1. Introduction
UpCRM ("we," "our," or "us") is a customer relationship management platform that helps businesses manage clients, companies, invoices, and communications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.
2. Information We Collect
We collect information necessary to provide and improve our services:
- Account information: Email address, name, and role when you sign in
- Business data: Client details, company information, invoices, notes, and alerts you create
- Email integration: When you connect Gmail, we store access tokens to send and read emails on your behalf; we do not store email content beyond what is necessary for the service
- Financial documents: Bank statements and receipts you upload for expense tracking and transaction matching
- Location data (mobile app): With your explicit consent, precise location — including background location — to enable automatic clock-in and clock-out when you arrive at or leave a work site. You can withdraw consent at any time in your device settings, and the feature stops working
- Audio and voice input (mobile app): When you use voice features, your speech is converted to text on your device or processed by our AI provider (Anthropic) to fulfil your request; we do not retain audio recordings
- Crash and diagnostic data: Crash reports and diagnostic information (such as device model, OS version, and error logs) collected via Sentry to identify and fix technical issues; this data is never used for advertising
- Usage data: Logs and analytics to improve our platform and troubleshoot issues
3. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the UpCRM platform
- Authenticate users and manage access
- Process invoices and send emails on your behalf
- Deliver notifications via the dashboard
- Power AI features for chat assistance and invoice extraction
- Record shift clock-in and clock-out times, including automatic clock-in based on your work-site location where you have enabled it
- Support multi-organization and multi-tenant data isolation
- Comply with legal obligations and respond to lawful requests
4. Data Storage and Security
Your data is stored securely using industry-standard hosting (e.g., Supabase, Vercel). We use encryption in transit (HTTPS) and at rest. Access to data is restricted by role and organization. We do not sell your personal information to third parties.
5. Third-Party Services
We integrate with third-party services to provide functionality:
- Supabase: Database and authentication
- Google (Gmail): Email sending and reading
- Anthropic (Claude): AI chat, invoice OCR, and voice input processing
- Sentry: Crash reporting and application diagnostics
Each service has its own privacy policy. We recommend reviewing them when you use these integrations.
Google user data
If you choose to connect your Gmail account, UpCRM accesses your Gmail data only to provide the features you request:
- Reading email (gmail.readonly): We display email conversations between you and your CRM clients inside the relevant client record, so you can see your correspondence history in context
- Sending email (gmail.send): We send emails you compose in UpCRM — such as invoices, quotes, and replies — from your own Gmail address, only at your explicit request
We do not use Gmail data for advertising, do not sell it, do not use it to train generalized AI or machine-learning models, and human access is limited to the cases permitted by Google's policy (e.g. with your explicit consent, or for security and abuse investigation). You can disconnect Gmail at any time in UpCRM settings or revoke access at myaccount.google.com/permissions, after which we delete stored Gmail tokens.
UpCRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Retention and Deletion
We retain your data for as long as your account is active or as needed to provide services. You can delete your account and associated data directly in the mobile app (Settings → Delete Account) or by contacting us. Some data may be retained where required by law.
7. Your Rights
Depending on your location, you may have the right to:
- Access and receive a copy of your data
- Correct inaccurate data
- Request deletion of your data
- Object to or restrict certain processing
- Data portability
To exercise these rights, contact us using the details below.
8. Cookies
We use essential cookies for authentication and session management. These are required for the platform to function. We do not use third-party advertising cookies.
9. Changes
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of UpCRM after changes constitutes acceptance.
10. Contact Us
For questions about this Privacy Policy or your data, please contact us at the address or email provided by your organization administrator.