Skip to main content

Privacy Policy

Last updated: September 9, 2026 · Version 2026-09-09

1. Who we are

EmailPoint Group EOOD („ИМЕЙЛПОЙНТ ГРУП" ЕООД), UIC (ЕИК) 207188514, registered seat 81V Bulgaria Blvd., Sofia, Bulgaria, is the controller for the personal data described in this policy. Contact: [email protected].

We comply with the General Data Protection Regulation (GDPR) and the data protection law of the Republic of Bulgaria.

Two different roles. For your account, billing and our own operations we are the controller — that is what this policy covers. For the data you upload or collect through the Services (your contacts, your visitors, your subscribers) you are the controller and we are the processor. That processing is governed by our data processing terms, which are being finalised as a written Data Processing Agreement; until it is published, request it at [email protected].

2. Data we collect

2.1 Account data

  • Name, email address, and password (hashed)
  • Workspace name
  • Optional: phone number, avatar, timezone, language preference
  • The date and version of the Terms of Service you accepted

2.2 Usage data

  • IP address and approximate location (for security and analytics)
  • Browser type and device information
  • Pages visited and features used within the Service
  • Login timestamps
  • Product-usage events, such as account setup and onboarding progress (e.g. connecting a website, activating a recipe, opening a service), used to improve onboarding and provide better support

Product-usage events are first-party analytics: they are processed entirely on our own infrastructure and are never shared with third-party analytics providers.

2.3 Billing data

We store your billing profile (name, country, VAT number where given), your subscription state and invoice metadata. We never see or store card details — they go directly to Stripe.

2.4 Social login data

If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not access your Google contacts, calendar, or other data.

3. Why we process it, and on what legal basis

  • Providing the Service, managing your account, authenticating you — performance of a contract (Art. 6(1)(b) GDPR)
  • Taking payment, keeping billing and accounting records — contract and legal obligation (Art. 6(1)(b), (c))
  • Transactional email — verification, password reset, billing and account notices — contract (Art. 6(1)(b))
  • Security monitoring, abuse and fraud prevention, logging — legitimate interest in keeping the Service secure (Art. 6(1)(f))
  • Product-usage analytics to improve onboarding and features — legitimate interest in improving a service you use (Art. 6(1)(f))
  • Email to customers about our own similar services — legitimate interest (Art. 6(1)(f)), with an opt-out in every message
  • Anything else we ask you about — consent (Art. 6(1)(a)), withdrawable at any time

We do not sell personal data and do not use it for advertising.

4. Payments and Stripe

Payments are processed by Stripe as merchant of record. Stripe is the seller for the payment transaction: it calculates and remits VAT, issues your invoice and receipt, and handles payment disputes. For that activity Stripe is an independent controller, not our processor — Stripe's own privacy policy applies. Invoices and receipts reach you from Stripe, not from a Monfri address.

5. Who else processes your data

These third parties process personal data when you use the Service:

  • Cloudflare, Inc. — CDN, DDoS protection, DNS and WAF in front of every Monfri service (request metadata: IP address, headers, user agent), and Cloudflare R2 for encrypted off-site backups and file storage for Pages.
  • OpenAI (United States) — the AI provider behind AI features: CRM search and AI assistance over CRM records, the Assistant chat, Pages AI, CDP article enrichment and profile summaries, and AI steps in Automation. What is sent is the content the feature works on. See §10 for the transfer safeguard.
  • Google — optional social login only (name, email, profile picture).
  • Font and asset hosts — some pages load fonts and avatar images from Google Fonts, Bunny Fonts, jsDelivr and ui-avatars.com; your browser discloses your IP address and user agent to those hosts.

IP geolocation uses a database file we host ourselves (MaxMind GeoLite2); no data is sent to MaxMind. Our email delivery, databases and analytics engines are software we run on our own servers, not third parties.

A maintained list of sub-processors for the data you upload as a customer will be published with the Data Processing Agreement. We will give at least 30 days' notice before adding or replacing one.

6. Where your data is and how we protect it

Your data is stored on servers located in the European Union (Bulgaria). We use:

  • Encryption in transit (TLS 1.2+)
  • Encrypted off-site backups, with the encryption key held offline
  • Database access restricted to application services on a private network
  • Role-based access control and tenant isolation within the platform
  • Automated infrastructure auditing with alerting, and regular security patching

7. How long we keep it

  • Account data — while your account is active
  • Data in a workspace whose subscription ended — kept read-only until you ask us to delete it
  • Billing records — as required by Bulgarian accounting and tax law
  • Application logs — 10 days
  • Backups — rotated on their own cycle; archived monthly copies of CDP event data are currently retained longer than the regular rotation
  • Anonymised, aggregated analytics — indefinitely

To request deletion, write to [email protected]. We act within 30 days, except where retention is required by law.

8. Your rights

Under the GDPR you have the right to:

  • Access — request a copy of your personal data
  • Rectification — correct inaccurate personal data
  • Erasure — request deletion of your personal data
  • Portability — receive your data in a structured, machine-readable format
  • Restriction — request limitation of processing
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg.

9. Cookies

We use essential cookies for session management (keeping you logged in), CSRF protection, and language and timezone preferences. We do not use third-party tracking cookies or advertising cookies. Cloudflare may set a security cookie (__cf_bm) to identify bots.

10. International data transfers

Your data is primarily stored and processed within the European Union. Two transfers outside the EEA occur:

  • OpenAI (United States), for the AI features listed in §5 — under the EU Standard Contractual Clauses incorporated in the provider's data processing terms.
  • Cloudflare's global network, for request metadata passing through its edge — under Standard Contractual Clauses.

11. Children

The Service is for business use and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy. We will notify you of material changes by email or through the Service. The "Last updated" date at the top indicates when the latest changes were made.

13. Contact