Termeni și condiții

1. Agreement

These Terms govern your use of polimorf CRM, including this marketing site and the application at crm.polimorf.md (together, the "Service"). By accessing or using the Service you agree to be bound by them. If you are agreeing on behalf of a company, you confirm you may bind it.

The Service is delivered as a single hosted deployment that we operate. There is no on-premise edition, no per-customer installation and no licence to run the software yourself.

2. Workspaces and accounts

Your organisation gets a workspace — an isolated tenant with its own database schema — containing one or more projects. Access is invite-only. There is no public sign-up: we register your first administrator, and that administrator creates everyone else. A person cannot register themselves into your workspace.

You are responsible for the security of your users' credentials, for who you invite, for the permissions you grant them, and for everything done under those accounts. Deactivate people who leave. Tell us promptly about any unauthorised access. Keep your workspace's security contact current — we ask you to confirm it once a year, and it is the address we use to reach you about an incident.

3. Your role and ours

For the personal data in your workspace — your contacts, their messages, your recordings — you are the controller and we are your processor. You decide what is collected, on what legal basis, and for how long. We process it on your instructions and for no purpose of our own. Configuring retention, consent and channels in the product is how you give us those instructions.

That allocation is not a formality. It means the lawful basis for messaging or recording someone, the honouring of their objections, and the answering of their access and erasure requests are yours. We build the machinery; you make the decisions. Our Privacy Policy describes the machinery, and a Data Processing Agreement forms part of these Terms — ask contact@polimorf.md for the current version and the sub-processor register that goes with it.

4. Acceptable use

You may not use the Service:

• In violation of any applicable law, or of the terms of a channel you connect through it.
• To send unsolicited bulk or marketing messages. polimorf is for conversational and transactional messaging with people you have a relationship with. It ships no campaign builder, no drip sequences and no broadcast, and it is not to be used as a bulk sender by other means.
• To contact anyone who has opted out, on any channel, for any purpose.
• To request, transmit or store full payment card numbers, CVV codes, bank account numbers or national identity numbers over a messaging channel. The Service scans outbound messages and will refuse to send them.
• To probe, scan or attack systems without authorisation, or to interfere with other tenants.
• To store or transmit content that infringes someone else's rights, or that is unlawful.

We may suspend a workspace, a user, or a single channel to stop ongoing harm or to comply with a platform's demands. Where it is possible to warn you first, we will.

5. Connected channels

The Service carries your conversations over third-party platforms — WhatsApp Business Platform, Facebook Messenger, and email through Gmail, Microsoft 365 or your own mail server. Connecting one means you accept that platform's own terms and policies, and that we must apply them. Practically:

• Their rules become your rules. Messaging windows, template approval, prohibited content and opt-out handling are set by the platform, not by us. We enforce them because we have to.
• Marketing requires consent. On WhatsApp and Messenger, prior consent from the recipient is required for marketing messages, and legitimate interest is not available to you. Obtaining and evidencing that consent is your responsibility. Service and transactional messages are treated differently.
• Opt-outs are absolute and permanent. Every send passes through one suppression check with no override and no "force send". A STOP keyword or a one-click unsubscribe suppresses the recipient, and we never delete that suppression record — deleting it would let the same person be contacted again after a re-import.
• What we can and cannot stop. polimorf blocks a prohibited send, and where your mailbox is mirrored it will flag one made outside polimorf after the fact. We cannot technically prevent a person opening their own mail client and writing to someone who opted out. We say this plainly rather than implying a guarantee we cannot keep.
• WhatsApp data location is decided once. Each number is registered with Germany as its storage region, because no EU-wide option exists, and that cannot be changed afterwards without deregistering the number. You acknowledge this before we register anything.
• Shared platform risk. We connect to Meta through a single vendor application. Enforcement action by Meta against that application, or a change to a platform's API, policy or pricing, can affect messaging for every customer at once. That is a structural feature of these platforms and it is outside our control.

6. Telephony and call recording

polimorf is not a telecommunications provider. We do not sell you a telephone service, assign or port numbers, or provide access to emergency services. You bring your own SIP trunk or carrier; we operate the media path and the CRM around it. Your carrier remains your carrier.

Call recording is off until you turn it on, and it is your decision, per project. When you turn it on, these are yours to get right:

• The lawful basis for recording in every jurisdiction you call, and for recording your own staff. Recording law varies, it is stricter than most people assume, and in some countries recording without consent is a criminal offence.
• The announcement. A spoken notice is played to the other party by default, in the language you choose, from wording we write and you cannot edit — the announcement is the legal control, so it is not editable text. Turning it off is possible, and it requires a specific permission, a named person, and a written confirmation of your legal basis, all of which are permanently recorded in your audit log.
• Honouring objections. If someone asks not to be recorded, recording stops and the whole recording is deleted rather than truncated, and they are not recorded on future calls. This behaviour cannot be switched off.
• Your own equipment. If you terminate calls on your own PBX, we will not record unless your system can confirm the announcement was played. If it cannot, recording does not start. We would rather you lose the feature than lose the compliance.

Your users see a recording indicator on screen for the duration of a recorded call. Access to recordings is a permission separate from seeing that a call happened, and every playback, download and export is logged.

7. AI features

Transcription, summarisation, reply drafting and search over your conversations are optional. They are off until you enable them, per feature and per project, and enabling one requires you to acknowledge the model provider as a sub-processor and the international transfer it involves. Where AI-generated content is shown to one of your customers, it is disclosed as such, and drafted replies are always confirmed by a person before they are sent.

Automatic transcripts contain errors and are not a record of what was said. Do not rely on one as evidence. We do not analyse voice for emotion or affect, and we will not build it.

8. Your content

You retain all rights to the data and content in your workspace ("Customer Content"). You grant us only the limited licence needed to host, transmit, secure and process it in order to provide the Service. We do not use Customer Content to train models, to build cross-customer benchmarks, or for any product purpose of our own.

You are responsible for having the right to put Customer Content into the Service in the first place — including message content and recordings that concern people who are not your users.

9. Availability and change

We do not currently offer a contractual uptime commitment or service credits, and we will not pretend otherwise until we can stand behind a number. We take availability seriously — backups, restore drills and on-call are in place — but the honest statement today is that the Service is provided without a guaranteed availability level.

The Service is one continuously updated deployment. We add, change and remove features, and a change made necessary by a third-party platform can arrive without much notice. Where a change materially reduces what the Service does, we will tell you.

10. Confidentiality

Each party will protect the other's confidential information with reasonable care and use it only as these Terms permit. Our staff do not access your workspace without a grant you create; the terms of that access, including the emergency path, are described in the Privacy Policy and the DPA.

11. Security incidents

If we become aware of a personal data breach affecting your workspace, we will notify you within 24 hours and give you the information you need for your own notification obligations. You will keep your security contact current so that we can reach you.

12. Warranty disclaimer

The Service is provided "as is" and "as available", without warranties of any kind except those the law does not allow us to exclude. We disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement, and we do not warrant that the Service will be uninterrupted, error-free, or that any third-party platform will keep working the way it does today.

13. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, arising out of the Service. Nothing here limits liability that cannot be limited by law.

14. Suspension and termination

You may close your workspace at any time. We may suspend or terminate it for material breach of these Terms, for non-payment, or where a platform we depend on requires it.

A suspended workspace becomes read-only for your users while still receiving your customers' incoming messages, so a billing problem does not cost you a conversation. You can still read and export.

On deletion, your workspace enters a grace period — 30 days by default — during which nothing is destroyed and the deletion can be reversed. You can request a full export of your workspace before and during it. When the grace period ends, the schema is dropped, the stored files are deleted and your encryption key is destroyed. Backups made before that point expire on their own within the published windows. An export archive is available for 7 days after it is built.

15. Changes to these Terms

We may update these Terms. We will tell you before a material change takes effect, and continued use after that date is acceptance. New sub-processors are notified separately, with 30 days to object.

16. Governing law

These Terms are governed by the laws of the jurisdiction in which polimorf is established, without regard to conflict-of-laws rules. The governing law and the competent courts are stated in the order form and the Data Processing Agreement that apply to your workspace.

17. Contact

Questions about these Terms, or about personal data: contact@polimorf.md.