Privacy Notice

The DealCRM service is operated by DEALCRM LLC, a limited liability company registered in Georgia (identification number 422961806).
Registered address: Khvanchkara, block N001, plot N047 settlement, Ambrolauri district, Georgia.
Privacy contact: crm@dealcrm.app.

DealCRM is a CRM: a customer (a company that signs up) stores records about its own staff, leads, clients and other contacts. For those records the customer decides why and how they are used and is responsible for informing the people concerned; DealCRM processes them on the customer’s behalf to run the service. For account administration, service security, support and billing status DealCRM acts as a controller itself.

Account data (users of the service):

• name, email address, telephone number, organisation name and job title;
• hashed password, two-step verification settings, last-login time;
• the time you accepted this notice at registration (kept as a consent record).

Customer content (entered by the customer or its users):

• contacts, companies, deals, tasks, meetings, comments and change history;
• business correspondence: emails and messages from connected channels, call records, attachments;
• data about the customer’s own clients that is shown in the client portal.

Technical data:

• session and security data: IP address, browser and device information, access logs;
• support correspondence and service configuration;
• subscription status and payment records (invoices, transaction identifiers). Card details are handled by the payment provider and never reach DealCRM servers.

We use this data to:

• create accounts, authenticate users and provide CRM functionality;
• send transactional emails (verification codes, invitations, password reset, notifications you enabled);
• secure, maintain and troubleshoot the service;
• answer support requests and announce service changes;
• manage subscriptions, issue invoices and meet accounting obligations.

We do not sell personal data and do not use it for advertising. Please do not enter special-category data (health, beliefs, biometrics and similar) unless your organisation has a lawful basis and safeguards for it.

• Contract (Art. 6(1)(b)) — creating and running your account and the features you use.
• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention, reliability, support and backups, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — accounting and tax records for payments and invoices.
• Consent (Art. 6(1)(a)) — where a feature relies on it; you can withdraw it at any time without affecting earlier processing.

For customer content, the lawful basis is the customer’s own; we process it under the customer’s instructions. The final mapping is subject to confirmation by the controller’s legal adviser.

The EU service runs on servers of Hetzner in Germany. Data is shared only with providers needed to run the service:

• Hetzner (Germany) — server hosting.
• Paddle — payments for the EU service; Paddle acts as merchant of record and handles card data and tax under its own terms.
• Backups — database backups are encrypted and stored with Hetzner.
• Channels the customer connects itself: a mailbox through Google or Microsoft OAuth or the customer’s own mail server settings, messengers and telephony. DealCRM does not provide a mail server; these providers receive data under the customer’s own settings and agreements.

DEALCRM LLC is established in Georgia, outside the EEA, so remote access from Georgia to data stored in the EU is an international transfer, and the EU has no adequacy decision for Georgia. We therefore rely on the EU standard contractual clauses. Customers in the EU/EEA accept the Data Processing Agreement, which incorporates the EU standard contractual clauses (Module Two), when they register. Further information at crm@dealcrm.app.

• Deleting your own account: your profile (name, email, phone, password, tokens) is erased. Deals, tasks, comments and history you worked on stay with the organisation, with you removed as owner/author, so colleagues keep their records.
• Deleting an organisation: marked immediately, all its contacts, deals, correspondence, attachments and users are permanently erased after 7 days. All administrators are notified by email during this period.
• Payment records and invoices are kept for the period required by accounting law.
• Data export links expire after 7 days and the archive is then deleted.
• Backups: daily encrypted database backups are kept on the server for 3 days and in Hetzner storage for up to 30 days (up to 37 days including superseded versions), after which they are deleted automatically. Data you erase therefore disappears from backups within that period.

Security measures include HTTPS, password hashing, role-based access, encrypted backups and separation of production services. No online service can guarantee absolute security.

Subject to the GDPR you may request access to your data, rectification, erasure, restriction, objection to processing, and portability; withdraw consent; and lodge a complaint with your local data protection supervisory authority.

Self-service: in Settings you can download your data (an archive with your account and records, sent to your verified email) and delete your account. Administrators can export or delete the whole organisation. Other requests: crm@dealcrm.app. We answer within one month. If your data sits in a customer’s CRM workspace, contact that customer first; we will assist as our agreement requires. We may need to verify your identity.

DealCRM uses only strictly necessary cookies and local storage; there is no advertising or analytics tracking.

• refresh_token — keeps you signed in; HttpOnly, 7 days.
• NEXT_LOCALE — remembers your interface language; 1 year.
• dealcrm_zone — remembers the service region you chose; 1 year.
• Local storage — your notice dismissal, theme and layout preferences; stays on your device.

Blocking these may prevent parts of the service from working.

We may update this notice when the service or its data practices change. The current version is published at dealcrm.app/en/privacy with its last-updated date. Material changes will be communicated in the service or by email.

This notice is based on Regulation (EU) 2016/679 (GDPR). It is a product disclosure, not a substitute for the customer’s own privacy notice or legal advice.