Privacy Policy
How [Legal entity name] handles personal data in Application.
Last updated 2026-09-01
Introduction
This Privacy Policy explains how [Legal entity name] (“we”, “us”) processes personal data when you use Application, visit our marketing pages, or contact us.
Registered address: [Registered address]. Governing context: [Jurisdiction].
Who Is the Data Controller
For account and platform administration data (for example your login email and authentication events), [Legal entity name] is the controller.
For CRM and operations data that a Business stores about its own customers, clients, companies, contacts, invoices, and similar records, the Business (customer) is the controller and we act as processor. See DPA.
Scope & Roles
| Context | Role of Application operator | Role of customer |
|---|---|---|
| User account, login, billing identity | Controller | — |
| Business CRM / ops records (customers, invoices, etc.) | Processor | Controller |
| Public contact form submissions (Formspree) | Controller (of inquiry data) | — |
Application uses Business tenancy. Team members invited into a Business can access that Business’s data according to roles and permissions.
Data We Collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email, password hash, verification status | Create and secure accounts |
| Business profile | Business name, settings, memberships, roles | Provide tenancy and access control |
| CRM / ops content | Customers, clients, companies, contacts, products, services, invoices, quotes, expenses | Provide the product features you use |
| Auth & session | Session identifiers, password-reset and verification tokens | Authenticate and protect accounts |
| Billing | Plan, subscription status, Stripe customer/payment references | Process subscriptions |
| API credentials | Client IDs and hashed/secret material for Integration apps | Enable scoped API access |
| Support & contact | Messages sent via contact forms or email | Respond to inquiries |
| Technical | Basic server logs and security telemetry | Operate and secure the service |
How We Collect Data
- Directly from you when you register, verify email, reset passwords, or update settings
- From Business owners who invite you or enter CRM/ops records
- Through the Integration API using X-Client-Id and X-Client-Secret
- From Stripe for checkout and subscription events
- From Formspree when you submit public contact or sales forms
- Automatically via necessary cookies and local UI preferences (see Cookie Policy)
How We Use Data & Legal Bases
Uses
- Provide, maintain, and secure Application
- Authenticate users and manage Business memberships
- Process plan upgrades, renewals, and billing status via Stripe
- Send transactional email (verification, resets, invitations) via SMTP/Nodemailer
- Support optional Business outbound email when you configure a provider
- Respond to support, privacy, and legal requests
- Detect abuse and enforce the Acceptable Use Policy
Legal bases (where GDPR-style rules apply)
- Contract — to provide the service you request
- Legitimate interests — security, abuse prevention, service improvement
- Legal obligation — tax, accounting, or lawful requests
- Consent — where we specifically ask for it (for example optional marketing, if offered)
Sub-processors
Current infrastructure and vendor processors are listed at Subprocessors.
Retention
- Account and Business data are kept while the account/Business remains active.
- Many product resources use soft-delete and may remain recoverable for a period.
- Billing records may be retained as required for accounting and tax.
- Session and short-lived auth cookies expire according to their purpose.
- There is no self-serve account deletion API and no CSV export feature in the current product. To request deletion, access, or other rights, contact [privacy@…].
International Transfers
We and our subprocessors may process data in more than one country. Where required, we rely on appropriate transfer mechanisms (such as standard contractual clauses) and the contractual protections of our vendors. Hosting region details: [Confirm with product].
Your Rights
Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing.
Because Application does not currently expose self-serve account deletion or CSV export APIs, exercise these rights by emailing [privacy@…]. We may need to verify your identity and, for Business CRM data, redirect you to the Business that controls that data.
Children
Application is built for business users. It is not directed to children under 16 (or the age required in your jurisdiction). Do not create an account for a child.
Security
- Email/password authentication with verification and reset flows
- HttpOnly session cookie backed by server-side session storage
- Business-scoped permissions and Integration API scopes
- Secrets for Business Applications and sensitive credentials handled server-side
- No security measure is perfect; report issues to [support@…] or [privacy@…]
Data Processing Addendum
Where we process Business CRM/ops personal data on your instructions, the Data Processing Addendum applies.
Changes
We may update this Privacy Policy from time to time. The “last updated” date at the top of the page will change when we do. Material changes may also be communicated by email or in-product notice.
Contact & DPO
Privacy requests: [privacy@…]
Support: [support@…]
Legal: [legal@…]
DPO / privacy lead: [Confirm with product]
Operator: [Legal entity name], [Registered address]
Or contact us.