Privacy Policy

A CRM holds two very different sets of personal data, and confusing them is the most common mistake in policies like this one. So, plainly:

• Data about you, our customer — your name, your email, your billing details, how you use the product. We are the controller of that, and this policy is about it.
• Data about your contacts — the people inside your CRM. You are the controller and we are only the processor. We hold that data on your instructions and we do not decide what happens to it. That relationship is governed by our Data Processing Agreement.

If you are here because a company you deal with keeps your details in CRM City and you want them changed or deleted, we are not the right people to ask — that company is. Write to them. If you cannot reach them, write to us at privacy@crmcity.app and we will do what we can to put you in touch.

The controller is Community Den Ltd, a company registered in England and Wales under number 15654370, whose registered office is at 110 Market Street, Milnsbridge, Huddersfield, England, HD3 4HT. We trade as CRM City at crmcity.app. For anything in this policy, write to privacy@crmcity.app.

Account data — your first and last name, your email address, the name of the organisation you create, and a securely hashed password. We need it to create and run your account. Lawful basis: performance of our contract with you.

Billing data — your plan, subscription status and billing history. Payments are taken by Stripe on their own checkout; card numbers never reach our servers and we cannot see them. Lawful basis: performance of our contract, and our legal obligation to keep accounting records.

Usage and technical data — IP address, browser and device information, pages requested, timestamps, and error diagnostics. We use it to keep the service running, to investigate faults and abuse, and to understand in aggregate which features are used. Lawful basis: our legitimate interest in operating and securing the service.

Audit records — significant actions taken inside your organisation are logged with the acting user and a timestamp. This exists so that you can answer “who changed this?”, and so that we can investigate security incidents. Lawful basis: legitimate interest in security and accountability.

Support correspondence — what you write to us and what we reply. Lawful basis: legitimate interest in answering you, and keeping a record of what was agreed.

We do not carry out profiling or automated decision-making that produces legal effects for you. We do not use special category data about you, and we ask you not to send us any.

We use only what is strictly necessary to sign you in and remember your display preference, plus privacy-preserving analytics that do not use cookies. That is why you are not being asked to dismiss a consent banner. The detail is in the Cookie Notice.

We do not sell personal data, we do not share it for advertising, and we do not use it to train AI models. We use a small number of service providers, each of which processes data only on our instructions and under a contract that requires it. The complete list:

We will also disclose data where the law requires it, and to advisers or an acquirer in connection with a sale of the business — in which case this policy continues to apply until you are told otherwise.

The database holding your CRM data is hosted in the European Union (Frankfurt). Transfers from the UK to the EEA are permitted under UK adequacy regulations, so no additional safeguard is needed for that leg.

Some of the providers listed above are based in the United States. Where personal data reaches them, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. We keep the relevant paperwork and will show it to you on request.

• Account and CRM data — while your account is open. After you close it we keep it for 30 days so it can be restored or exported, then delete it from live systems; it ages out of encrypted backups within a further 30 days.
• Billing records — six years after the transaction, because UK tax law requires it.
• Technical logs — up to 90 days, unless they form part of a security investigation.
• Suppression records — an email address that has unsubscribed or hard-bounced is kept on a suppression list indefinitely. This is deliberate and it is in the person’s interest: deleting the record is what would let them be emailed again by mistake.
• Support correspondence — two years.

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete it, where we have no overriding reason to keep it;
• restrict or object to how we use it, including any use based on legitimate interests;
• give you a portable copy in a machine-readable format;
• withdraw consent, where we relied on consent — this does not affect what we did before you withdrew it.

Much of this you can do yourself and immediately: your account settings let you edit your details, and a full export of everything in an organisation is available at any time on every plan. For anything else, write to privacy@crmcity.app. We answer within one month, and we do not charge for it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113). We would rather you told us first, so we get the chance to put it right.

Every organisation’s data is separated at the database layer by row-level security, so the database itself refuses to return another organisation’s rows — the isolation does not depend on application code being bug-free. Data is encrypted in transit and at rest. Two-factor authentication is available on every account. API keys are stored only as hashes and shown once. Access to production systems is limited to those who need it.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will tell the ICO within 72 hours and tell you without undue delay.

The service is for business use and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

When this policy changes we update the date at the top, and for anything material we email account holders. The current version is always at crmcity.app/legal/privacy.

To exercise a right, or to ask anything about this policy, write to privacy@crmcity.app. For anything else about your account or the service, write to support@crmcity.app.