CRM-G CRM-G

Privacy Policy.

What we collect, why, and the rights you have over it.

Effective date: July 2, 2026 · Applies to crmg.ai and the CRM-G service

1. Who we are

CRM-G ("we", "us") operates the crmg.ai website and the CRM-G application — a multi-tenant CRM platform covering Sales, Service, and Time Management with a built-in AI assistant. Questions about this policy or your data: use our contact page, or email security@crmg.ai for privacy and security matters.

2. Two roles: controller and processor

We handle personal data in two distinct capacities:

  • As a controller — for data you give us directly: demo requests, workspace provisioning, account administration, and website operations.
  • As a processor — for the CRM records your organization stores inside its CRM-G workspace (leads, contacts, cases, timesheets, and similar). Your organization is the controller of that data; we process it on their instructions. If you want data about you corrected or deleted from a customer's workspace, contact that organization's administrator.

3. Data we collect as a controller

  • Demo and trial requests — name, work email, company, phone (optional), workspace name, and any message you include.
  • Account data — name, email, authentication data (passwords are stored only as salted hashes), and workspace membership for provisioned users.
  • Operational logs — IP address, timestamps, and request metadata, kept for security, abuse prevention, and troubleshooting, with sensitive payloads redacted and bounded retention.

We do not run third-party advertising trackers on crmg.ai. The site loads fonts and icons from Google Fonts and cdnjs (Cloudflare), which receive your IP address as part of serving those files.

4. How we use it

  • To provision and operate your workspace, and to respond to demo requests and inquiries.
  • To secure the service — authentication, rate limiting, abuse detection, audit logging.
  • To communicate with you about your account, the service, and material changes (transactional email is delivered via Mailgun).
  • To improve the product using aggregate, non-identifying usage information.

Under the GDPR, our legal bases are performance of a contract (operating your workspace), legitimate interest (security, service communications), and consent where required. We do not sell personal data.

5. AI features

The built-in AI assistant processes the CRM data your organization stores in its workspace in order to answer questions and execute the actions you request. Personally identifiable information is redacted before content is sent to the large-language-model provider, model calls are subject to per-tenant guardrails and quotas, and AI-initiated actions are recorded in the audit log. We do not use your workspace data to train foundation models.

6. Sub-processors

We use a small set of infrastructure providers to deliver the service: Google Cloud Platform (hosting), Mailgun (transactional email), Qdrant Cloud (vector search), Anthropic / Google Vertex AI (LLM inference), and Stripe (billing). The current list and what each does is maintained on our security page. We notify workspace administrators in advance of material sub-processor changes.

7. Retention

  • Demo-request data: kept while we evaluate and provision the request; deleted or anonymized if a workspace is not created.
  • Workspace data: kept for the life of the subscription and deleted after termination, subject to a wind-down window for export and to backup cycles (backups expire within the point-in-time-recovery window).
  • Operational logs: bounded retention, then deleted.

8. International transfers

The service is hosted on Google Cloud Platform in the United States (us-central1). Where required, we make Standard Contractual Clauses and a Data Processing Addendum (DPA) available — request one via the contact page.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise them for data we control, contact us via the contact page or security@crmg.ai; we respond within the timelines the applicable law requires. For data inside a customer workspace, contact that organization's administrator — we will support their response.

10. Children

CRM-G is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes

We will post updates to this policy here and update the effective date. For material changes affecting active workspaces, we notify workspace administrators.