Privacy Policy

CRM Connector ("we," "our," or "us") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website or use either of our two products: - CRM Connector for GoHighLevel: the GoHighLevel marketplace app that syncs a HighLevel location with external systems, with its application at https://app.crm-connector.com. - CRM Connector Platform: the platform that keeps CRM, field service, accounting and payment systems in sync with each other, with its application at https://platform.crm-connector.com and its api at https://platform-api.crm-connector.com. Company Details: - Trade Name: CRM Connector - VAT Number: NL867523372B01 - Chamber of Commerce (KvK): 96231866 - Registered Address: Opalstraat 17, 4421LK Kapelle, The Netherlands - Contact: support@crm-connector.com This Privacy Policy applies to all users of both products, including agency owners, sub-account users, platform account owners and their team members, and visitors to our website at https://crm-connector.com. Where a section applies to only one product, it says so.

For the purposes of this Privacy Policy: - "Products" refers to CRM Connector for GoHighLevel and CRM Connector Platform together, and "Platform" refers to the CRM Connector website, both applications, their apis, and all related services. - "Connected System" means any third-party software you connect through our Products, such as CRMs, field service, accounting and payment systems. Examples are GoHighLevel (HighLevel), HubSpot, Salesforce, Pipedrive, Jobber, ServiceM8, QuickBooks Online, Xero, FreshBooks, Stripe, Square and more. - "Personal Data" means any information relating to an identified or identifiable natural person, as defined by Article 4(1) of the GDPR. - "Processing" means any operation performed on Personal Data, as defined by Article 4(2) of the GDPR. - "Data Controller" means the entity that determines the purposes and means of the processing of Personal Data. - "Data Processor" means the entity that processes Personal Data on behalf of the Data Controller. - "User" refers to any person who accesses or uses the Platform, including agency owners, sub-account users, platform account owners, team members, and website visitors. - "Synced Data" refers to the records we read from and write to your Connected Systems through our Products, such as contacts, appointments, jobs, quotes, invoices and payments.

2.1 As Data Controller CRM Connector acts as a Data Controller for the Personal Data we collect directly from you in connection with your use of the Platform. This includes your account information, payment details, communication data, security data, and website usage data. 2.2 As Data Processor CRM Connector acts as a Data Processor when we process Synced Data on your behalf, that is, when we read, transfer and synchronize records between your Connected Systems. In this capacity: (a) You (the User, or the organization you represent) are the Data Controller for the Synced Data; (b) You are responsible for ensuring that you have appropriate legal bases (such as consent, legitimate interest, or contractual necessity) for the collection, processing, and transfer of Synced Data through the Platform; (c) You are responsible for informing data subjects (for example your clients and customers) about the processing of their data through integration services, where required by applicable law; (d) We process Synced Data only in accordance with your instructions as configured through your integration settings and as necessary to provide the Service.

3.1 Data You Provide Directly

3.2 Synced Data (Processed on Your Behalf) When you connect a Connected System through either Product, we read records from it and write records to it, as you configured. Depending on the systems and record types you choose, Synced Data may include: - Contact and customer information (names, company names, email addresses, phone numbers, addresses, tags, lead source) - Appointments, visits, calendar events and the staff assigned to them - Jobs, work orders, deals, opportunities and requests - Quotes, estimates, invoices, line items, payments and their statuses - Custom fields and status information - Any other data made available through the Connected System's api that your configuration uses The specific data depends on the Connected System, its api, and your configuration. We do not determine what Synced Data is processed: that follows from your configuration and the Connected System's api. For CRM Connector Platform, we also keep, for each integration, the links between a record in one system and its copy in the other (so a record is updated rather than created twice), a short fingerprint of each synced record (so unchanged records are skipped), a history of sync runs with the outcome per record and, for a record that failed, the error the Connected System returned, and figures derived from Synced Data for the reports inside the application. 3.3 Data Collected Automatically

Our application logs record identifiers (such as account, integration and record ids) rather than the contents of your records; we do not write names, email addresses or phone numbers of your customers into our logs.

4.1 Legal Bases for Processing (GDPR Article 6) We process your Personal Data based on the following legal bases:

4.2 Specific Processing Activities (a) Service Delivery: We use your account information, integration settings, identifiers and credentials to establish and maintain your integrations, perform data synchronization, show you the status and history of your syncs, and provide the Service as described in our Terms of Use. (b) Payment Processing: Payment information is processed by Stripe, our third-party payment processor. We do not store full credit card numbers on our servers. Please refer to Stripe's privacy policy at https://stripe.com/privacy for information on how Stripe handles your payment data. (c) Credential Storage: Your OAuth tokens and API keys are stored in encrypted form in our systems solely for the purpose of maintaining your active integrations. We do not use these credentials for any purpose other than providing the Service, and we access only the data your integrations need. (d) Communication: We use your email address to send service-related communications, including account confirmations, security notices, subscription and billing confirmations, integration alerts, and support responses. In CRM Connector Platform you can switch operational emails off in your settings. We do not send unsolicited marketing emails without your consent. (e) Analytics: We use PostHog to understand how visitors interact with our website, which pages help users reach checkout, and where users encounter friction. This may include analytics events, page views, click interactions, referrer information, browser and device data, and limited session replay on selected high-intent pages. (f) Assistant (CRM Connector Platform): Questions you type into the assistant inside the application are interpreted by a language model that runs on our own server. The question text is not stored, not logged, and not sent to any third party. The answers are computed from your own account's data. 4.3 Data From Connected Systems Data we receive from a Connected System, including data received through the apis of Google, Intuit (QuickBooks Online), Xero and other providers, is used only to provide and improve the features you use in our Products. We do not sell it, do not use it for advertising, do not use it to train artificial intelligence or machine learning models, and do not transfer it to anyone except as needed to provide the Service, to comply with the law, or as part of a business transfer described in section 6.4. People on our team do not read it unless you ask us to (for example in a support request), it is needed for security reasons, or the law requires it. When you sign in with Google, our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy). We receive only your name, email address and account identifier for signing in.

5.1 What Cookies We Use

5.2 PostHog Analytics, Session Replay, and Error Monitoring We use PostHog on our website to collect information about how visitors use it. PostHog may use cookies or similar browser storage technologies to collect information such as: - Pages visited and time spent on pages - Clicks and navigation patterns - Referral source - Approximate geographic location (based on IP address) - Browser and device type - Errors encountered in the browser On selected high-intent pages, we may also use session replay to understand usability issues and technical friction. We do not use PostHog to process payment card details entered into Stripe Checkout, and Stripe remains our payment processor for transactions. PostHog data is processed by PostHog. For more information, see PostHog's privacy policy at https://posthog.com/privacy. 5.3 Managing Cookies You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Platform. We will ask for your consent before placing non-essential cookies (such as analytics cookies) on your device, in compliance with the Dutch Telecommunications Act (Telecommunicatiewet) and the ePrivacy Directive.

6.1 We Do Not Sell Your Data CRM Connector does not sell, rent, or trade your Personal Data or Synced Data to third parties for marketing or advertising purposes. 6.2 Third-Party Service Providers (Sub-Processors) We share data with the following third-party service providers who assist us in operating the Platform:

All sub-processors are contractually obligated to process data in accordance with our instructions and applicable data protection laws. Connected Systems receive data because you instruct us to send it there; their own privacy policies govern how they handle it. 6.3 Legal Requirements We may disclose your Personal Data if required to do so by law, regulation, legal process, or enforceable governmental request, or if disclosure is reasonably necessary to protect the rights, property, or safety of CRM Connector, our users, or the public. 6.4 Business Transfers In the event of a merger, acquisition, reorganization, or sale of assets, your Personal Data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.

7.1 Transfer Mechanisms As the Platform uses service providers located in the EU, the United States and Canada, and your Connected Systems may be located anywhere, your Personal Data may be transferred to and processed in countries outside the European Economic Area (EEA). CRM Connector Platform is hosted by OVHcloud in Canada (Beauharnois, Quebec); Canada benefits from an EU adequacy decision for commercial organisations. For transfers to countries that do not benefit from an EU adequacy decision, we ensure appropriate safeguards are in place, such as: (a) EU-US Data Privacy Framework (DPF): For transfers to US-based service providers certified under the DPF; (b) Standard Contractual Clauses (SCCs): As approved by the European Commission, where applicable; (c) Other legally recognized transfer mechanisms under Chapter V of the GDPR. 7.2 Your Acknowledgment By using the Platform, you acknowledge that your data may be processed in jurisdictions outside the EEA and that we will take reasonable steps to ensure adequate protection for your data in accordance with this Privacy Policy and applicable law.

8.1 Active Accounts We retain your Personal Data for as long as your account is active and as necessary to provide the Service. 8.2 Sync History (CRM Connector Platform) The detail of each sync is kept for a limited time: the per record lines of records that were written successfully are removed after 30 days, and sync runs with everything recorded on them are removed after 90 days. We keep the most recent completed run of each sync direction for as long as the integration exists, because the next sync continues from it. The links between records in two systems and the fingerprints of synced records are kept as long as the connections they belong to, so that records are never created twice. 8.3 Disconnecting and Revoking Access You can disconnect a Connected System at any time. In CRM Connector Platform, revoking an app connection in Settings asks the Connected System to revoke our access where its api allows it, deletes the stored credentials, and pauses the integrations that used it; you can also revoke our access from within the Connected System itself (for example by uninstalling our app from its marketplace), after which we stop syncing and delete the stored credentials. In CRM Connector for GoHighLevel, you can disconnect an integration in the app or revoke the API key or token in the Connected System. 8.4 Deleting Your Account or Cancelling (a) CRM Connector Platform: The account owner can delete the account from Settings at any time. Deleting an account cancels its subscription, revokes its app connections where the Connected System allows it, and permanently erases the account's data from our database straight away, including users, connections, credentials, integrations, sync history, record links and report data; (b) CRM Connector for GoHighLevel: Upon cancellation or termination of your account, we retain your data for a period of 90 days to allow for account reactivation or data retrieval upon request. After that period, your Personal Data, including stored API keys and authentication credentials, is permanently deleted from our systems; (c) Synced Data that has been written into GoHighLevel or your other Connected Systems remains in those systems and is governed by their respective privacy policies. Deleting your account with us does not delete records we previously wrote into your Connected Systems. 8.5 Extended Retention We may retain certain data for longer periods where required by law (e.g., financial records for tax compliance under Dutch fiscal law, which requires retention for 7 years) or where necessary to resolve disputes, enforce our agreements, or protect our legal rights. 8.6 Anonymized Data We may retain and use anonymized and aggregated data (which cannot identify any individual) for analytical and improvement purposes indefinitely.

9.1 Security Measures We implement appropriate technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction, including: (a) Encryption: OAuth tokens, API keys and two-factor secrets are stored encrypted, and passwords are stored only as salted hashes; (b) Access Controls: Access to Personal Data is restricted to authorized personnel only, and within your account you decide which team members have which role; (c) Secure Transmission: Data is transmitted using industry-standard encryption protocols (TLS); (d) Account Protection: Two-factor authentication, session management and the ability to sign out other sessions are available in your settings; (e) Monitoring: We monitor our systems for security threats and unauthorized access. 9.2 No Absolute Security Despite our best efforts, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data, and you transmit data to us at your own risk. 9.3 Data Breach Notification In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will: (a) Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR; (b) Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34 of the GDPR; (c) Where we act as Data Processor, notify you (the Data Controller) without undue delay so that you can fulfill your own notification obligations.

As a data subject, you have the following rights regarding your Personal Data under the GDPR and the Dutch GDPR Implementation Act: 10.1 Right of Access (Article 15) You have the right to request a copy of the Personal Data we hold about you. 10.2 Right to Rectification (Article 16) You have the right to request correction of inaccurate or incomplete Personal Data. 10.3 Right to Erasure (Article 17) You have the right to request deletion of your Personal Data, subject to legal retention obligations and other applicable exceptions. In CRM Connector Platform the account owner can also delete the account directly from Settings. 10.4 Right to Restriction of Processing (Article 18) You have the right to request restriction of processing of your Personal Data in certain circumstances. 10.5 Right to Data Portability (Article 20) You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to transmit it to another controller. 10.6 Right to Object (Article 21) You have the right to object to processing of your Personal Data based on legitimate interests, including profiling. 10.7 Right to Withdraw Consent (Article 7(3)) Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. 10.8 Right to Lodge a Complaint You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): - Website: https://autoriteitpersoonsgegevens.nl - Address: Bezuidenhoutseweg 30, 2594 AV Den Haag, The Netherlands 10.9 Exercising Your Rights To exercise any of your rights, please contact us at: - Email: support@crm-connector.com - Address: CRM Connector, Opalstraat 17, 4421LK Kapelle, The Netherlands We will respond to your request within one (1) month of receipt, as required by the GDPR. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We may ask you to verify your identity before processing your request, to ensure the security of your data. If you are a customer of one of our users and your data reached us as Synced Data, we will refer your request to that user, who is the Data Controller, and assist them in answering it.

11.1 Availability Where CRM Connector acts as a Data Processor on your behalf, for either Product, you may request a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR by contacting us at support@crm-connector.com. 11.2 Scope A DPA covers the processing of Synced Data performed by CRM Connector on your behalf and defines the obligations and rights of both parties regarding data protection.

12.1 Age Requirement Both Products are B2B services intended for business use. The Platform is not directed at individuals under the age of 16, in accordance with the Dutch GDPR Implementation Act. 12.2 No Intentional Collection We do not knowingly collect Personal Data from individuals under the age of 16. If we become aware that we have collected Personal Data from a person under 16, we will take steps to delete that data promptly.

This section applies to CRM Connector Platform when you use it from an AI assistant: the CRM Connector plugin in ChatGPT, and the CRM Connector connector and plugin in Claude (together, the "Assistant Plugin"). The Assistant Plugin connects to our server at https://platform-mcp.crm-connector.com. 13.1 Without Connecting Your Account Anyone can ask the Assistant Plugin what two systems can sync and have it prepare a setup link. These answers come from our catalogue of supported systems and contain no personal data. The only input is the names of the systems and record types the assistant passes on; we do not store them. 13.2 When You Connect Your Account You connect your CRM Connector account through our own sign in at https://platform.crm-connector.com, followed by a consent page that names the assistant and says what it may see. You sign in on our site with your password, or with Google or Microsoft; nothing you enter there is shared with the assistant. Once connected, the Assistant Plugin can only read; it cannot create, change, pause or delete an integration, start a sync, or touch the records in your Connected Systems. When you ask about your account, the Assistant Plugin returns: - your integrations: their identifier, name, the two systems they connect, the direction, the status and the record types they sync; - when your syncs ran and how they ended, with counts of records read, written, skipped, failed and waiting; - the reasons records failed or are waiting, as readable sentences from which we remove email addresses, links, identifiers, quoted values, amounts and long numbers before they leave our server; - your organisation name and the email address you sign in with, so the assistant can tell connected accounts apart. It never returns the records themselves: no names, email addresses, phone numbers or addresses of your customers, no amounts of individual invoices, quotes or deals, no raw responses from your Connected Systems, and no passwords, api keys or tokens. 13.3 Who Receives These Answers The answers go to the AI assistant you use, operated by OpenAI (ChatGPT) or Anthropic (Claude), which processes them under its own terms and privacy policy. You choose to use that assistant and to connect your account to it; we do not share your data with these providers in any other way. 13.4 What We Store and Log We store a record of the access you granted (which user allowed which assistant, and when) and of the tokens issued under it. An access token is valid for 10 minutes; a refresh token is valid for 30 days and is replaced each time it is used. Your consent stays in place until you revoke it; when an assistant has not used its access for 30 days, it asks you to sign in again. Ended tokens and access records are deleted 14 days after they end, and an assistant registration that was never used is deleted after 30 days. We do not store or log the content of your conversations, your questions, the values the assistant sends to a tool, or the answers. For each call we log only which tool was called, for which account and assistant, whether it succeeded and how long it took, to keep the service secure and working. These lines are part of the Log Data described in section 3.3. 13.5 Disconnecting You can see every connected assistant and revoke its access at any time in CRM Connector under Settings, Security, Connected AI assistants. Revoking takes effect at once for the refresh token and within 30 seconds for an access token the assistant already holds; after that it can no longer read anything. Resetting your password through "Forgot password" revokes the access of every connected assistant in the same way. You can also remove the plugin or connector in ChatGPT or Claude. Deleting your CRM Connector account removes all access granted to assistants. 13.6 Legal Basis We process this data to perform our agreement with you (GDPR Article 6(1)(b)): showing you your own integrations and sync results in the assistant you chose to connect.

The Platform and website may contain links to third-party websites or services, including the marketplaces and Connected Systems you install our apps from. This Privacy Policy does not apply to those third-party websites or services. We encourage you to read the privacy policies of any third-party services you visit or use.

We may update this Privacy Policy from time to time to reflect changes in our practices, our Products, or applicable law. Changes will be posted on this page with an updated date. Your continued use of the Platform after any changes constitutes your acceptance of the revised Privacy Policy. For significant changes, we will make reasonable efforts to notify you (e.g., through a notice on our website or an email notification).