Privacy policy
Before the final wording
This policy is being read by a lawyer. Until the final wording, it is how your data is handled; when it changes, you are told.
Two kinds of data
Some data is about the company's own people: names, emails and when they signed in — we are responsible for it. The rest is what a company puts in: its clients, their documents, its cars and bookings. That data is the company's; we keep and process it only so that the CRM works for the company, on its instructions.
Where it is kept
The database and the files are kept by our hosting provider, Railway, in Singapore. They travel only over encrypted connections and are encrypted where they are stored.
Who else processes it
Railway hosts the CRM. A mail service sends the CRM's letters: confirming an email, a new password. If a company switches the copilot's AI on, Google's Gemini receives the question and only what is needed to answer it, under Google's paid terms, which do not let Google learn from it. Services a company connects itself — a Telegram bot, a WhatsApp service — receive what the company sends through them.
Who sees a company's data
Only the people the company gives an account to, as far as their position allows. Every company's records are kept apart in the database itself. The people who run the CRM see which companies use it and how much, never what is inside them; when support needs to look inside, the company's admin gives them an account and takes it back afterwards, and what they did shows in the company's history.
How long
As long as the company uses the CRM. When its owner asks, the company and everything in it are deleted 14 days later; backup copies run out within 30 days of that.
A client of a company
A person whose details a company keeps asks that company to see, correct or delete them. The company can do all three in the CRM.
Security
Passwords are kept only as hashes, connected services' keys are sealed, and two-step sign-in with a phone app is offered to everybody. A breach that touches a company's data is told to that company without delay.
Contact
Write to us about personal data, or to ask what is kept about you, through your company's owner: they reach us from the account the company registered with.