Privacy Policy

Effective date: 14 October 2026

This policy explains what data the Schedule by Reform widget for Kommo (the “Widget”) collects, why, and how it is protected. The Widget is provided free of charge by Reform (reform.bz).

1. Who we are

For the data described below we act as the data processor on behalf of the Kommo account owner, except for the support contacts in section 2.5, for which we are the controller.

2. What data we process

2.1 Kommo account data. Account ID, name, address (subdomain) and country; the list of users with their Kommo IDs, names, e-mail addresses, role (administrator or not), active status and group. We use this to show employees in the schedule and to check who may edit it.

2.2 Schedule data. Shifts, breaks, days off, vacations and sick leave that your users enter in the Widget, the distribution queues and their weights, and the list of users allowed to edit the schedule. When the Grab feature is on, the Widget keeps a connection between the open Kommo page and our server to show lead offers (lead ID, name and amount) and stores who took a lead and the end time of a break a user starts with the Break button.

2.3 Lead distribution. When the Digital Pipeline trigger fires, we receive the lead ID and read its current responsible user. We then change the responsible user and, if enabled in the rule, create a task and a note in the lead. We keep an assignment log: time, lead ID, assigned user and the reason. We do not read or store lead contents, contacts, messages or other CRM data.

2.4 Access tokens. The OAuth tokens that Kommo issues when the Widget is installed, used only to perform the actions above.

2.5 Support contacts. When the Widget is installed, we receive a notification with the account name, address, country, number of users, and the names and e-mail addresses of its administrators, so that we can offer help with the setup. When installing the Widget, the administrator confirms a contact e-mail, name and phone number (prefilled from their Kommo profile), and may later leave a name, company and phone number in an optional form inside the Widget. Ideas sent from the Wishlist tab are received together with the account name and the sender's name. We use these contacts only to provide support and to contact you about the Widget.

3. Why we process it

• To provide the Widget: show the schedule, distribute leads, create tasks and notes, and answer API requests from your own services.
• To provide support and contact you about the Widget (section 2.5).

We do not sell data, do not use it for advertising and do not share it with third parties, except the service providers listed below.

4. Where the data is stored and who has access

• Cloudflare, Inc.: hosting of the Widget server and database (Cloudflare Workers and D1).
• Telegram: an internal, private chat of the Reform team that receives the support notifications from section 2.5.
• Kommo: the CRM itself, which the Widget accesses through the official API.

Access to the data is limited to the Reform team members who maintain the Widget and provide support. Data is transmitted over encrypted connections (HTTPS).

5. How long we keep it

• Access tokens are deleted when the Widget is disabled in Kommo.
• Schedule data, rules and the assignment log are kept while the Widget is in use, so that nothing is lost if it is reinstalled. They are deleted within 30 days of a deletion request.
• Support contacts are kept for as long as needed to provide support, and are deleted on request.

6. Your rights

You may request access to, correction of, or deletion of your data, or object to its processing, by writing to admin@reform.bz. We answer within 30 days. We process personal data in accordance with the Law of the Republic of Moldova No. 133/2011 on personal data protection and, where applicable, the EU General Data Protection Regulation (GDPR).

7. Changes

We may update this policy. The current version is always available at this address, with the effective date at the top.