Privacy Policy

This policy explains what personal information EzyCrm collects, why, where it goes, and what control you have over it. In short: we store what you put in your CRM so you can use it, we keep each company's data separate, we use only the cookies needed to keep you signed in, and we don't sell your data.

EzyCrm is operated by Evan Korial, based in Saskatchewan, Canada ("we", "us"). EzyCrm is a tool for businesses. It is not meant for consumers or for anyone under 18.

Who is responsible for your data

There are two kinds of data in EzyCrm, and responsibility differs for each:

• Your account data (your name, email, password and sign-in records). We decide how this is used, so we are the organization accountable for it (the "controller").
• Workspace data about your own contacts (the people and companies your business records in EzyCrm). Your business decides what goes in and why, so your business is the controller. We handle that data only on your behalf, as a processor or service provider. Our Data Processing Addendum sets out those commitments.

If you are someone whose details are stored in a customer's workspace, please contact that business first. We will help them respond to your request.

What we collect

• Account details: your name, email address and a securely hashed password (we never store your password in readable form).
• Session and security data: a session cookie that keeps you signed in, plus the IP address and browser (user agent) of each session, kept for security. Our hosting provider also keeps short-lived request logs, including IP addresses.
• Agreement records: which version of our terms you agreed to, when, and the IP address and browser used, so we can show what was agreed.
• Workspace data: contacts, companies, deals and their values, tasks, events, notes, activity history, custom fields, saved views, and route or visit plans including addresses.
• File attachments: files you attach to records, such as quotes, photos and PDFs (up to 5 MB each).
• Imports: data you import, for example from a Less Annoying CRM CSV export.
• Microsoft 365 / Outlook (optional): if you connect it, we use it for sign-in, two-way calendar sync, and logging emails to contacts. For logged emails we store the subject, participants and time, plus links or message bodies as logged.
• AI assistant (optional add-on): if your workspace has it enabled, we store your questions and the assistant's answers. To answer, the assistant reads CRM records from your workspace.
• Public lead forms: a workspace can publish a web form. When someone fills it in, the name, contact details and message they enter are sent to that workspace, which is responsible for that information.
• Things you send us: emails and requests you send to us, so we can answer them.

How we use it

• To provide the service: store your data and show it to you and the teammates you invite.
• To run the features you turn on, such as calendar sync, email logging, route planning and the AI assistant.
• To keep accounts secure, for example by limiting repeated sign-in and password-reset attempts and reviewing session records.
• To send transactional emails: password resets, invitations and important account or service notices.
• To meet legal obligations and enforce our Terms of Service.

We don't sell your personal information, we don't share it for cross-context behavioural advertising, and we don't use workspace data for advertising. We don't send marketing emails.

For people in the EU or UK, our legal bases are: performing our contract with you (running the service), our legitimate interests (security and improving reliability), legal obligations, and your consent where we ask for it (for example, connecting Microsoft 365). You can withdraw consent at any time by disconnecting the integration.

Who can see your data

Each company gets its own workspace, and data is kept separate per workspace. Only members of a workspace can see its data. Workspace owners and admins decide who is invited and can remove members at any time. We access workspace data only when needed to run, secure or support the service, or when the law requires it.

Where your data is stored

EzyCrm's database, files and hosting are in the United States. That means your data is stored outside Canada and may be accessible to courts, law enforcement and national security authorities in the United States under US law.

For users in Canada, this is a transfer for processing under PIPEDA: we stay accountable for your data and use contracts and safeguards with our providers to protect it. For users in the EU or UK, where transfers to the US require safeguards, we rely on Standard Contractual Clauses or equivalent mechanisms offered by our providers.

Cookies and local storage

Details are in our Cookie Policy. We use only strictly necessary cookies: the session cookies that keep you signed in. We also save your light or dark theme choice in your browser's local storage on your own device. We don't use analytics, advertising or tracking cookies, which is why EzyCrm doesn't show a cookie consent banner.

How we protect it

• HTTPS encryption for all traffic.
• Passwords stored only as secure hashes.
• Microsoft access tokens encrypted at rest.
• Workspace isolation enforced in the data layer, so one workspace can't read another's data.
• Rate limiting on sign-in and password reset.
• File downloads served with security headers that stop browsers running uploaded files as web pages.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected account owners and report it to the Office of the Privacy Commissioner of Canada and any other regulator, as the law requires. We keep a record of any such breach.

How long we keep it

• Account and workspace data is kept while your account or workspace exists.
• You can delete individual records at any time.
• Any user can delete their own account from Settings, and workspace owners can delete the whole workspace. Deletion takes effect immediately in the live database, and attachments are deleted too.
• Database backups may keep copies for up to 30 days before they are overwritten.
• Session records expire and are cleared over time.

Your rights

Depending on where you live, you have the right to:

• Access the personal information we hold about you.
• Correct information that is wrong or incomplete.
• Delete your information (you can delete your account yourself from Settings).
• Get a copy of your data. You can export contacts to CSV and download attachments in the app.
• Withdraw consent, for example by disconnecting Microsoft 365.
• In the EU or UK, object to or restrict certain processing.

Send requests to scanified@gmail.com. We will respond within 30 days and may need to confirm your identity first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or to your local data protection authority if you are in the EU or UK.

California residents: we do not sell or share personal information for cross-context behavioural advertising.

Quebec residents: the person in charge of protecting personal information is Evan Korial, reachable at scanified@gmail.com. Before data is stored outside Quebec, we assess the protection it will receive, as described under "Where your data is stored". You may also complain to the Commission d'accès à l'information du Québec.

Children

EzyCrm is for businesses and is not directed at children. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18.

Changes

If we make material changes to this policy, we'll tell workspace owners by email or in the app before they take effect. The date at the top shows when it was last updated.

Contact

Evan Korial is the person accountable for privacy at EzyCrm (our privacy officer). Questions or requests: scanified@gmail.com.