Privacy.

The short version

UK-hosted. Drafts and brief data live in crm.care. Salesforce and Account Engagement data is read on demand and never used to train models. We do not sell data, and there are no third-party trackers on this site.

1. What we hold

Data	Why	Retention
Account: name, email, workspace	Authentication and billing	Life of the account
Briefs, strategies, drafts, brand voice	They are the product — campaign memory depends on them	Until you delete them; 30 days in backups
Objects read from Salesforce / AE / HubSpot	Attribution and publishing	Cached for the session, not stored long-term
Application logs	Fault diagnosis	30 days

2. AI models

The agents call third-party models to generate text and images. We send the brief, the brand voice and the relevant memory excerpts; we do not send your prospect database. No provider is permitted to train on our traffic — we use commercial endpoints with training disabled.

3. Your rights

• Access and portability: export any workspace as JSON from Settings.
• Erasure: delete a workspace and it leaves live systems immediately and backups within 30 days.
• Rectification and objection: email legal@crm.care; we respond within 30 days.
• Complaint: you can complain to the UK ICO at any time.

4. Cookies

One session cookie to keep you signed in and a local preference for language. Nothing else. No third-party analytics on the marketing pages.

5. Sub-processors

The current list, with location and purpose, is available on request and in the DPA annex.