ChmurkiCRM Privacy Policy

1. Who we are

ChmurkiCRM is a customer relationship manager (CRM) for brands that sell through sales agencies and distributors. It is operated by Bamebridge Coaching B.V., the Netherlands ("we", "us"). This policy explains what information ChmurkiCRM collects, how we use it, who we share it with, how long we keep it, and the choices you have. It covers the website at crm.chmurki.com and the ChmurkiCRM application.

Questions about this policy or your data: serge@bamebridge.com.

2. Our role under GDPR

For the CRM data an organisation puts into its ChmurkiCRM workspace — its contacts, companies and deals — that organisation is the controller and we are its processor: we handle that data only on its instructions, to provide the service. For your own account and for the operation of the service (sign-in, security, support), we are the controller.

3. Information we collect

• Account information — your name, email address and workspace membership, received from our sign-in service when you sign in. ChmurkiCRM does not store passwords.
• Workspace (CRM) data — what you and your team enter or import: contacts, companies, deals and their history, notes, tasks, funnel settings, email templates, and the sales reports your distributors submit.
• Google user data — only if you choose to connect a Gmail mailbox. Section 4 describes exactly what this is.
• Technical data — server logs (IP address, time, the page or API requested, errors), kept for up to 90 days to run and secure the service. We use only essential cookies: your sign-in session, and short-lived security cookies while you sign in or connect a mailbox. Your browser's local storage keeps conveniences on your own device, such as sign-in state, view preferences and recently viewed records. We use no advertising or analytics cookies and no third-party trackers.

4. Google user data (Gmail)

Connecting a Gmail or Google Workspace mailbox is optional. If you connect one, you grant ChmurkiCRM these Google permissions, and we use each one only as described:

• Read your email (gmail.readonly) — we use this permission to read message headers only: the sender, recipients, subject line, date, and message and thread ids. Every request we make to Gmail asks for headers alone. We do not request or store the body of any message, and we never access attachments. When you first connect, we read the headers of the last 7 days of mail; after that, only new mail.
• Send email on your behalf (gmail.send) — we use this to send email from your own address: messages you write and send in ChmurkiCRM, and the steps of an email sequence that your workspace sets up and enrols a contact in. A sequence email is sent from the mailbox of the team member who owns that contact. Sequence emails are sent one at a time, spaced apart, within daily limits, carry an unsubscribe link, and stop when the contact replies or unsubscribes. Sent messages appear in the sender's own Gmail Sent folder.
• See your email address (userinfo.email) — to identify which mailbox you connected.

How we use it. Headers are used to match correspondence to people already in your workspace, so each email appears on the timeline of the right contact and of their company and deals; to show when a contact last wrote to you and whether a reply is outstanding; to detect replies and bounces so a sequence stops; and to report sequence reply rates to your workspace. For a message you write and send yourself, we record only the recipient, subject and date, not its text. For sequence emails, we keep the text of each message as it was sent, so your workspace can see what went out.

Mail from someone who is not yet in your workspace is held briefly in a triage queue so you can decide whether to add them as a contact. We keep only the sender's address, the latest subject line, a message count, and the dates involved, and the queue is visible to members of your workspace. An entry nobody acts on is deleted automatically after 30 days. An entry you dismiss is kept, so that the sender stays dismissed. You can also suppress a sender, or a whole domain, at any time; once suppressed, they no longer appear in the triage queue.

Who can see it. Matched email headers are visible to members of your own workspace, like the rest of your CRM data, including any outside collaborators your workspace adds as members. They are not shared with other organisations through connections between workspaces.

Storage and security. The access credential Google gives us is encrypted (AES-256) before it is stored, and is used only by the server component that talks to Gmail. If you disconnect your mailbox in Settings, we ask Google to revoke our access and delete the stored credential at once. If you revoke access in your Google Account instead, we detect it on the next sync and delete the stored credential.

Limited Use. ChmurkiCRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide and improve the user-facing features described above;
• we do not sell it, and do not transfer it to anyone except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to you;
• we do not use it for advertising, including retargeting or personalised ads;
• no person at ChmurkiCRM reads it, unless you ask us to for support, it is needed for security purposes such as investigating abuse, or the law requires it;
• we do not use it to train or improve generalised or non-personalised AI or machine learning models.

Revoking access. You can disconnect your mailbox at any time in Settings → Email connections, or remove ChmurkiCRM's access at myaccount.google.com/permissions. Syncing and sending stop immediately. To have the email data we already hold deleted, email serge@bamebridge.com.

5. How we use information

To provide the service you or your organisation signed up for; to keep it secure and prevent abuse; to provide support when you ask; and to meet legal obligations. Our legal bases are performance of a contract, our legitimate interest in running a secure service, and legal obligation. We do not sell personal data, we do not use it for advertising, and we do not use it to profile you for anyone else.

6. Where data is stored, and who we share it with

ChmurkiCRM's database and application servers are in the EU (Amsterdam, the Netherlands). We use these service providers to run it:

• DigitalOcean — hosts our servers and database, in Amsterdam.
• Vercel — delivers the website and passes your requests through to our servers.
• Google — only if you connect a Gmail mailbox, as described in section 4.
• Apollo.io — only if your workspace administrator turns on the contact-data integration; it is then used to look up business contact details your workspace asks for.

If your workspace configures its own outgoing mail server for invitations and notifications, those messages pass through that server, which your workspace chooses. Within the product, data is shared with another organisation only when your workspace sets up a connection with it (for example, with a sales agency), and only to the extent that connection allows. Where a provider processes data outside the EU, it does so under the European Commission's Standard Contractual Clauses or an equivalent safeguard. We may also disclose information if the law requires it.

7. How long we keep it

• Workspace data: for as long as your organisation uses ChmurkiCRM.
• Triage-queue entries: deleted automatically 30 days after the sender's last message if nobody has decided on them. An entry you dismiss is kept, so that the sender stays dismissed, until that person's data is erased on request.
• Google credentials: until you disconnect your mailbox in Settings, revoke access to ChmurkiCRM in your Google Account, or leave or are removed from the workspace, whichever comes first.
• Server logs: up to 90 days.
• When an organisation leaves, its workspace data is deleted within a reasonable period, except what the law requires us to keep.

8. Security

All traffic is encrypted in transit (HTTPS/TLS). Each workspace's data is isolated from every other workspace's by access rules enforced in the database itself. Google credentials are encrypted at rest, and access to production systems is limited to the people who operate the service.

9. Your rights

Under the GDPR you can ask for access to your personal data, a copy of it, correction, deletion, or restriction, and you can object to processing. Email serge@bamebridge.com. If your data is in a workspace run by another organisation, we will pass your request to that organisation, which decides as controller, and help it respond. You also have the right to complain to a data-protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

10. Children

ChmurkiCRM is a business tool and is not directed at children under 16. We do not knowingly collect their data.

11. Changes to this policy

If we change this policy, we will update the date above. If a change materially affects how we use your data, we will tell you before it takes effect.

12. Contact

Bamebridge Coaching B.V. · email serge@bamebridge.com