Privacy Policy

Last updated: 12 October 2026

1. Who is responsible

The operator responsible for account administration, website and support information is Valentin Cvetanovski, trading as GoLevelBeyond, Dimce Antuleski no 66, 7500 Prilep, Republic of North Macedonia. Contact: support@golevelbeyond.com.

For personal information a business puts into its workspace, that business normally determines the purpose of processing and acts as controller. GoLevelBeyond processes those records to deliver the service on its instructions. Contact the relevant workspace business about its use of your information; we can assist with requests concerning our processing.

2. Information we process

Account and setup information includes your full name, login email, password hash, verification status, workspace name, intended team size and setup progress. Company name, job title and phone number are optional. We record marketing preferences and, where applicable, the time and version of your consent. Verification, password-reset and unsubscribe token hashes support account actions.

Workspace records can include companies, contacts, notes, communications, opportunities, values, owners, tasks, calendar entries, roles, invitations and activity history. Information you provide in support requests is also processed. Technical information associated with requests and sessions may include IP addresses, browser information, timestamps and security events.

Providing required account information is necessary to create and protect your account. Optional profile details and marketing consent are not required to use the service.

3. Purposes and legal bases

We use account and workspace information to provide the service, authenticate users, verify emails, recover accounts and administer authorized collaboration. For our account relationship, this processing is necessary to perform our agreement with you or take steps you request before entering it.

We process limited technical and support information to protect accounts, prevent abuse, troubleshoot and respond to enquiries, relying on legitimate interests where applicable and balancing those interests against your rights. We retain information required for legal obligations on that basis. Optional marketing and non-essential analytics rely on your consent. Processing customer CRM records is carried out on the workspace controller's instructions; that controller is responsible for its legal basis.

We do not sell your personal information or use customer CRM records to build advertising audiences. We do not make decisions producing legal or similarly significant effects about you solely through automated profiling.

4. Workspace visibility

Your workspace information may be available to teammates according to their roles and permissions. Owners and admins manage access. Information you contribute to a shared workspace may remain after you leave or delete your personal account. Workspace owners should explain their own retention and sharing rules to their users and contacts.

5. Connected email and calendars

Connections to Google or Microsoft are optional. When you authorize a connection, we process the connected account identifier, granted permissions, access credentials and relevant mailbox or calendar information to provide the features you use. This can include reading or sending messages and synchronizing calendar events where the granted permissions support those actions. Authorization screens show the permissions requested.

You can disconnect a connection in the app and revoke permissions with Google or Microsoft. Disconnecting stops that connection's future access but does not automatically erase previously imported CRM records or data held by the provider. Do not connect an account you are not authorized to use.

6. Providers and other disclosures

Our current service providers include Railway for hosting, MongoDB Atlas for database storage and Brevo for transactional email. They process information needed for their services. Google and Microsoft process information when their integrations are used, under their own terms as well as the authorization you grant.

Paddle is the intended subscription payment provider. No live checkout is connected at present. When enabled, Paddle will process purchase and billing information as Merchant of Record under its Privacy Notice. We receive subscription information needed to manage access; you should never send full card details to our support address.

We may disclose necessary information where required by law, to protect the service or legal rights, or as part of a business transfer subject to appropriate confidentiality and privacy obligations. Access is limited to what is needed for the relevant purpose.

7. International processing

We operate from the Republic of North Macedonia. Cloud and connected-service providers may process information in other countries. The locations and protections depend on the provider and service configuration. Where a transfer requires safeguards under applicable law, those safeguards must be established for that transfer. Contact us for information about processing locations and applicable transfer arrangements.

8. Cookies, browser storage and analytics

The app uses session cookies to support authenticated access. Browser storage may hold preferences and interface state. The website stores an analytics preference when you make a privacy choice.

Google Analytics is not currently configured and Meta Pixel is not installed. If optional analytics is introduced, the notice and controls will be updated before it is activated; optional tracking will require consent. You can revisit choices using the footer's Privacy choices control. Declining marketing or analytics does not prevent account registration.

The website question form opens an email draft in your email application. It does not deliver the question to a website submission endpoint. We receive it only if you send the email.

9. Service emails and optional marketing

Verification, password recovery, security, billing and important service notices are operational messages. They are separate from marketing preferences.

Marketing consent is optional and unchecked by default at registration. If you opt in, we may send product news and offers; you can withdraw consent through an unsubscribe link or by contacting support. Withdrawal does not affect earlier lawful processing. Promotional campaigns are not currently connected. We may keep a minimal opt-out record to respect your choice.

10. Retention and deletion

We keep account and workspace records while needed to provide the service and administer the account. Owners can deliberately delete workspaces through the app, subject to authorization and confirmation. Shared-workspace ownership must be resolved before deleting an owner account. Deliberate deletion removes active records and does not provide a guaranteed recovery period.

For future paid subscriptions, our subscription-expiry policy is to allow 30 days after access ends to request recovery or export before removing workspace records from active systems. This billing-related lifecycle is not active while paid checkout is unavailable. It does not delay a valid deletion request or restore records deliberately deleted earlier.

Support, security and legal records are retained only for as long as needed for their purpose, including resolving disputes, preventing abuse or meeting legal requirements. Copies in backups, where maintained, may persist until normal replacement; deletion from active storage is not a promise of immediate erasure from every backup. Contact support for a retention or deletion request concerning your information.

11. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to certain processing and withdraw consent. We may need to verify your identity and authority over workspace records. We will respond within the time required by applicable law and explain any lawful restriction.

You can complain to the Agency for Personal Data Protection of the Republic of North Macedonia, or another competent supervisory authority. You do not need to contact us before exercising that right.

12. Security, children and updates

We use password hashing, session controls and workspace authorization to protect access. No system can guarantee complete security. Keep your credentials private and report suspected compromise to support@golevelbeyond.com.

The service is intended for adults using it for business, not children. Contact us if you believe a child has supplied account information. Material changes to this policy will be communicated by email or an in-app notice as appropriate. The date above identifies the latest version.