CRMCA
1. Who we are
CRMCA operates the websites https://crmca.cc and https://app.crmca.cc (the “Service”). Contact for privacy matters: hello@crmca.cc.
app.crmca.cc is the multi-tenant CRM product for companies and organizations (“tenants”) and their authorized users. adm.crmca.cc is an internal operations surface for CRMCA platform staff only and is not a customer product.
2. Roles under data-protection law
For personal data that a tenant stores in its workspace (clients, contacts, leads, projects, messages, and similar CRM content), the tenant is typically the controller and CRMCA acts as a processor under the tenant’s instructions, as described in our Data Processing Agreement (DPA).
CRMCA acts as an independent controller for: platform account registration and authentication; security, abuse-prevention, and system logs; billing and subscription administration; and communications about the Service with tenant administrators.
A digital agency is one example of a tenant type; the Service is designed for companies and organizations generally.
When a tenant uses integrations to publish or submit content (including personal data) to third-party websites, CMS, social networks, ads platforms, or similar services, the tenant remains the controller for that outbound use and is responsible for having a lawful basis, notices, and consents as required. See also Terms of Service §7 (content published to third-party platforms).
3. Categories of personal data
Account and identity data: name, email address, authentication identifiers (including Google OAuth identifiers when you choose that sign-in method), role within the tenant, language and timezone preferences.
Workforce / employee fields configured by the tenant (for example job title, phone, Telegram identifiers used for notifications).
CRM content entered by the tenant: clients, contacts, leads, projects, tasks, comments, dialogs, files metadata, finance records linked to projects, and marketing/SEO project data.
Technical and usage data: IP address, device/browser type, timestamps, request logs, cookie identifiers needed for session security, and approximate location derived from IP for security.
Integration data when a tenant connects third-party services (Google Workspace / Drive / Search Console / Ads, Telegram, telephony providers such as Zadarma, email SMTP, LLM providers for AI features). We process only what is needed to operate the integration the tenant enables.
4. Purposes and legal bases
Provide, maintain, and secure the SaaS (contract / legitimate interests).
Authenticate users and prevent unauthorized access (contract / legitimate interests / legal obligation where applicable).
Customer support and service communications (contract / legitimate interests).
Billing and accounting (contract / legal obligation).
Improve reliability and product quality using aggregated or de-identified signals where feasible (legitimate interests).
Non-essential cookies or similar technologies, if ever enabled for analytics: only with consent where required (see Cookie Policy).
Tenants determine the legal bases for CRM content they collect from their own customers and end users (for example consent, contract, or legitimate interest for lead forms on tenant websites).
5. Sharing and subprocessors
We use vetted subprocessors for hosting, CDN/DNS, email delivery, identity/productivity APIs, messaging, telephony, and AI inference when tenants enable those features. The current public list is at our Subprocessors page. Material changes will be reflected there and versioned.
We do not sell personal information. We may disclose data if required by law, to protect rights and security, or in connection with a corporate reorganization, subject to appropriate safeguards.
6. International transfers
Primary application hosting is operated with an EU-oriented architecture. Some subprocessors (for example Google or LLM providers) may process data outside the EEA/UK. Where required, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses, adequacy decisions, or vendor certifications (for example EU–US Data Privacy Framework participation where applicable).
7. Retention
Account and tenant workspace data are retained while the subscription/workspace is active and for a reasonable period afterward to allow export, resolve disputes, and meet legal retention duties (for example tax and accounting).
Security logs are retained for a limited operational window unless a longer period is needed for investigations.
Tenants may delete CRM records according to product features; hard deletion and automated purge schedules continue to be refined as part of the compliance roadmap.
8. Security
We apply industry-standard measures including TLS in transit, access controls, least-privilege operations, backups, and environment separation between production and non-production where applicable. No method of transmission or storage is 100% secure; please use strong account hygiene and report suspected incidents to hello@crmca.cc.
9. Your rights
Depending on your location, you may have rights to access, rectify, erase, restrict, object, port data, and withdraw consent. For CRM content controlled by a tenant, please contact that organization first. For CRMCA-controlled account or platform data, contact hello@crmca.cc. You may also lodge a complaint with a supervisory authority.
California and similar US state laws: we do not sell personal information in the ordinary B2B SaaS sense. Eligible residents may request to know, delete, or correct certain personal information we control, and to opt out of sale/share where those concepts apply. Contact hello@crmca.cc.
10. Children
The Service is a B2B SaaS product and is not directed to children. Do not submit personal data of children under the applicable age of digital consent.
11. Changes
We may update this Policy. The version identifier (2026.10.25-v6) and “Last updated” date will change. Material changes affecting tenants will be communicated through the product or email to administrators where appropriate.
12. Contact
Privacy contact: hello@crmca.cc. Postal and company registration details may be provided on request for contracting.