Start free

Privacy Policy

Last updated 30 September 2026

Who we are

Commission Slate is a commission tracking product made by Skyfall Labs (“we”, “us”). This policy explains what personal data we handle when you use the Commission Slate extension for Zoho CRM, when you use theCommission Slate web app at app.commissionslate.com, and when you visit commissionslate.com. Questions can go to [email protected].

Data processed by the Zoho CRM extension

The extension runs inside your own Zoho CRM organisation. The data it works with (deals, invoices, sales orders, payees and the commission records it creates) stays in your Zoho CRM. The extension reads the records you point it at and writes only to its own modules; it never modifies your deals, invoices or sales orders. No copy of your CRM data leaves Zoho.

The Commission Slate web app

The web app (app.commissionslate.com and its API at api.commissionslate.com) is a separate product from the Zoho CRM extension. Unlike the extension, the web app stores your data on our infrastructure. This section describes that data.

Data we collect

  • Account details: your email address, name and a hashed password. Passwords are never stored in plain text.
  • Organisation settings, and the members of your organisation and their roles.
  • Sales records and their amounts and custom fields, which you or your team upload (for example by CSV) or enter manually.
  • Commission calculations, payouts and statements produced from those records.
  • An audit log of actions taken in your organisation (who did what, and when).
  • Session cookies, which are strictly necessary to keep you signed in and to protect against cross-site request forgery: cs_session and cs_csrf.

We do not use advertising or analytics trackers in the web app.

Why we use it, and our legal basis

We use this data to provide the service: to create and secure your account, calculate and record commissions, produce statements, send transactional email (such as invitations and password resets from [email protected]), and respond to support requests. Our legal basis is performance of our contract with you or your organisation and, for security, abuse prevention and improving reliability, our legitimate interests.

Who can see it

  • Only members of the same organisation, according to their role. Sales reps see only their own commission.
  • Skyfall Labs staff, only for support or security purposes, and with a logged reason.

Processors

We use these providers to run the web app, and they process data only on our behalf:

  • our hosting provider for the web app and API;
  • MongoDB Atlas, which stores the application data;
  • Cloudflare, for DNS and network protection;
  • our own mail server, which sends transactional email.

Retention

We keep your data while your account is active. If an organisation asks us to delete it, we delete the organisation’s data within 30 days, and backups rotate out within 90 days after that request.

Security

Connections use TLS, passwords are hashed, organisation data is isolated on the server, access is role-based, and actions are recorded in an audit log. See Data and security.

Export and deletion

To export or delete your data, email [email protected].

International transfers

Our providers may process data in countries other than your own. Where personal data is transferred across borders, we rely on appropriate safeguards such as contractual protections with our providers.

Children

The web app is not intended for anyone under 16, and we do not knowingly collect their data.

Data collected by this website

The website does not use advertising or analytics trackers and does not set tracking cookies. The only place we collect data is the waitlist form. If you join the waitlist we store:

  • your email address (required);
  • your name, company and the CRM you use, if you provide them;
  • the page or campaign that referred you (for example a link’s UTM parameters);
  • a hashed form of your IP address and your browser’s user-agent string, used to prevent abuse.

We use this to tell you when Commission Slate is available for your CRM, to understand which integrations people want, and to protect the form from spam. We keep waitlist data until you ask us to remove it or you unsubscribe from our messages. Like most web servers, our hosting provider may keep standard access logs (IP address, time, requested page) for a limited period for security and troubleshooting.

We do not sell your data

We do not sell personal data, and we do not share it for advertising.

Service providers

We use a small number of providers to run the site and waitlist:

  • our web hosting provider, which serves the website and API;
  • MongoDB Atlas, which stores waitlist records;
  • Cloudflare, which provides DNS and network protection for our domain.

These providers process data only on our behalf and to provide their service.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you, to object to or restrict its use, and to complain to your local data protection authority. To exercise any of these rights, email [email protected]. We will respond within a reasonable time.

Changes to this policy

We may update this policy as the product and site change. The date at the top shows when it was last revised; for significant changes we will say so on this page.

Contact

Skyfall Labs · [email protected]