Privacy Policy (Draft)

Operator and contact

Operator: Not yet provided
Support / privacy contact: Not yet provided
Contact address: Not yet provided
Operating country: Not yet confirmed
Intended audience: Not yet determined; no business-only or consumer-only assumption is made

No registered company is identified in this draft. An operational contact and the legally required operator information must be published before real-data or paid-service onboarding. Provider privacy links below are not a substitute for contacting the service operator.

Scope and responsibilities

This draft covers the CRMPanel website, account-based application, and public demo. The website operator would be responsible for its own account, security, and website processing. A workspace owner may determine how their customer and team records are used, with the service acting on their instructions. The final allocation of responsibilities depends on the service and applicable law.

This is not a data processing agreement. Real-data onboarding requires an identified operator, an appropriate processing agreement where required, and reviewed instructions, subprocessors, security measures, and transfer arrangements.

Information processed

Contact enquiries: the separate contact page stores the sender's name, email address, message, and submission time for the designated site owner to review. Company administrators do not receive these messages. Cloudflare Turnstile verifies submissions; security tokens are not stored with messages. A keyed hash derived from the network address and normalized email supports rate limiting. This form does not send automatic emails.
Accounts and teams: names, email addresses, profile details, company memberships, invitations, roles, permissions, authentication sessions, and account-security settings.
Workspace records: customer and company contacts, projects, tasks, inventory, offers, invoice records, manual collection records, comments, attachments, and supported CSV or Excel imports. Linked records may reference the same customer, project, or inventory item.
Security and operations: activity and audit events, timestamps, account and company identifiers, IP addresses and device/request information where recorded, errors, and service-provider infrastructure logs.
Demo access: a temporary anonymous authentication identity, private sample workspace, changes made during the session, security-check tokens, and a hashed IP-derived rate-limit value. A hashed value is not a guarantee of anonymity.
Billing, if activated later: account/customer and subscription identifiers, selected plan, billing status, and related operational records. Stripe would handle payment-card entry; the application is not designed to store full card numbers.

Purposes and legal bases

The current functions process information to authenticate users, separate company workspaces, apply access permissions, maintain connected business records, import authorized files, provide reports, prevent abuse, investigate security events, and operate the service.

The operator must determine and document the applicable legal basis for each purpose before a real-data launch. Depending on jurisdiction and context, this may involve performing a contract, complying with legal obligations, assessed legitimate interests, or specific consent. This draft does not assign a legal basis merely because a feature exists. Workspace owners must separately establish their authority to upload other people's information.

The application does not implement an advertising profile, a sale-of-personal-data workflow, or automated decisions producing legal or similarly significant effects. Ordinary reports and role-based permissions are not a promise about how a future operator will use the service.

Cookies, browser storage, and analytics

Authentication uses session cookies and/or browser storage. The application also stores interface preferences and may cache application assets through a service worker. Signing out is not a promise that every browser cache, infrastructure log, or backup has been erased.

Optional Vercel Web Analytics is off by default in this implementation. It cannot be enabled while these notices remain drafts. After a reviewed implementation is finalized, a separate, optional choice would be required by this product's configuration before loading analytics. This is a conservative product setting, not a statement that every cookie-free analytics service legally requires consent in every country.

The existing analytics filter permits page views only, removes query strings and fragments, masks supported business-record detail identifiers, and excludes designated authentication and sensitive routes. It does not intentionally send customer records or custom analytics events. Vercel describes its Web Analytics as cookie-free; request metadata and aggregate visit information can still be processed.

Use the persistent Privacy settings button to review or change your choice. Your versioned preference is stored locally for up to 180 days, separately on each site origin. Choosing necessary only stops future optional analytics events; it does not erase earlier provider records. Authentication, hosting, security checks, and external font requests are separate from optional analytics.

Providers and external requests

Supabase: authentication, database, and storage services. See Supabase privacy information; customer-data processing arrangements require a separate review of the applicable service agreements.
Vercel: website hosting, request delivery, operational logs, and optional analytics. See Vercel Privacy Policy and Web Analytics data information.
Cloudflare Turnstile: the demo loads a bot-protection check which can process IP, browser, device, and interaction signals. It is not the optional analytics feature. See Turnstile Privacy Policy.
Google Fonts: the site requests fonts from Google servers, exposing network request information such as the visitor's IP address. This request is not disabled by declining analytics. See Google Fonts privacy information.
Stripe, only if billing is activated: payment and subscription infrastructure. Live billing is currently blocked; no functioning payment account is claimed. See Stripe Privacy Policy.

Retention and deletion

Main-workspace records generally remain until an authorized deletion or an operator-managed retention action. Moving a record to Trash does not necessarily permanently delete it. Production company deletion has a configurable grace period of 7 to 30 days (default 7 days), followed by background processing; failures can delay completion.

Demo access lasts 30 minutes. Signing out ends access immediately, and background cleanup removes ended or expired demo workspaces and associated temporary authentication data. This is not a promise that all personal information disappears within 30 minutes: rate-limit records, security records, hosting logs, and provider backups are separate.

Audit history, legally required records, and provider backups may need different handling. A complete retention schedule, backup expiry, log retention, and any exceptions must be confirmed before real-data operation. There is no blanket promise of immediate erasure or indefinite retention.

Locations, sharing, and transfers

Authorized workspace members can access records according to their permissions. Infrastructure providers process information to deliver their services. Disclosure may also be required by applicable law or to respond to a security incident, subject to a reviewed process.

The operator's location, intended markets, configured hosting/database regions, and applicable international-transfer mechanisms have not been finalized. Providers can process information in multiple countries. No specific data residency, adequacy finding, standard contractual clauses, or executed transfer agreement is asserted by this draft. These must be verified against the real deployment.

A software-asset sale does not itself authorize disclosure of live customer data to a buyer. Any future transfer of personal data requires a separate assessment and appropriate notices and safeguards.

Requests, rights, and security

Depending on applicable law, people may have rights to information, access, correction, deletion, restriction, portability, objection, withdrawal of consent, and a complaint to the competent authority. The applicable authority and response deadlines depend on the operator and jurisdiction and are not invented here.

For information placed in a workspace by another organization, contact that workspace owner where possible. The operator must publish a working privacy contact and a proportionate identity-verification and request-handling process before accepting real personal data. This draft has no completed operator contact channel.

Company-scoped access, role permissions, MFA functionality, and audit records support security, but no system can guarantee absolute protection. An incident-response procedure, provider agreements, and notification obligations require operational and legal review. The current evaluation is not intended for children or sensitive-data use; no age-eligibility policy has been finalized.

Changes and finalization

Substantive changes should be versioned and clearly communicated. The final notice must identify the operator, explain actual processing and applicable legal bases, define retention and transfer arrangements, and provide usable request channels. A final policy or new consent is not created by continuing to browse this draft.