As of: 2026-10-11 · Version: 1.3.1 · Change history · Deutsche Fassung
This policy explains, in accordance with the GDPR, how personal data is processed on this website (the-y.at), in our SaaS service “TheY CRM / Kunden-Support CRM” at crm.the-y.at, including the Meta app “TheY CRM” for WhatsApp, Facebook Messenger, Instagram and Facebook Pages, and during the licence check of self-hosted installations. It applies as of the stated date and is adjusted when the service or the legal situation changes. This is a courtesy translation — the German version is authoritative.
The-Y e.U., Thomas Nuri Yilmaz, BSc · Senefeldergasse 25, 1100 Vienna, Austria · office@the-y.at · Privacy requests: datenschutz@the-y.at
The website is operated on a server in Austria. When the site is accessed, technically necessary access data (IP address, date/time, page requested, browser/device type) is processed for delivery, stability and security. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
When you use the contact form, the data you enter (name, company, email, optionally phone and your message) is processed to handle your enquiry. Legal basis: pre-contractual measures or legitimate interest (Art. 6(1)(b)/(f) GDPR). No transfer takes place without an appropriate legal basis.
We grant paid licences for TheY CRM to businesses only (B2B). To handle the purchase, we process the following as controller, depending on how you buy:
Licence and customer record. For each purchase we issue a licence key and store it with the name or company, the email address and a reference to the purchase. We also create buyers as a customer contact in The-Y e.U.'s own TheY CRM (name, email address, language, licence key, licence type and purchase channel, and details such as “active”, “cancelled”, “revoked” or “licensed until”). We send you the licence key and notices about the purchase by email, for example about payment, cancellation or refund. To match a purchase to an account on crm.the-y.at, we compare the email address with the user accounts.
Payment processing. Payments via Stripe are processed by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe processes payment details (e.g. card data) and the full billing address directly as an independent controller (Stripe's Privacy Policy); we only take the country from it. Stripe issues the invoices for the Founder subscription. After a full refund or a lost payment dispute, the rights from the purchase end; while a payment dispute is open, they are suspended.
Purpose: concluding and handling the purchase, issuing and managing the licence, sending the licence key and purchase-related notices, proving acceptance of the terms, looking after our customers, and complying with tax and commercial law obligations. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR) for retention under § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 of the Austrian Commercial Code (UGB); our legitimate interest (Art. 6(1)(f) GDPR) in proving acceptance of the terms and in preventing misuse, for example in the case of chargebacks. Recipients: Stripe for payment processing; our hosting provider as a sub-processor (see “Services used & sub-processors”). We do not transfer any personal data to AppSumo. There is no other disclosure.
Retention: we store purchase, licence and billing data for the duration of the contract or licence (the lifetime licence has no end date) and beyond that as long as statutory retention obligations apply: books, records and receipts for 7 years from the end of the calendar year (§ 132 BAO, § 212 UGB). After that, we delete them. We keep the customer contact in our CRM for the duration of the customer relationship and delete it afterwards unless a retention obligation prevents this. Details of the licences: Terms of Use, sections 5 and 6.
Self-hosted installations of TheY CRM (free, Founder and lifetime licence) check their licence online with The-Y's licence server (crm.the-y.at) while they are running, currently about once per hour. In doing so, we process the following as controller:
For each installation we keep only the latest check; earlier checks are overwritten. No content or customer data of the installation is transmitted (e.g. contacts, messages or data from Meta platforms). That data stays on the operator's server, and the operator is responsible for it. In addition, the installation asks crm.the-y.at whether a newer program version is available. No data of the installation is transmitted in doing so; only technical connection data such as the IP address appears in the server's technical logs.
Purpose: to confirm that the licence is valid, to detect misuse (e.g. one key used for several installations) and to know which program versions are in use, for example to send security notices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the licence (Art. 6(1)(f) GDPR). Recipients: none; the data is stored on our servers with our hosting provider.
Retention: we delete the check data automatically 12 months after the licence ends (expiry, revocation or suspension) or 12 months after an installation last reported, whichever comes first. This period allows us to resolve queries and cases of misuse. Data stored when a licence is bought or issued (company, email address, payment records) is covered by the section “Purchase of a licence”. If The-Y shuts down the licence server, the checks end (Terms of Use, section 5).
To improve the website we use Microsoft Clarity (Microsoft Ireland Operations Ltd.), which processes usage data such as clicks, scroll behaviour, heatmaps and pseudonymised session recordings. Input into form fields is masked and not recorded in clear text. Microsoft information: privacy.microsoft.com. Microsoft Clarity is loaded only after your explicit consent via the cookie notice (legal basis: consent, Art. 6(1)(a) GDPR). Without consent, no analytics take place. You can withdraw your consent at any time via the “Cookie settings” link in the footer.
Technically necessary storage is used to operate the website. Analytics services (Microsoft Clarity) are only activated after your consent via the cookie notice. Your choice is stored locally in your browser and can be changed at any time via “Cookie settings” in the footer.
Besides the website, we operate the SaaS service “TheY CRM / Kunden-Support CRM” at crm.the-y.at, an all-in-one CRM and support system. Business customers use it to bundle, manage and answer the communication with their own customers across several channels (including email, the WhatsApp Business Platform, Facebook Messenger, Instagram, comments on Facebook Pages and Instagram, SMS, web chat and integrated telephony), to manage customer, sales and order data (e.g. contacts, companies, deals, invoices, tasks, appointments) and to publish posts on their Facebook Page and Instagram account. The following sections describe the data processing within this service.
For the communication data processed in the service, the respective business customer (our client) is the controller under the GDPR. The-Y e.U. processes this data solely on the business customer's instructions and is a processor in this respect (Art. 28 GDPR, see our data processing agreement). Meta Platforms Ireland Ltd. (Dublin, Ireland) operates WhatsApp, Facebook Messenger, Instagram and Facebook Pages and processes the data arising there as an independent controller under Meta's Privacy Policy; The-Y e.U. has no influence on this. For the transmission of messages via the WhatsApp Business Platform, Meta additionally processes data under the WhatsApp Business terms agreed between the business customer and Meta. For the data that TheY CRM receives via Meta's APIs and stores on behalf of the business customer, The-Y e.U. is the business customer's processor (details under “Data from Meta platforms”). Depending on the channels and functions the business customer uses, further services may be involved as processors or recipients: email, SMS, telephony/SIP and, if the AI functions are used, AI providers. The business customer selects these providers and is responsible for them (see “Services used & sub-processors”). For self-hosted installations, the operator of the installation is solely responsible for the data stored there; The-Y e.U. only receives the licence check and update check data from such installations (see “Licence check of self-hosted installations”).
Depending on the channels and functions used, the service may in particular process the following data of the business customer's customers and business partners:
The processing serves exclusively to provide the CRM and support service to our business customers: receiving, displaying, assigning, answering, managing and documenting the conversations between the business customer and its customers, and related functions such as forwarding, automation, publishing posts and analysis on behalf of the business customer.
Data received via the Meta and WhatsApp APIs is used exclusively to provide the service to the respective business customer and is processed in accordance with the Meta Platform Terms and the applicable developer policies. We do not sell this data and do not use it for advertising, profiling or our own marketing.
Business customers can connect their own WhatsApp Business Account, their Facebook Page and the linked Instagram professional account in TheY CRM under Settings → Channels, using the Meta app “TheY CRM”. The-Y e.U. acts as a technology provider (Tech Provider). The accounts remain in the business customer's own business portfolio, and Meta bills WhatsApp fees directly to the business customer.
When connecting (Facebook Login for Business, WhatsApp Embedded Signup). The business customer logs in in a Meta window and selects which assets to share. We receive:
We do not store the name, profile picture or other profile data of the person who logs in with Facebook. Facebook Login is used only to connect the assets, not to sign in to the CRM.
Access tokens. Access tokens (the WhatsApp Business token, the Facebook user token from the login and the Page token) are stored only on our servers, encrypted at field level with AES-256-GCM. They are never shown in the browser and are used only for the functions of the respective channel. When the business customer deletes the channel in the CRM or resets or deletes its account, the tokens are deleted immediately.
Ongoing operation (webhooks). After connection, our app subscribes to the events (webhooks) of the shared assets, limited to the event types that TheY CRM processes. Meta sends them to us signed and over HTTPS. We assign them to the correct business customer and store them in that customer's area of the CRM:
Events that cannot be assigned to a connected account are discarded and not stored.
What we send to Meta. We send replies, files and template messages that the business customer's staff send in the CRM, and replies to comments. We also send WhatsApp message templates that the business customer creates; they are stored in its WhatsApp Business Account at Meta and reviewed by Meta. Finally, we send posts, images and videos that the business customer publishes or schedules under Marketing → Posts. For publishing, we make the media file available at an unguessable address from which Meta retrieves it.
Keeping the WhatsApp Business app (coexistence). A business customer can connect a number that it keeps using in the WhatsApp Business app on its phone. After connection, we request from Meta, once, the chat history of up to the last 180 days. It is imported as closed conversations; Meta does not transfer group chats. After that, messages sent from the phone are copied to the CRM continuously. We import the contacts from the WhatsApp Business app's address book (name and phone number) only if the business customer ticks “Import WhatsApp contacts (address book)” when connecting; this box is unticked by default. Without it, the CRM only creates people who appear in the imported chat history. With it, people who have never written to the business are created as well; deleting a contact on the phone does not delete it in the CRM. The business customer is responsible for this transfer; it needs a legal basis for it and informs its contacts accordingly. Meta may still deliver chat history during the first few days after connection; a person deleted during that time may be re-created as a result, and the deletion then has to be repeated.
Purpose. The data is used exclusively to provide the service to the business customer: receiving, displaying, assigning and answering messages and comments, managing WhatsApp templates, publishing posts and showing the connection status. We do not sell this data. We do not use it for advertising, profiling or our own marketing, do not pass it on to data brokers and do not use it to train AI models.
Legal bases. Processing on behalf of the business customer is governed by Art. 28 GDPR (data processing agreement) together with the business customer's legal basis. That is usually Art. 6(1)(b) GDPR (handling its customers' enquiries and contracts), Art. 6(1)(f) (legitimate interest in orderly customer communication) or Art. 6(1)(a) (consent, e.g. for marketing templates). We need the credentials and identifiers of the connected accounts to perform our contract with the business customer; this falls under Art. 6(1)(b) GDPR. Signature checks, security and error logs fall under Art. 6(1)(f) GDPR.
Recipients.
There is no other disclosure.
Retention.
Revoking access. The business customer can end the access at any time:
After that, TheY CRM stores no new data from that account. If access is removed only at Facebook or Meta, the then invalid access token remains stored until the channel is also deleted in the CRM. Messages and contacts already stored remain in the CRM until the business customer deletes them or requests deletion; see the data deletion instructions.
Processing on behalf of the business customer is based on a data processing agreement (Art. 28 GDPR). The business customer, as controller, is responsible for the legal basis of the underlying processing (Art. 6(1) GDPR, usually performance of a contract under (b), legitimate interest under (f) or consent under (a)). We process contract and contact data of our business customers themselves to perform the contract (Art. 6(1)(b) GDPR).
When a business registers for the free version, we process, as controller, the company name, name, email address and password (stored only as a hash), and, as proof, the accepted version of the Terms of Use together with the time and IP address of acceptance. Where available, we also store the source of the sign-up: a campaign identifier from the link used (e.g. “src” or “utm” parameters), the domain of the referring website (without path) and the landing page on our website. These details are not stored in the browser (no cookies); they are only passed on via the link and stored with the account at registration. The purpose is to measure through which channels new users find us. The legal basis for the source is our legitimate interest (Art. 6(1)(f) GDPR); for the other details it is performance of a contract (Art. 6(1)(b) GDPR). The data is deleted together with the account.
If someone starts a personal test environment without signing up (“Demo” or “Try it yourself” on crm.the-y.at), we store, to prevent abuse, a non-reversible hash of the IP address formed with a secret key, as well as the start and expiry of the test environment. These details and all data entered in the test environment are deleted automatically no later than 24 hours after the start. No emails, messages, calls or posts are sent from the test environment, and entries are not carried over to a later account. The legal basis is our legitimate interest in an abuse-resistant product demonstration (Art. 6(1)(f) GDPR).
Data is stored on servers in Austria (data centre in Vienna; backups at a separate location in Austria). Access to the service over public networks is encrypted with TLS/HTTPS; HTTP is redirected to HTTPS and HSTS is enabled. Events that Meta sends to our webhooks are verified by their signature (HMAC-SHA256 with the app secret); unsigned or incorrectly signed requests are rejected. Sensitive secrets and credentials (mailbox, SIP, API and channel credentials, channel tokens, 2FA secrets) are additionally encrypted at field level with AES-256-GCM; recovery codes are stored only as a hash. Other content data is not encrypted field by field; it is protected by server, access and operational security. Tenants are separated at database level (row-level security). For details of the technical and organisational measures, see the data processing agreement, Annex 1.
The retention period depends on the instructions and the contractual relationship of the respective business customer. In the service, the business customer can itself delete channels, export data, permanently delete individual persons including their conversations, and reset or delete its entire account. Deletion requests by email, from the business customer or from data subjects, are carried out within 30 days (see the data deletion instructions). By category:
Deletion from backups & logs: automatic backups are kept for 14 days locally on the production server and for 30 days as a copy at a separate location in Austria; the copy is transferred there over an encrypted connection. After that, they are overwritten in the regular rotation. After a deletion, data may therefore remain in backups for up to 30 days and in technical logs for up to 14 days. Backups are not processed in regular operation. ⚠ The backups currently run on a best-effort basis; a formal backup and restore guarantee with a fail-safe will follow with the beta (see DPA, Annex 3).
Depending on the functions activated by the business customer, the following services are involved:
Where data is transferred to third countries (e.g. to an AI provider outside the EU), this is based on appropriate safeguards such as the EU standard contractual clauses. The business customer, as controller, is responsible for selecting the email, SMS, telephony and AI providers it uses and for the corresponding legal basis.
Data is disclosed only to the technical services listed under “Services used & sub-processors”, only to the extent necessary and on the basis of corresponding contracts or, for providers used by the business customer itself, on its instructions. The-Y e.U. does not sell data and does not disclose data for advertising purposes.
Our data deletion instructions (Deutsche Fassung) explain how business customers, their customers, and people who connected TheY CRM to Facebook, Instagram or WhatsApp can delete data or have it deleted. In short:
We handle deletion requests by email within 30 days and confirm the deletion by email.
You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time. Contact for privacy requests, including about the service “TheY CRM”: datenschutz@the-y.at; general: office@the-y.at. We respond within 30 days. To delete data stored in the service, please follow the data deletion instructions. If you are a customer of one of our business customers, that business is the controller; we carry out deletion requests on its behalf or forward them to it. You may lodge complaints with the Austrian Data Protection Authority (dsb.gv.at).
Note: This English text is a courtesy translation; in case of doubt the German version prevails.