This Privacy Notice explains how Good Old CRM collects, uses, and protects your personal data, and the rights you have under the General Data Protection Regulation (GDPR).
Leon Skalczyński, operating Good Old CRM from Spain, is the data controller for the personal data described in this notice.
When you create an account, Firebase Authentication (Google) processes your email address and password credential. We do not receive your plain-text password. We send a verification email to the address you provide, and some features require a verified email.
We process the clients, deals, events, custom fields, settings, team and membership information, and file attachments you enter into the application.
Paddle is the authorised reseller and merchant of record for Pro purchases. We receive and store identifiers and status information needed to connect a Paddle customer and subscription to your account, including customer and subscription IDs, price IDs, status, entitlement, and event timestamps.
We compare the Paddle email with your account email when first linking a subscription, but we do not store that Paddle email in our subscription record and do not receive your full payment card number.
If you use Smart AI, voice transcription, or Import with AI, the relevant prompt, CRM context, audio recording, or content of a file you choose to import is sent through our Firebase function to a Google Gemini model. Proposed changes and converted records are shown for review before they are applied.
If you create a calendar link (Pro), we generate a secret link for one workspace and serve your events at that address as an iCalendar feed.
We do not connect to Google or Apple on your behalf, we do not hold any Google or Apple account credentials, and no calendar account data is sent to us. The link itself is the credential: anyone who has it can read the event titles and notes in that workspace, so it should be treated as a password and removed from Settings if it is shared by mistake.
The link and its workspace are stored on our servers. The events it serves are the same records already stored in your workspace.
The web app uses Google Analytics to collect usage information such as screen views, feature actions, aggregate record counts, plan/account/workspace categories, session information, approximate location, and browser or device information.
Our product-event code is designed not to send CRM content, names, email addresses, record IDs, search terms, filenames, or notes to Analytics. Google may also receive the page URL, referrer, IP address, and cookie or device identifiers as part of the Google tag's normal operation.
We use data to:
We do not sell personal data or use CRM content for advertising.
Depending on the processing, we rely on:
Analytics cookies or similar storage require consent where applicable. You may withdraw consent at any time, without affecting processing already carried out lawfully.
CRM data entered in Guest mode is stored in browser storage on your device rather than in our CRM cloud database. Limited analytics and technical data is still transmitted as described above.
If you create an account, CRM data is synchronised to Firebase Cloud Firestore and Pro attachments may be stored in Cloud Storage for Firebase.
Google and Paddle may process data outside the European Economic Area under the safeguards described in their privacy documentation.
We use Google services for:
We use Paddle as the authorised reseller and merchant of record for subscriptions. These providers process data under their own terms and privacy notices and may act as processors or independent controllers depending on the activity.
The web application uses browser storage for CRM data, backups, attachments, preferences, and account-related state.
The Google tag is configured with advertising and analytics storage denied by default, so it must not write the usual Google Analytics _ga identifier unless you enable anonymous usage analytics during registration or through Analytics preferences in your account. You can withdraw that consent at any time.
Google may still receive limited cookieless measurement data as described above. You can limit or clear cookies and local storage through your browser, although clearing application storage can remove locally stored CRM data.
Account and cloud CRM data is kept while your account is active and as needed to provide the service. You can delete individual CRM data in the application or request account deletion from the Account screen.
Account deletion starts automated removal of personal CRM data, owned teams and their data, memberships, cloud attachments, and our subscription-entitlement records, and requests cancellation of linked Paddle subscriptions.
At the date of this notice, the Google Analytics property is configured to retain event data associated with cookies or identifiers for 2 months and user data for 14 months, with the user-data retention period reset on new activity. These controls do not determine the retention of most aggregated standard reports. Changes to the Analytics settings may take up to 24 hours to apply.
Deletion may not remove data immediately from provider backups, security or function logs, aggregated reports, or records that Google or Paddle must retain for fraud prevention, accounting, tax, dispute, or other legal obligations. Those providers apply their own retention periods. Local browser data remains under your control and can be cleared in the browser.
Under the GDPR, you have the right to:
You can exercise several of these rights directly in the application, for example by exporting or deleting your data. To exercise any of these rights, contact us at support@goodoldcrm.com.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) if you believe your data has been processed unlawfully.
We apply reasonable technical and organisational measures to protect your data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The service is not directed to children under 16, and we do not knowingly collect personal data from them.
We may update this Privacy Notice from time to time. Material changes will be communicated within the application.
For questions about this notice or to exercise your rights, contact us at support@goodoldcrm.com.
