Privacy Policy

Product: Chrome extension KEP-CRM for Gmail
Chrome Web Store item ID: emdacjakkdijlkdbjdcpgedgofccanhj
Controller: Xolvix GmbH, Hietzinger Hauptstraße 66/3, 1130 Vienna, Austria
Contact: [email protected] · +43 1 9284454
Effective date: 10 September 2026

This page is the Privacy Policy for the Chrome extension. It states how user data is collected, used, stored and shared.

Chrome Web Store User Data Policy — Limited Use. The use of information received from Google APIs and from Gmail as displayed in the browser will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide or improve user-facing CRM features that are prominent in the extension’s user interface. We do not use this data for serving advertisements, for creditworthiness, or for lending. We do not allow humans to read this data except: (a) with the user’s consent for support; (b) for security / legal compliance; (c) if aggregated and anonymized; or (d) as part of operating our CRM for the authenticated employee who initiated the action.

1. What data we collect

The extension handles personal and sensitive user data only while Gmail is open and the employee uses the CRM panel. It does not scan the whole mailbox in the background.

From the open Gmail message (website content / personal communications):

sender name and sender email address
subject, message ID, thread ID
visible body text of the open message (to match a CRM contact or extract contact fields when the employee asks)
the employee’s own mailbox address

Entered by the employee: name, email, phone, task titles, dates, CRM status fields; optional microphone audio if the employee starts voice notes.

Stored on the device: CRM API token and UI preferences in chrome.storage.

We do not collect passwords, payment card data, or browsing history outside Gmail and our CRM domains.

2. How we use / handle the data

Collected data is used only to:

match the open email to a CRM customer or create a lead
show and save customer records, tasks and reminders in the CRM
optionally suggest contact fields from the message text, or transcribe a voice note the employee started

We do not use the data for advertising, retargeting, selling lists, credit scoring, or training public AI models.

Legal bases (GDPR): performance of a contract with CRM users (Art. 6(1)(b)) and legitimate interest in internal sales operations (Art. 6(1)(f)). Optional AI/voice features run only after a deliberate employee action.

3. How and where we store the data

Customer records, email links and tasks are sent over HTTPS (TLS) to https://api.angebote.xolvix.ai and stored in the CRM database (Cloudflare D1). The CRM UI is https://crm.xolvix.ai.
The token and UI settings stay in Chrome storage on the device until the extension is uninstalled or storage is cleared.
CRM retention: as long as the customer record is needed for sales, or as required by Austrian bookkeeping law (UGB/BAO).

No unencrypted HTTP is used for user data.

4. How we share the data

We share data only as needed to run the CRM:

Xolvix GmbH / authorised CRM staff with access to crm.xolvix.ai
Cloudflare, Inc. as hosting, Worker, D1 and optional Workers AI processor (Art. 28 GDPR; EU processing where available; US transfers with SCCs / Data Privacy Framework where applicable)
Anthropic — only if the employee uses AI extract / copilot / chat; then message excerpts or typed text are sent to produce that help
Google Gemini or Cloudflare Workers AI (Whisper) — only if the employee starts a voice recording, for transcription
authorities if required by law

We do not sell user data. We do not share it with ad networks, data brokers or independent analytics vendors. Google does not receive this data for ads personalisation through this extension.

5. Chrome permissions

storage — token and display settings
tabs / scripting — refresh Gmail after an update; open the CRM tab
sidePanel — optional side panel
host mail.google.com — CRM card in Gmail
host api.angebote.xolvix.ai — CRM API
host crm.xolvix.ai — CRM UI / call popup

6. Access, correction, deletion

Employees edit or delete CRM records at crm.xolvix.ai or by unlinking a mail in the extension. Uninstalling the extension deletes local Chrome storage. Data-subject requests: [email protected]. Supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Datenschutzerklärung

Produkt: Chrome-Erweiterung KEP-CRM für Gmail
Artikel-ID: emdacjakkdijlkdbjdcpgedgofccanhj
Verantwortlicher: Xolvix GmbH, Hietzinger Hauptstraße 66/3, 1130 Wien
Stand: 10. September 2026

Diese Seite ist die Datenschutzerklärung der Erweiterung. Sie beschreibt, wie Nutzerdaten erhoben, behandelt, gespeichert und geteilt werden. Der englische Text oben ist verbindlich für den Chrome Web Store; der deutsche Text dient der Transparenz.

Erhebung nur aus der geöffneten Mail (Absender, Betreff, sichtbarer Text, Message-/Thread-ID, eigene Mailbox) sowie Eingaben des Mitarbeiters und Token in chrome.storage. Nutzung nur für CRM-Zuordnung, Kundenakte und Aufgaben; optional KI/Sprache nach bewusster Aktion. Speicherung per HTTPS in der CRM-Datenbank und lokal im Browser. Weitergabe nur an Xolvix-Mitarbeiter, Cloudflare (Hosting) und optional Anthropic/Google/Workers AI bei KI- bzw. Sprachfunktionen. Kein Verkauf, keine Werbung. Kontakt: [email protected].