Privacy Policy

“CRM03”, “we” and “us” mean the company that runs crm03.com. This policy covers:

• Visitors to our website, including people who send us a request from it.
• Users: the owners and team members of businesses with a CRM03 account.
• Customers of those businesses, whose details reach CRM03 when they contact a business that uses it.

A business decides what it keeps in CRM03 about its own customers, and we handle that information on the business's behalf, under its instructions and our Terms of Use. If you're a customer of a business that uses CRM03, the business's own privacy policy applies too, and it's the best place to start with questions about your information. We'll help it answer them.

• Account details: your name, email address, phone number, job title, and the organizations you belong to and your role in them.
• Leads and customers: what a business adds or receives through CRM03, such as customers' names, email addresses, phone numbers, addresses, the job they need, messages, form answers, and photos and documents they send. This arrives from the business's team, its forms and lead links, connected websites (such as Wix), email and text messages.
• Messages we send for a business: the emails and texts its team or its agent sends to its customers, with when they were sent and whether they were delivered.
• Sign-in and usage information: the codes we email you to sign in, your sessions, the IP address and browser they come from, and logs of what happens in the service, so we can keep it secure and working.
• Website requests: what you send us through the request form on our website, such as your name, contact details, your business and what you need.
• Analytics on our public pages: how visitors use our website, through Google Analytics (see section 7).

• To provide CRM03: store leads, show them to the business's team, and run its agent.
• To send the emails, texts and calendar invitations a business asks for or allows its agent to send.
• To sign you in, keep accounts secure, and prevent spam and abuse.
• To answer your requests and support questions.
• To understand how the service and our website are used, and to improve them.
• To meet our legal obligations and enforce our terms.

We don't sell personal information, and we don't use a business's data to advertise to anyone.

Each business's agent reads a lead's details, conversation and files, and the business's own rules (its playbook), and then suggests or takes the next step, such as replying to the customer or filling in the job's details. The business decides what the agent may do on its own and what needs a person's approval first.

To do this, we send the information the agent needs to our AI provider, OpenAI, through its API. Under its API terms, OpenAI doesn't use that information to train its models. We don't use a business's data to train AI models either.

We share information only with the service providers that run parts of CRM03 for us, and only what each one needs for its job:

• DigitalOcean hosts the app and stores files.
• Our database provider stores accounts, leads and messages.
• OpenAI runs the AI behind each business's agent.
• EmailIt delivers our emails, such as sign-in codes and emails a business sends to its customers.
• Telnyx sends and receives text messages for businesses that use them.
• Google provides Google Analytics on our public pages and, when a business connects its Google account, sends its email and manages its visits (see section 6).
• Wix passes on form submissions from a business's Wix website when the business connects it.

We may also share information when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business, in which case this policy keeps applying to it.

A business can connect a Google account so its emails go out from its own Gmail address and its visits are booked on its calendar. When it does, CRM03 asks Google for:

• The account's email address, to show which account is connected.
• Permission to send email (gmail.send). CRM03 can't read, search or delete anything in the mailbox.
• Permission to manage calendars CRM03 creates (calendar.app.created). CRM03 can't see any other calendar in the account.

We use this access only to send the messages and book the visits the business asks for or allows its agent to handle. We keep only what those features need: the account's address, its access tokens, and the messages and events CRM03 itself created. We don't use Google user data for advertising, we don't sell it, we don't transfer it to others except to provide these features or as the law requires, and no person reads it unless the business asks us to for support, for security, or as the law requires. We don't use it to train AI models.

CRM03's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect its Google account at any time under Settings → Connectors, or from its Google account's security settings, and CRM03's access ends right away.

• Cookies CRM03 needs: signing you in, remembering which organization you're working in, and whether you're looking at sandbox data. The service doesn't work without them.
• Preferences in your browser: such as the width of panels you resized.
• Google Analytics on our public pages: the landing page, sign-in and these legal pages. It sets cookies to count visits and see how people find and use the website. It doesn't run inside the app after you sign in. You can turn it off with Google's opt-out browser add-on or your browser's cookie settings.

We keep information for as long as the business's account is open and it needs it. A business can delete a lead, a file, a team member or its whole organization at any time, and the deletion is permanent: we remove it from CRM03 right away, and any copies in our providers' backups expire on their schedules. We keep sign-in and security logs only as long as we need them to protect the service, and some records for longer where the law requires it.

Information travels to and from CRM03 encrypted (HTTPS). You sign in with a one-time code sent to your email, so there's no password to steal. Files are private: we show them only to the business's signed-in team. Connected accounts' tokens are stored encrypted. No system is perfectly secure, so please tell us right away at [email protected] if you think something is wrong.

You can see and change your account details on your profile page at any time. You can also ask us to give you a copy of your information, correct it, or delete it, by writing to [email protected]. Depending on where you live, you may have further rights, such as to object to or limit how we use your information, and to complain to a data protection authority. We won't treat you differently for using them.

If a business that uses CRM03 has your information as its customer, please ask the business first: it controls that information. We'll help it respond.

CRM03 is a tool for businesses and isn't meant for children under 16. We don't knowingly collect their information; if you think we have, write to us and we'll delete it.

We store information in the United States. If you use CRM03 from somewhere else, your information is transferred to and handled in the United States, with the protections this policy describes.

When we change this policy, we'll update the date at the top, and for changes that matter to you we'll tell account owners by email or in CRM03 before they take effect.

Questions about this policy or your information? Write to us at [email protected].