Privacy Policy.
What we collect, why, and the rights you have over it.
1. Who we are
CRMG Labs LLC ("CRMG Labs", "we", "us") is an Illinois limited liability company that operates the crmg.ai website and provides CRM-G — a multi-tenant CRM platform covering Sales, Service, and Workforce Management with optional AI assistance. Our business address is 1901 North Roselle Road, Suite 800 PMB 8390, Schaumburg, Illinois 60195, United States. Questions about this policy or your data: use our contact page, or email security@crmg.ai for privacy and security matters.
2. Two roles: controller and processor
We handle personal data in two distinct capacities:
- As a controller — for data you give us directly: demo requests, workspace provisioning, account administration, website operations, and public website chat when enabled.
- As a processor — for the CRM records your organization stores inside its CRM-G workspace (leads, contacts, cases, timesheets, and similar). Your organization is the controller of that data; we process it on their instructions. If you want data about you corrected or deleted from a customer's workspace, contact that organization's administrator.
3. Data we collect as a controller
- Demo and trial requests — name, work email, company, phone (optional), workspace name, and any message you include.
- Account data — name, email, authentication data (passwords are stored only as salted hashes), and workspace membership for provisioned users.
- Public website chat, when enabled — messages you submit, session identifiers, and technical information needed to answer product questions and operate the channel. Avoid submitting customer records, credentials, or sensitive personal data.
- Operational logs — IP address, timestamps, and request metadata, kept for security, abuse prevention, and troubleshooting.
We do not run third-party advertising trackers on crmg.ai. The site loads fonts and icons from Google Fonts and cdnjs (Cloudflare), which receive your IP address as part of serving those files.
4. How we use it
- To provision and operate your workspace, and to respond to demo requests and inquiries.
- To secure the service — authentication, rate limiting, abuse detection, audit logging.
- To communicate with you about your account, the service, and material changes (transactional email is delivered via Mailgun).
- To improve the product using aggregate, non-identifying usage information.
Under the GDPR, our legal bases are performance of a contract (operating your workspace), legitimate interest (security, service communications), and consent where required. We do not sell personal data.
5. AI features
When AI is enabled, messages and relevant workspace or knowledge-source content may be sent to the configured model and retrieval providers to generate responses. Signed-in CRM actions are subject to user permissions and confirmation for writes. Supported sensitive-data detection and redaction depend on configured policies and do not guarantee removal of all personal data. Public website chat, when enabled, processes visitor messages and published knowledge separately from authenticated workspace actions. Provider processing and data-use terms depend on the configured services; contact us to review the arrangements for your intended use.
6. Sub-processors
Google Cloud provides primary application hosting and database storage. Transactional email and configured AI/model and knowledge-retrieval services also process information needed to deliver their features. The applicable providers depend on the workspace or channel configuration. Contact security@crmg.ai for the processing details and provider information relevant to your use.
7. Retention
- Demo requests and public-chat data: used to evaluate requests, respond to inquiries, and operate and secure the service. Contact us to request deletion or ask about applicable retention.
- Workspace data: retained to operate the workspace. Export and deletion arrangements at termination should be confirmed with our team and in any applicable agreement. Deleted data may remain in backups or recovery archives until those copies are removed under their separate retention arrangements; the database recovery window is not a deletion deadline for all copies.
- Operational logs: retained for service operation, troubleshooting, and security. Applicable retention depends on the system and any legal or contractual requirements; contact us for details.
8. International transfers
Primary application hosting is in the United States (Google Cloud us-central1). Configured service providers may process information in other locations. Contact us to review processing locations and any required transfer or data-processing arrangements before submitting data subject to specific requirements.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise them for data we control, contact us via the contact page or security@crmg.ai; we respond within the timelines the applicable law requires. For data inside a customer workspace, contact that organization's administrator — we will support their response.
10. Children
CRM-G is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children.
11. Changes
We will post updates to this policy here and update the effective date. For material changes affecting active workspaces, we notify workspace administrators.