Privacy Policy

Conscious CRM ("we", "us") operates the Conscious CRM website and application (together, the "Service"). You can reach us at privacy@consciouscrm.com.

We handle information in two roles:

• For our customers. Businesses that use the Service decide what they store about their own contacts and customers, and why. For that information we act on their behalf and follow their instructions, as a "processor" or "service provider". Each business is responsible for its own use of it.
• For ourselves. For the accounts of the people who use the Service and for visits to our website, we decide how information is used, as a "controller".

Account information

When an administrator adds you to an account, or you set one up, we store your name, email address, role and the businesses (sub-accounts) you belong to. We store your password only as a salted one-way hash, never the password itself. Administrators may also enter business details such as a business name, address, phone number and time zone.

Information our customers store

Businesses use the Service to keep information about the people and companies they work with: names, email addresses, phone numbers, postal addresses, notes, tasks, tags, custom fields, the deals in their pipelines, and anything else they choose to record. They may type it in, import it from a file, or send it through our API.

Information from connected platforms

When a business connects a Facebook Page, an Instagram professional account or a WhatsApp Business account, we receive information from Meta through the permissions the business grants. What that includes, and how we use it, is set out under Facebook, Instagram and WhatsApp data below.

Technical and security information

When you sign in or make a change, we record the date and time, your IP address and your browser's user agent, together with what changed, in an audit log. Our hosting provider also keeps standard server logs. A cookie keeps you signed in.

We use information to:

• provide, operate and maintain the Service, including carrying out our customers' instructions, such as saving a contact, publishing a scheduled post or sending a reply;
• sign people in, keep accounts secure, and detect, prevent and investigate abuse and security incidents;
• keep an audit trail of changes that our customers can review;
• send account holders the messages the Service needs, such as sign-in links and security or service notices;
• meet our legal obligations and enforce our terms.

We do not sell personal information. We do not use it for advertising, and we do not use our customers' data, or data from connected platforms, to build profiles for any purpose of our own.

When a business connects its accounts on Meta's platforms, we receive, through the permissions it grants:

• the names and identifiers of the connected Facebook Pages, Instagram professional accounts and WhatsApp Business accounts and phone numbers, and the name and app-scoped identifier of the person who connected them;
• access tokens that let us act for the business on those accounts;
• the posts, photos and videos the business publishes through the Service, and the comments and mentions on its Page and Instagram posts;
• insights for the Page, the Instagram account and their posts, such as reach and engagement;
• WhatsApp messages sent and received on the connected number, message templates and their status, and, if the business chooses to share them when connecting, its WhatsApp contacts and message history.

We use this information only to provide the features the business uses: showing its Pages, accounts and posts, publishing what it schedules, showing and answering comments and messages, showing insights, and keeping its WhatsApp conversations and contacts in the Service.

We do not sell or license this information, use it for advertising, use it to build profiles of people, or give it to data brokers. We share it only as this policy describes or when the law requires it. We store access tokens encrypted and never write them to logs. Our use of information from Meta's platforms follows Meta's Platform Terms and Developer Policies.

A business can disconnect an account at any time, and a person can remove Conscious CRM from their Facebook settings. When a connection ends, we stop using its access token and delete it, and we delete the platform data tied to that connection within 30 days. Deletion requests made through Facebook are covered under How to request deletion.

We share information only:

• with the service providers that host and run the Service for us, which may use it only to provide their services to us (listed below);
• with the platforms a business connects, when the business directs us to, for example to publish a post or send a WhatsApp reply. Their own terms and privacy policies govern what they do with it;
• within a customer's account, with the users its administrators give access to;
• when we believe the law requires it, or to protect the rights, property or safety of our customers, their contacts, the public or us;
• as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.

We do not sell personal information or share it for cross-context behavioral advertising.

• Render (render.com) hosts the application and its database in the United States.
• Email and text message delivery. When the Service starts sending email and text messages, the providers that deliver them will process the messages and their recipients' addresses and numbers. We will name each provider here before it starts.

We use only the cookies the Service needs: one that keeps you signed in, and short-lived ones that protect the sign-in form and remember where to return afterwards. Your browser's local storage keeps display preferences, such as a light or dark theme and the columns you choose to show. We do not use advertising cookies or third-party analytics.

• Account information: for as long as the account is open. When an account closes, we delete its information within 90 days, except what the law requires us to keep or what we need to resolve disputes or enforce our agreements.
• Information our customers store: for as long as the customer keeps it in the Service, and up to 90 days after its account closes. A contact a customer deletes stays restorable for 60 days.
• Connected platform data: while the connection is active, and deleted within 30 days after it ends or after a valid deletion request.
• Audit and security records: for as long as the account exists, so customers can see who changed what.
• Backups: our hosting provider keeps database backups for disaster recovery, currently for up to 7 days. Deleted information can remain in them until they expire.

Our safeguards include:

• encrypted connections (HTTPS) between your browser and the Service;
• passwords kept only as salted one-way hashes, and session and API tokens stored only as hashes;
• each business's data kept separate, with access checked on every request;
• an audit log of changes;
• access to production systems limited to the people who operate the Service.

No system is perfectly secure. If we learn of a security incident that affects your information, we will tell the affected customers and, where the law requires, the authorities and the people affected.

Depending on where you live, you may have the right to ask us for access to your personal information, to correct it, to delete it, or to receive a copy of it; to object to or restrict some uses of it; and to withdraw consent where we rely on consent. To use these rights, write to us at privacy@consciouscrm.com. We answer within 30 days, and we may need to confirm your identity first. We will not treat you differently for using them.

If your information is in a business's account, for example as one of its contacts, that business decides what it keeps: please contact it directly. If you write to us instead, we will pass your request on and help the business answer it.

You may also complain to the data protection authority where you live.

• People who connected Facebook or Instagram: remove Conscious CRM in your Facebook settings and ask for your data to be deleted there. Facebook sends us the request, and you get a confirmation code and a link to follow it.
• Account holders: ask an administrator of your account, or write to us at privacy@consciouscrm.com from the email address on the account.
• Contacts of a business that uses Conscious CRM: ask that business, or write to us and we will pass your request on.

The steps, and a way to check a request you made, are on our Data deletion page.

Conscious CRM is a tool for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, contact us and we will delete it.

We host the Service in the United States. If you use it from another country, your information is transferred to and processed in the United States, where data protection law may differ from yours. Where the law requires it, we put appropriate safeguards in place for these transfers.

We may update this policy. When we do, we change the date at the top of this page, and if a change is significant we tell account holders by email or in the Service before it takes effect.

Questions about this policy or requests about your information: privacy@consciouscrm.com.

Conscious CRM