CAE CRM
Privacy notice
This notice explains what personal data Collinalitics Ltd ("we") collects through CAE CRM, why, and your rights. We're registered with the Information Commissioner's Office, number [to confirm: ICO registration number].
Two different roles
- We're the controller for data about the people who use CAE CRM (you and your team), about billing, and about visitors to this website. This notice covers that.
- We're a processor for the customer and contact records that businesses keep in CAE CRM, including people who fill in a business's web form or sign one of its quotes. That business is the controller and decides how the data is used. If you're one of those people, contact the business directly. We'll help them respond. Our data processing agreement covers how we handle that data.
What we collect, why, and our lawful basis
| Data | Why | Lawful basis |
|---|---|---|
| Your name, email, password (stored only as a scrambled hash), role, and any profile details you add: job title, department, phone, location, LinkedIn, a short bio and a photo | To create your account, sign you in and show your team who's who | Contract |
| Sign-in and security records: IP address, the browser and device you sign in from, where you're currently signed in, failed sign-in attempts, two-factor settings, password reset requests, and an audit trail of changes made in your workspace | To keep accounts secure, stop misuse, and let admins see who changed what | Legitimate interests (security) |
| Business and billing details: business name, address, VAT number, the number of users, and subscription status. Card details go straight to Stripe and never reach us | To charge for CAE CRM and keep the accounts the law requires | Contract; legal obligation |
| Questions you ask the AI assistant, its answers, the summaries, briefings and draft replies it writes for you, and the records it looks up, if your workspace's admin has turned it on | To answer your questions. Your conversations are visible only to you | Contract |
| Emails you send us, and our replies | To answer you | Legitimate interests |
| Service emails, such as password resets and notices about your account | To run the service. We don't send marketing without asking first | Contract |
| A daily summary email of your tasks, tickets and deals, sent on working mornings when something needs you | To help you keep on top of your work. You can turn it off from any summary or under Profile and password | Legitimate interests |
| Error reports, which may include an account number and the page involved, with form contents, cookies and sign-in details removed | To find and fix faults | Legitimate interests |
| Website visits: IP address and browser details in our hosting provider's logs | To deliver pages and protect the site | Legitimate interests |
If you connect Gmail or Outlook, CAE CRM logs only emails to or from people already in your workspace's contacts, and only the subject and a short preview. It doesn't read or store anything else in your mailbox.
Who we share it with
We use these providers to run CAE CRM. They act on our instructions and must protect the data:
- Hetzner Online GmbH: the server CAE CRM runs on, in Nuremberg, Germany.
- Supabase: database and file storage, in [to confirm: where the database is hosted (the Supabase project's region)].
- Resend: sending email, and receiving emails sent to a business's support address.
- Stripe: payments and invoices for your subscription. If a business you deal with takes card payments on its invoices through CAE CRM, you pay on Stripe's own page and the business's Stripe account handles your card details; we only learn that the payment was made.
- Sentry: error reports, if switched on.
- Anthropic: the AI assistant and website chat, only if your workspace's admin turns them on. Anthropic receives the questions asked and the records the assistant looks up, in the United States. It doesn't use them to train its models, and deletes them within 30 days, unless it flags them for breaking its usage policy (then it can keep them for up to 2 years) or the law requires otherwise.
We don't sell personal data, and we don't use it for advertising. We only share it with anyone else if the law requires it or to protect people's safety.
Outside the UK
CAE CRM runs on a server in Germany, which the UK's adequacy regulations cover, and its database is in the UK. Some of the other providers are based in, or use services in, the United States or the EU. Where data leaves the UK, it's protected by UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK's International Data Transfer Agreement or Addendum. [to confirm: which applies to each provider]
How long we keep it
- Account and profile details: while you're on a team. When an admin removes you, they're deleted. Your name may stay on records you created or changed, such as notes and the audit trail, because those belong to the business.
- Sign-in sessions: end after 12 hours unused, or when you sign out. Password reset links expire after an hour, and email confirmation and invite links after 7 days. Failed sign-in attempts are kept for a day. A record of which browsers you've signed in from is kept while you have an account, so we can warn you about a new one.
- Billing records: six years, as UK tax law requires.
- Webhook delivery logs: 30 days.
- AI assistant conversations, summaries, briefings and drafts: 30 days from the last message, unless you delete them sooner. Erasing a contact also deletes conversations that mention them. A count of questions asked and the amount of AI processing used, without their content, is kept for 13 months.
- Workspace data: deleted within 30 days of the 30-day export window that follows a workspace closing (see the terms).
- Backups and error reports: kept for a limited period, then overwritten. [to confirm: backup and error report retention periods]
Your rights
You can ask us:
- for a copy of your personal data;
- to correct it;
- to delete it;
- to restrict how we use it;
- to stop using it, where we rely on legitimate interests;
- to send it to you or someone else in a reusable format.
You can change most profile details yourself under Profile and password. To use any other right, email [to confirm: privacy and legal contact email]. We'll reply within one month.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Here are the main ways we protect your data:
- It's encrypted on its way to and from the service.
- Passwords are stored only as scrypt hashes.
- Admins must use two-factor sign-in.
- Each business's data is kept apart from every other business's.
When you choose a password, we check it against Have I Been Pwned's list of passwords exposed in data breaches. Only the first five characters of a one-way scrambled version (a hash) are sent, never your password or email address, so the service can't tell what your password is or whose it is.
The data processing agreement lists our security measures in full.
Changes
If we change this notice in a way that matters, we'll tell users by email or in the app before the change applies.