Who is responsible for your information?
EASYCRM is a wholly owned project of Chrysalis Marketing (Pty) Ltd, company registration number K2021340278, South Africa. This notice covers our website, account administration and CRM service.
For account, support and service-administration information, Chrysalis Marketing is the responsible party. A business using an EASYCRM workspace decides why and how it uses its contacts and conversations; that business is normally the responsible party for that workspace information. We process workspace information on its instructions to provide the service. A customer workspace is separate from EASYCRM’s own platform administration and from other customers’ workspaces.
Contact support@easycrm.co.za for privacy questions, access or correction requests, account closure, or help identifying the business responsible for a workspace record.
Information we collect
If you join the early-access waitlist, we collect your name, email, business name, team size, optional requirements and a record of your request to be contacted. These enquiries belong to EasyCRM platform administration, not to a customer workspace. We use them to review access requests and arrange invitations; joining is not consent to unrelated marketing. Contact support@easycrm.co.za to correct or withdraw your request.
Account information includes your name, email address, password hash, workspace membership and security settings. Service records include invitations, authentication and security events, support correspondence, and technical information such as IP addresses and request logs.
Workspace owners and authorised users may add contact details, relationships, custom fields, notes, pipeline records, tasks, form enquiries and messages. Imported files may contain additional personal information selected by the uploader. Please include only information you are authorised to provide and that is needed for your business.
Connecting Google is optional. Depending on the features you authorise, we access your account email, saved contacts, Gmail messages and headers, primary-calendar events, and Drive file metadata and links. Gmail attachments are retrieved on request; Drive indexing does not import full document contents. Credentials and tokens allow the selected connection to work in the background.
Obsidian and WhatsApp export imports contain the notes or conversations you choose to upload, their source details and original archives. They are snapshot imports, not continuous access to your device or personal WhatsApp account.
How we use information
We use information to provide and secure your account, organise workspace records, suggest identity matches for review, link conversation history to people, run requested tasks and sequences, deliver authorised messages and invitations, provide support, and meet legal obligations.
If a workspace owner enables Gemini contact selection, we send the selected contact names, company names, Google labels and email domains to the configured Gemini API to assess relevance against the owner’s criteria. We do not send full email addresses, phone numbers, message bodies, financial fields or notes for this feature. It requires a billing-enabled service configuration and a workspace opt-in. The result is a selection suggestion; local identity checks still control linking.
Workspace messages use the workspace’s configured sending account. EASYCRM invitations and platform messages use a separate platform connection. Connecting a mailbox does not authorise unrelated customers to access it.
We do not sell personal information or use imported conversations for advertising. The current service does not send your imported records to a general-purpose AI model for training. Matching suggestions do not automatically establish that two records refer to the same person.
Google API data: Limited Use
EASYCRM’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
We use Google data only to provide or improve the user-facing CRM features you enable. We do not sell it, use it for personalised advertising, or use it to train generalised AI or machine-learning models.
Human access to Google data is limited to cases permitted by that policy, such as your affirmative agreement to view specific data, security investigations, legal requirements, or permitted aggregated and anonymised internal operations. Transfers are limited to what is necessary for the permitted service purposes or otherwise permitted by that policy.
Sharing and international processing
We use hosting and service providers to operate EASYCRM. The current application is hosted through GreatSites. Google processes connected-account requests and mail according to its own terms. Authorised infrastructure administrators may have technical access needed to operate and protect the service.
Information is shared with recipients when you send messages, with authorised users of the relevant workspace, with service providers where necessary, and where disclosure is legally required or needed to protect rights and security. We do not provide one customer with another customer’s workspace records.
Google and other service providers may process information outside South Africa. Where we arrange an international transfer, we must use an applicable lawful basis and appropriate protection under POPIA. This notice does not promise that all data or backups stay in South Africa.
Retention, disconnection and deletion
Workspace history is retained while needed for the service and the workspace’s purposes. Automatic history expiry is off by default; an owner may choose a retention period. You can ask your workspace owner or support to remove information that is no longer needed.
Disconnecting Google stops future access and revokes the connection, but does not by itself delete information already imported into EASYCRM. You may also revoke access through your Google Account. Request deletion separately if you want the imported copies removed.
Workspace erasure removes that workspace’s active records and uploaded history in stages. A login shared with another workspace may remain. Account closure and deletion requests are reviewed separately from a workspace erasure. Backup copies expire separately and are not immediately removed by deleting a live record; contact us for the applicable backup retention. We may retain information required by law or for a documented dispute or security purpose.
Security and cookies
We use access controls, HTTPS, password hashing, administrator multi-factor authentication, encrypted connection credentials and encrypted application backup tools. Source history and uploaded archives are not end-to-end encrypted. Authorised infrastructure access remains possible; no online service can promise absolute security.
The CRM uses essential session cookies to keep you signed in and protect requests. The current website does not include advertising trackers. Your browser can block cookies, but sign-in and account functions may stop working. Hosting providers may keep technical access and security logs.
Your choices and rights
You may request access to your personal information, correction of inaccurate information, deletion where applicable, or object to processing as provided by law. Where processing depends on consent, you may withdraw it. Withdrawing a Google permission may disable the corresponding feature.
For records held by a customer workspace, contact that business first; we can help route a request. For EASYCRM account or platform information, email support@easycrm.co.za. We may need to verify your identity and authority before providing or changing information.
You may lodge a complaint with South Africa’s Information Regulator. The service is intended for business users, not accounts operated by children. A workspace must have a lawful basis for any information it imports about children or other people.
Changes to this notice
We will update this page when our practices change and identify the revision date. Where a change requires a new permission or consent, publication of this notice alone does not grant it.