Privacy policy.

1. Who is responsible

CMTools is run by SillySanta AS, org. no. 916 896 050 MVA, Lilletorget 1, 0184 Oslo, Norway. SillySanta AS is the data controller for the website, for enquiries, and for the contact people and user accounts of our customers. For the data a store puts into Returns or AMED, the store is the controller and we are its processor (section 8).

Questions about privacy go to [email protected].

We have not appointed a data protection officer, as the business does not fall within the requirement in GDPR Article 37.

2. What we collect

When you email us: your name, your email address and what you write to us, for example your company and how you handle returns today.

When you send the contact form: what you want to set up, your email, your store's address, and any setup details or preferred call time you add. Cloudflare passes it on to our inbox as an email.

When you visit the site: the contact form on the contact page is the site's only form. The site sets no cookies of its own, and has no ad networks or tracking pixels. Cloudflare and our hosting provider handle technical data, such as your IP address, to deliver the pages and keep the site secure. We use Cloudflare Web Analytics to count page views and measure how fast pages load. It sets no cookies and does not follow you to other sites.

When your company is a customer: the name, email address, phone number and role of your contact people; invoicing details; the user accounts your staff have in Returns or AMED (name, email address, role, and log-in and security records); and what we exchange in support cases.

3. Why, and on what lawful basis

• Answering your email or contact request, holding any call and following up a possible agreement: legitimate interest, GDPR Article 6(1)(f), in replying to an enquiry you sent us yourself. Where an agreement is entered into: Article 6(1)(b).
• Running a customer's agreement, user accounts and support: Article 6(1)(b), and legitimate interest (Article 6(1)(f)) where the person is an employee of the customer rather than a party to the agreement.
• Invoicing and bookkeeping: legal obligation, Article 6(1)(c).
• Delivering the website and the services securely: legitimate interest, Article 6(1)(f).

We do not use your data for automated decision making or profiling, and we never sell it.

4. How long we keep it

• Enquiries and contact requests that don't lead to a customer relationship: deleted no later than 24 months after the last contact.
• Contact people and user accounts: for as long as the agreement runs, and deleted within 30 days after it ends.
• Invoices and other accounting records: for as long as the Norwegian Bookkeeping Act requires (five years after the end of the financial year).

5. Who we share it with

Only with the processors below, and for customers, the providers listed for Returns and AMED (section 8). They process data on our behalf, under a data processing agreement. Otherwise, we disclose data only where the law requires it.

6. Transfers outside the EEA

Cloudflare and Salesforce are United States companies, and Microsoft's Irish company can pass data to its parent in the United States. Where data leaves the EEA, the transfer is covered by the EU–US Data Privacy Framework, under which all three are certified, and by the standard contractual clauses in their data processing agreements.

7. Your rights

You have the right to:

• see the data we hold about you
• have inaccurate data corrected
• have data erased where we no longer have a basis for keeping it
• ask us to restrict processing
• object to processing based on legitimate interest
• receive your data in a machine-readable format

Email [email protected] and we will answer within 30 days, free of charge. If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet. We would appreciate hearing from you first, so we can put it right.

8. Returns and AMED

Both tools connect to a store's Shopify account as apps. The store is the data controller for that data. We are its processor: we process it only on the store's instructions, under our data processing agreement.

• What Returns reads and writes: the orders a shopper returns or claims on, with the shopper's name, email address, phone number and address; products and stock; and the refunds, gift cards, exchange orders and fulfilments it creates. It also stores what the shopper enters: reasons, photos, receipts and shipping details.
• What AMED reads: orders, products and stock, read-only. It does not ask Shopify for customer records. It also reads the ad, sales and stock sources the store connects.
• What we use it for: only to run the service for that store. We never sell it, and we never use it, or let our providers use it, to train AI models.
• Where it goes: both tools are hosted in the EU, with databases in Ireland and Sweden. Email delivery, error monitoring and the AI models are run by providers who may process data in the United States, under the EU–US Data Privacy Framework or the standard contractual clauses. The providers are on our sub-processor list.
• How long: for as long as the store uses the service. When the store's agreement ends, we delete its data within 30 days, or after giving the store an export if it asks for one.

A question about your own return or warranty claim? Contact the store you bought from. We can't look up your data or act on a request without the store's instruction.

Our sub-processors are on the sub-processor list, and stores that need our data processing agreement can ask at [email protected]. How we look after the data is on the Trust page.

9. Changes

If we change this policy, we update the date at the top. For material changes, we tell active customers directly.