Privacy Policy
Last updated: October 2026
1. Who we are
ImportToD365 is a service of Hexabyrd LLC. We are responsible for the personal data we collect through this website and through Service accounts.
For the data you import into your Dynamics 365 (for example, contacts or leads from your CRM), we act on behalf of your organization: we process it only to validate and import it, according to its instructions.
2. What data we collect
Contact form: your name, email, company (optional), the reason for your inquiry and your message.
Service account: when you sign in with Microsoft, we receive your name, your email and your organization’s identifier, and we record your account activity (for example, the imports you run).
Billing: the plan purchased, dates and payment status. Your card details are processed by Stripe and never go through our servers.
Data you import: the files and records you upload to import into your Dynamics 365.
Website usage data: through Vercel Analytics we collect anonymous visit data (pages viewed, country, device type), without tracking cookies and without data that identifies you.
Language preference: a functional cookie that remembers whether you prefer the site in Spanish or English.
3. How we use your data
Answer the inquiries you send through the contact form.
Provide the Service: authenticate you, run your imports, generate your reports and manage your plan.
Charge for paid plans and meet accounting obligations.
Understand website usage, anonymously, to improve it.
We don’t sell your data or use it for advertising. We don’t process your data with AI models.
4. Legal basis
We process your data with your consent (contact form), to perform the Service contract (account, imports and billing) and on the basis of legitimate interest (anonymous website analytics). You can withdraw your consent at any time, without affecting prior processing.
5. Who we share your data with
We don’t sell or transfer your personal data. We work with these providers, who process it on our behalf:
Vercel: website hosting and anonymous analytics.
Resend: sending contact form emails and notifications.
Microsoft Azure: infrastructure where the Service runs and where each import’s data is stored temporarily.
Stripe: payment processing.
6. How long we keep your data
Contact messages: up to 12 months from receipt.
Each import’s data (file, results and report): automatically deleted after 7 days.
Account and billing data: while your account is active and for as long as the law requires.
If you signed up for our former early access list, we keep your email until you ask to unsubscribe.
7. International transfers
Our providers may process data outside your country, for example in the United States. When that happens, we do so with the contractual safeguards those providers offer for data protection.
8. Your rights
You can request access to your personal data, its correction, deletion or portability, and withdraw your consent. Write to us and we’ll reply within 30 days. To stop receiving our emails, use the unsubscribe link included in each one.
9. Users in the European Union
If you’re in the EU, your rights are protected by the General Data Protection Regulation (GDPR — Regulation 2016/679). If you believe we handle your data incorrectly, you can file a complaint with your country’s data protection authority.
10. Users in the United States — CAN-SPAM and state laws
If you’re in the United States, the following applies:
CAN-SPAM Act: every commercial email we send identifies ImportToD365 as the sender, includes our contact information and offers a clear way to unsubscribe. We process unsubscribe requests within 10 business days.
California (CCPA): we don’t sell your personal data. California residents can request access to or deletion of their data by contacting us.
Other states (Virginia, Colorado, Texas, etc.): we apply the same rights — access, correction and deletion — to all US residents, regardless of state.
11. Security
We apply reasonable technical and organizational measures to protect your data: Microsoft Entra ID sign-in, delegated permissions, encrypted connections and automatic deletion of each import’s data. No system is 100% secure, but we work to keep the risk to a minimum. The details are on the Security & architecture page.
12. Cookies
This website uses a single functional cookie to remember your language. We don’t use tracking or advertising cookies, and Vercel Analytics works without cookies. In the app, the browser stores your Microsoft session and your language preference so you don’t have to set them up again.
13. Changes to this policy
We may update this policy. If the changes are significant, we’ll let you know by email if you have an account. The date of the last update always appears at the top of this page.
14. Contact
Use the contact form or email us: