudflare, Resend; OpenAI, Anthropic. Google Cloud: hosting, keys, logs, demo model; Belgium, Germany, global; SCCs. Supabase: database, backups; Frankfurt; SCCs. OpenAI: AI model for the AI processing in Annex 1; US and others; abuse logs up to 30 days, cache 24 hours; SCCs, UK Addendum. Anthropic: possible alternative AI model for the same processing; US and others; requests up to 30 days, safety-flagged content up to 2 years; SCCs Module Three, UK Addendum. Cloudflare: DNS, carries and decrypts web traffic to workspace addresses, brief inbound-mail storage; nearest server, email stored in EU; SCCs, UK Addendum. Resend: sign-in and invitation emails; mainly US; SCCs, UK Addendum, DPF.

The current list is at petalcrm.ai/sub-processors. Polar (Polar Software, Inc., US) sells paid plans as merchant of record and receives billing details directly as the seller; it receives no workspace data, so it is not a sub-processor.