1. Information We Collect
We collect information necessary to operate BytesCRM and provide the services described at checkout and in the product. This includes:
- Account data — name, email address, password credentials, and billing status used to authenticate and manage your account.
- CRM and business data — contacts, deals, tasks, calendar events, email logs, pipeline activity, and custom fields you enter or import.
- Subscription and billing metadata — your plan, usage counters, billing dates, and Stripe customer identifiers. Full payment card details are handled by our payment processor and are not stored in BytesCRM.
- Chatbot and lead data — chatbot conversations, lead capture submissions, contact details collected through your widget installations, and chat transcripts.
- Widget analytics — engagement events, page URL context, visitor session identifiers, country-level location signals, consent choices, and performance metrics sent from your installed widgets.
- Product usage events — feature interactions, navigation events, and error reports used to monitor reliability and improve the product.
- Support communications — messages you send us for help or account inquiries.
When your visitors interact with a BytesCRM widget installed on your website, that widget may transmit the data types listed above to BytesCRM on your behalf. You are responsible for ensuring your website visitors are informed about this collection in accordance with applicable law.
2. How We Use Information
We use the information we collect to:
- Authenticate and operate your account, CRM, and dashboard.
- Route, store, and display lead and contact data captured through your widgets.
- Send transactional notifications, lead alerts, daily summaries, and overflow warnings.
- Process payments and manage subscription state.
- Detect and prevent abuse, fraud, and unauthorized access.
- Generate aggregated or de-identified analytics to improve product reliability, reporting quality, and feature performance.
- Respond to support requests and resolve account or billing issues.
We do not sell personal information to third parties, and we do not use your CRM or lead data for advertising purposes unrelated to operating BytesCRM.
3. Customer Data and Tenant Isolation
CRM records, chatbot data, lead submissions, widget analytics, and subscription settings belong to the customer account that created or received them. BytesCRM is designed so each account can only access its own data. Administrative access to customer data by BytesCRM staff is limited to cases required for support, security investigation, legal compliance, or service continuity, and is governed by internal access controls.
Overflow leads — those captured beyond your plan's contact capacity — are sequestered and their identifying details (name, email, transcript) are not visible to other users or publicly accessible until unlocked by a subscriber with appropriate plan access.
4. Service Providers and Sub-processors
We engage trusted service providers to deliver BytesCRM. These may include providers for cloud hosting and database infrastructure, authentication and identity management, payment processing (Stripe), transactional email delivery, error monitoring and logging, customer support tooling, and AI model inference. We require service providers to handle data consistently with applicable privacy obligations and this Policy.
5. Cookies and Tracking Technologies
BytesCRM uses cookies and similar browser technologies for session authentication, security, preference storage, consent tracking, and analytics. When you install a BytesCRM widget on your own website, that widget may also use cookies or local storage to manage consent choices, session continuity, and engagement analytics. See our Cookie Policy for more detail.
6. Security
We apply administrative, technical, and operational safeguards to protect account and customer data. These include encryption in transit, access controls, and monitoring. No online service can guarantee absolute security, and we also design for detection, containment, and recovery in the event of an incident.
7. Data Retention
We retain information for as long as needed to operate the service, meet legal obligations, prevent abuse, resolve disputes, and enforce agreements. Overflow lead records and their associated secrets are subject to plan-defined expiry windows and are automatically deleted when they expire or when the subscriber deletes them. Account data is retained following account closure for a reasonable period to comply with legal, financial, and audit obligations, after which it is deleted or de-identified.
8. Your Rights and Choices
Depending on your jurisdiction, you may have rights to access, correct, export, restrict processing of, or delete personal data we hold about you. To exercise these rights:
- Account settings allow you to update profile data, notification preferences, widget configurations, and subscription choices.
- Reports and exports allow you to download certain CRM and analytics data.
- For account deletion or data correction requests that go beyond in-product controls, contact us at contact@bytescrm.app.
If you are a visitor to a website that uses a BytesCRM widget and you want to exercise rights regarding data collected through that site, please contact the website owner directly. BytesCRM acts as a data processor for that customer's widget deployment.
9. International Transfers
BytesCRM is operated from the United Kingdom. Data may be transferred to and processed in countries where our service providers operate. Where required by applicable law, we rely on appropriate transfer mechanisms to safeguard such transfers.
10. Changes to This Policy
We may update this Privacy Policy when we add features, change data practices, or respond to legal or regulatory developments. Material changes will be communicated through the product or by email. Continued use of BytesCRM after changes take effect constitutes acceptance of the updated Policy.
11. Contact
Questions or requests related to this Privacy Policy can be sent to contact@bytescrm.app. We aim to respond within a reasonable timeframe.