Bitrix24 Comment Manager
Privacy policy
The short version. Using the extension sends us nothing. Your comments, your leads and your Bitrix24 credentials go to a backend you run, not to us. The only time we receive anything is when you choose to write to us through the support form. There is no analytics, no tracking and no advertising anywhere in this project.
On this page
1. Who we are
Bitrix24 Comment Manager is an open source project published by PalWorks,
which operates from Abu Dhabi, United Arab Emirates and Madurai, India.
This policy covers the Chrome extension, this website, and the support
service at b24.palworks.ai. Write to
support@palworks.ai with any
question about it.
It does not cover the backend server that you or your administrator deploy. You run that, you control what it stores, and you are its data controller. What it holds is described in section 3 so you know what you are responsible for.
2. What the extension stores on your computer
Everything in this section stays in your browser profile. None of it is transmitted to us.
| What | Where | Why |
|---|---|---|
| Your backend URL | chrome.storage.local |
So the extension knows which server to talk to |
| Bitrix24 portals you added | chrome.storage.local |
So the extension activates on your portal |
| Your session token | chrome.storage.session |
To prove who you are to your own backend. Memory backed, cleared when the browser closes, and unreachable from any web page |
| Comments made this session | chrome.storage.session |
So the popup can still show them after it is closed and reopened |
The extension never holds your Bitrix24 password or your Bitrix24 API credentials. Those stay on the server side.
3. What goes to your backend
When you comment on a lead, the request goes to the backend at the URL you configured. That server is operated by you or your organisation. We have no access to it and receive no copy of anything it handles.
That backend records, in its audit log:
- which agent performed the action, and on which lead
- what the action was, and whether it succeeded
- when it happened
- a SHA-256 hash of the comment text
The text of your comments is never stored in the audit log, only that hash, which is enough to detect a duplicate but cannot be turned back into the comment. The comment itself goes to Bitrix24, where it lives under Bitrix24's own terms and privacy policy.
That backend also stores the Bitrix24 access and refresh tokens for each connected agent. They are encrypted with AES-256-GCM before they are written to its database.
4. What we actually receive
One thing only: what you type into the support form, on this site or inside the extension, at the moment you press send.
- your name, email address, and phone number if you give one
- the topic you chose and the message you wrote
- a file, if you attach one
- a small amount of context to help us reproduce the problem: the extension version, whether a backend is configured, the page you wrote from, and your browser's user agent string
That context deliberately excludes anything about your CRM. No portal contents, no lead data, no comment text, and no token is ever attached.
We use it to answer you and to fix what you reported. We do not sell it, we do not share it for advertising, and we do not add you to a marketing list unless you asked to be told when hosted plans open, which is a separate, clearly labelled action.
Our support server keeps a standard web access log, which records the IP address and the path of each request. It exists so that abuse of a public, unauthenticated form can be investigated. It rotates automatically and is capped in size, so it is not a long term record.
5. This website
This site is static. It sets no cookies, runs no analytics, and contains no advertising or tracking pixels. The only script on it is the support form on this domain.
Two things happen simply because a browser loads a page:
- GitHub Pages serves these files, so GitHub receives your IP address and request details, as described in the GitHub Privacy Statement.
- Google Fonts serves the typeface, so Google receives your IP address when the font file is fetched.
6. Who else is involved
| Service | What it does | What it sees |
|---|---|---|
| GitHub Pages | Serves this website | Your IP and request details |
| Google Fonts | Serves the typeface | Your IP when the font loads |
| Cloudflare | DNS for palworks.ai | DNS queries |
| Oracle Cloud (London, UK) | Hosts the support service | Traffic to that server |
| Resend | Delivers support messages as email | The message you sent, so it can be delivered |
Notably absent: any analytics, attribution, session recording or advertising provider. There are none.
Where it is processed
The support service runs in Oracle Cloud's London region, so a message you send through the form is processed in the United Kingdom before it is delivered to our mailbox. We operate from the United Arab Emirates and India, so our own staff read it from there. If you would rather not have your correspondence cross borders, the issue tracker is a public alternative that needs no personal details at all.
7. How long we keep it
Support messages stay in our mailbox for as long as they are useful for support history, and you can ask us to delete yours at any time. Server access logs rotate on a fixed size and count, so old entries are overwritten rather than accumulating indefinitely.
Anything stored by your own backend is kept for as long as you configure. The audit log ships with a retention job you control.
8. Your rights
Depending on where you live you may have the right to ask for a copy of what we hold about you, to have it corrected, or to have it deleted. Because the only thing we hold is your correspondence, that is a short conversation. Email support@palworks.ai and we will act on it.
For anything held by your employer's backend, ask your administrator: we cannot reach that data.
9. Children
This is a business tool for CRM teams. It is not directed at children and we do not knowingly collect anything from them.
10. Changes
If this policy changes, the date at the top changes with it, and the edit is visible in this site's public commit history. There is no version of this document you cannot see.