Privacy Policy

Account Information. When you create an account we collect your name, email address, and a hashed password. If you sign in with Google, we receive your name, email, and profile picture from Google — we never receive your Google password.

CRM Data. You may store contacts, accounts, deals, activities, tags, and related business records. This data is entered by you or by team members within your organization.

Google Integrations (OAuth). Signing in with Google uses only your email address and profile. Each integration below is optional and is only enabled when you connect it yourself.

Gmail (send only). If you connect your Gmail account for meeting outreach, we request the gmail.send scope, which allows us to send emails on your behalf only. We cannot read your inbox, drafts, or contacts.

Google Calendar (read only). If you connect Google Sync, we request read-only access to events on your primary calendar to log meetings as activities and match attendees to contacts. Meeting titles, times and participants are shared with your organization; event descriptions are stored separately and visible only to you.

Google Tasks and Google Drive. Google Tasks sync requests access to your tasks. Google Drive backups use the drive.file scope, which reaches only files the app creates.

All Google OAuth tokens are encrypted at rest. Google user data is used only to provide the feature you connected, is never sold, and is never used for advertising. Disconnecting an integration deletes its tokens.

Limited Use. The use of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalized AI or ML models, is not sold, and is not used for advertising.

AI processing of Google data. Anthropic is our only AI provider. Gmail and Tasks data is never sent to it. Calendar meeting titles and times may be included when you run a routine that includes activities, using your own Anthropic API key and only to produce that routine's output. Calendar event descriptions are never included. Under Anthropic's commercial API terms, this data is not used to train its models.

Enrichment Data. When you use our enrichment features, we may send contact names, email addresses, or company domains to third-party data providers (such as Apollo, Hunter, or similar services) to retrieve publicly available professional information. If you supply your own API keys for these providers (BYO Keys), those keys are encrypted at rest.

Payment Information. Billing is handled by Stripe. We do not store credit card numbers. Stripe's privacy policy applies to payment processing: stripe.com/privacy.

Usage & Log Data. We collect standard server logs including IP addresses, browser type, and pages visited to maintain service reliability and security.

• To provide, maintain, and improve the CrmZero platform
• To send emails on your behalf when you use the meeting request feature (only with your explicit authorization via OAuth)
• To enrich contact records with publicly available professional data
• To process payments and manage your subscription
• To communicate with you about your account, including service updates and security alerts
• To detect and prevent fraud or abuse

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Your data is hosted on servers located in the United States. We use industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• AES-256-CBC encryption for OAuth tokens and third-party API keys at rest
• Hashed passwords (bcrypt) — we never store plaintext passwords
• Role-based access control within the application
• Isolated organizational data — users can only access data within their own organization

We use essential cookies to maintain your login session and remember your organization context. We do not use third-party advertising or tracking cookies.

We integrate with the following third-party services, each governed by their own privacy policies:

• Google OAuth — for sign-in and optional Gmail email sending
• Stripe — for payment processing
• Data Enrichment Providers — for retrieving publicly available professional information about contacts

We retain your account and CRM data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records).

You may disconnect your Gmail account at any time from the Email Connection settings page. When disconnected, your OAuth tokens are immediately deleted from our systems.

You may:

• Access your personal data through the platform
• Update or correct your information in your account settings
• Disconnect your Gmail or other connected services at any time
• Delete your account by contacting us at the address below
• Export your data by contacting us

CrmZero is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the platform. The "Last updated" date at the top reflects the most recent revision.

If you have questions about this Privacy Policy or your data, contact us at:

privacy@crmzero.ai