Privacy Policy

Effective date: 12 November 2026

This policy explains what data the Dedup by Reform widget for Kommo and amoCRM (the “Widget”) processes, why, and how it is protected. The Widget is provided by Reform (reform.bz).

1. Who we are

For the data described below we act as the data processor on behalf of the CRM account owner.

2. What data we process

2.1 Base check and merging. The check, merging, manual review, merge log and undo run in the user's browser on the CRM page. Contact and company data (names, phones, emails, the field values chosen in the settings, links to leads, contacts and companies) is read from the CRM and processed in the browser only; it is not sent to our server. The merge log and the data needed to undo a merge are stored as notes in the CRM itself.

2.2 New duplicates from the Digital Pipeline. When the Widget action fires, our server receives the account ID and the lead ID. Using the access token, the server reads the lead's contacts and company and searches the CRM for duplicates; if a duplicate is clear, it links the lead and cards to the older card, moves phones, emails and tags to it and writes a note with the data needed to undo. This data is processed only in memory while the request runs and is not stored on our server. The server stores only the IDs of leads, cards and groups waiting to be processed, for up to 3 days, and a short technical log without personal data.

2.3 Access tokens. The OAuth tokens that the CRM issues when the Widget is installed, stored encrypted and used only for the actions in section 2.2.

2.4 Support contacts. If you write to us, we receive the contacts you send and use them only to answer you.

3. Why we process it

• To provide the Widget: find and merge duplicates, keep the merge log and undo merges.
• To provide support.

We do not sell data, do not use it for advertising, do not use it to train AI models and do not share it with third parties, except the service providers listed below.

4. Where the data is stored and who has access

• Cloudflare, Inc.: hosting of the Widget server (Cloudflare Workers and Durable Objects).
• Kommo / amoCRM: the CRM itself, which the Widget accesses through the official API and the native merge.

Access is limited to the Reform team members who maintain the Widget. Data is transmitted over encrypted connections (HTTPS).

5. How long we keep it

• Access tokens are deleted when the Widget is disabled in the CRM.
• IDs of leads and cards waiting to be processed are deleted after processing and in any case within 3 days.
• Notes with the merge log stay in your CRM; you can delete them like any other notes.

6. Your rights

You may request access to, correction of, or deletion of your data, or object to its processing, by writing to admin@reform.bz. We answer within 30 days. We process personal data in accordance with the Law of the Republic of Moldova No. 133/2011 on personal data protection and, where applicable, the EU General Data Protection Regulation (GDPR).

7. Changes

We may update this policy. The current version is always available at this address, with the effective date at the top.