Privacy Policy

Who we are

CRMSix (“CRMSix”, “we”, “us”) provides a customer relationship management service for support and sales teams: the website at crmsix.com, the application at login.crmsix.com and each organization’s own address (such as yourcompany.my.crmsix.com), the CRMSix mobile app, and the CRMSix API (together, the “Service”).

Your data and your customers’ data

Organizations that subscribe to CRMSix (our “customers”) put their own business data into the Service: their customers’ cases, contacts, leads, accounts, opportunities, emails, chats and files (“Customer Data”). For Customer Data, the customer decides what is collected and why, and is the controller (or “data fiduciary”); CRMSix processes it only on the customer’s behalf and on its instructions, to provide the Service. If you are a contact of one of our customers and have a question about your data, please contact that organization first; we will help them respond.

For the people who use the Service (“users”), for visitors to crmsix.com, and for people who contact us, CRMSix decides how their data is used, and this policy describes it.

What we collect

Account details: your name, email address, username, organization, profile and role, language, locale and time zone. Passwords are stored only as salted hashes.
Customer Data: whatever your organization enters into the Service or receives through it (for example inbound emails, web forms and live chats).
Sign-in and device information: sign-in history, IP address, browser and device type, and, for the mobile app, the devices signed in.
Usage and logs: actions such as setup changes (the admin activity log), API usage, and technical logs needed to run, secure and fix the Service.
Billing details: your plan, number of licences, invoices and payment status. We do not store payment card numbers.
Communications: messages you send us, such as demo requests from our contact page and support tickets.
Website analytics: on crmsix.com, Google Analytics records pages visited and general information about your browser and approximate location.
Connected accounts: if you choose to connect a Google account, the information described under Google user data.

How we use it

To provide the Service: sign you in, store and show your organization’s data, send the emails and notifications you or your organization set up, and run the features you use.
To keep it secure: detect and stop abuse, enforce sign-in and password rules, and investigate incidents.
To support you: answer questions and tickets. CRMSix support signs in to your account only when you or your administrator grant access, and every such session is recorded in your sign-in history.
To bill for subscriptions and keep financial records.
To improve the Service, using aggregated usage information and website analytics.
To meet legal obligations.

Where the GDPR applies, we rely on the performance of our contract with you or your organization, our legitimate interests in running and securing the Service, your consent (which you can withdraw at any time), and legal obligations. We do not sell personal data, and we do not use Customer Data for advertising.

Google user data

You can connect your own Google account in My Settings → Connected accounts, so that your CRMSix meetings appear on your Google Calendar and can have a Google Meet link, and, if you choose, so that your meetings with customers are logged in CRMSix.

What we access: your Google account’s email address, and permission to see, create, change and delete events on your Google Calendar (the calendar.events scope).
How we use it:
- to put the CRMSix meetings you own on your Google Calendar (while “Add my CRMSix meetings to Google Calendar” is on), with a Google Meet link when you choose one, and to update or cancel those events when you change or delete the meeting in CRMSix;
- to bring back changes you make to those same events in Google Calendar: a new time, title or place updates the meeting in CRMSix, and deleting the event marks the meeting cancelled. For this, Google notifies CRMSix when your calendar changes, and CRMSix then reads only the events it created;
- only if you turn on “Log meetings with my customers from Google Calendar” (it is off by default): to look at the events on your calendar from 30 days ago to 90 days ahead, and log as a CRMSix meeting each one whose guests include one of your organization’s CRMSix contacts or leads, keeping it up to date with later changes. Events without such a guest are skipped and nothing from them is stored;
- to show you which Google account is connected.
CRMSix never changes or deletes events it did not create, and it does not read your other events except as just described.
What we store: the connected email address, a refresh token (which lets CRMSix keep its events up to date) encrypted at rest, the identifier and Meet link of each event CRMSix created, the details needed to receive Google’s change notifications, and, for customer meetings you chose to log, the event’s title, time, place, video link, description and guests, kept as a meeting in your organization’s CRMSix account like any other.
Sharing: we do not sell Google user data or share it with third parties, except as needed to provide this feature, to comply with the law, or with your consent. It is not used for advertising, and it is not used to develop, improve or train artificial intelligence or machine learning models.
Human access: no one at CRMSix reads Google user data, unless you ask us to (for example in a support request), it is needed for security purposes such as investigating abuse, or the law requires it.
Removing it: turn either option off, or disconnect Google, in My Settings at any time; logged meetings stay in CRMSix until your organization deletes them. Disconnecting stops Google’s notifications, deletes the stored token and revokes CRMSix’s access at Google. You can also remove access from your Google account’s security settings.

CRMSix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The AI assistant

If your organization’s administrator turns on the AI assistant, questions you ask it and the records it looks up to answer them are sent to Anthropic, which provides the Claude AI model, to produce the answer. The assistant works with your own permissions and sees only what you can see. Under Anthropic’s commercial terms this data is not used to train its models. Your conversations are kept in your organization’s account so you can return to them, and you can delete them at any time. The administrator can turn the assistant off.

How long we keep it

We keep account and Customer Data for as long as your organization’s subscription is active. Administrators can delete records at any time, and deleted records stay in the recycle bin for a limited time before they are removed. When a subscription ends, we delete the organization’s data after a reasonable period during which it can still be exported, unless the law requires us to keep some of it, such as invoices. Technical logs are kept only as long as needed to run and secure the Service.

Security

Data is encrypted in transit, each organization’s data is kept separate at the database level, and secrets such as connection tokens are encrypted at rest. Organizations control password rules, sign-in lockout, single sign-on and access by profile. Read more on our Security page, and report a security issue to security@crmsix.com.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how we use it, and to withdraw consent. Under India’s Digital Personal Data Protection Act, 2023, you may also nominate someone to exercise these rights for you and raise a grievance with us. To make a request, write to security@crmsix.com. If your data is Customer Data, we will pass your request to the organization responsible for it. If you are not satisfied with our answer, you can complain to your data protection authority.

Cookies and local storage

The application keeps your sign-in and preferences (such as which app you last used) in your browser’s local storage; it is needed for the Service to work. The website crmsix.com uses Google Analytics cookies to understand how it is used; you can block them in your browser without affecting the Service.

Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this policy. We will change the effective date above, and tell customers’ administrators about significant changes before they take effect.

Contact

Questions, requests and grievances about privacy: security@crmsix.com.