Privacy Policy — NinjaProspecting CRM

Account information. Your name, work email address, role, and workspace membership, provided when your administrator invites you or when your company signs up. Sign-in is handled by Supabase Auth (an emailed sign-in code) or, where enabled, "Continue with LinkedIn"; we store the resulting account identifier, never a password.

Workspace data you enter. Contacts, companies, deals, notes, tasks, files, custom fields, and anything else your team records about its business relationships. This includes personal data about third parties (your prospects and customers) that your company is responsible for collecting lawfully.

Connected-account data. When a user connects a Gmail, Outlook, Google Calendar, or Outlook calendar account we receive mail and calendar data from that account, as described in sections 3 and 4.

LinkedIn data captured by the optional extension, described in its own policy.

Usage and technical data. Server logs (request paths, timestamps, IP address, browser user-agent), an audit log of who created, changed, or deleted which record and when, and error reports. We do not use analytics or advertising trackers.

• To provide the service: store and display your workspace's records, thread email and LinkedIn messages onto the right contact, schedule and remind about follow-ups, and send email or create calendar events only when a user asks us to.
• To keep the service secure and working: authentication, audit logging, abuse prevention (a captcha on public sign-up), error monitoring, and backups.
• To communicate with you about the service: invitations, sign-in codes, and service notices sent by email.

We do not sell personal data, use it for advertising, share it with data brokers, or use it to train artificial-intelligence or machine-learning models.

This section describes how NinjaProspecting CRM handles data received from Google APIs when a user connects a Google account. It applies in full to every Google permission we request.

What we request and why

What we access and store from Gmail

Starting from the time you connect (with a 24-hour look-back), we periodically read messages in your mailbox, excluding Spam and Trash, and store for each: sender and recipient addresses and names, subject, date, Gmail thread and message identifiers, Gmail labels, a short snippet, the message body as plain text, truncated to 50 KB, and the names and sizes of attachments. We do not download or store the attachment files from your mailbox. Each stored message is linked to the contact records whose email address matches a sender or recipient; messages that match no contact are still stored in your workspace so they can be linked later. When you send from NinjaProspecting CRM, we store the sent message (including its HTML) and any file you attached in the composer.

What we access and store from Google Calendar

Calendar events are read live when you open a scheduling view and are not stored; we only display them. For meetings you create in the CRM with two-way sync on, we store the identifier of the Google event we created so we can update or remove it when the CRM meeting changes.

Tokens

The access and refresh tokens Google issues are stored encrypted (AES-256-GCM) in our database and decrypted only in memory to make the API calls above. Disconnecting an account in Settings deletes the tokens immediately and stops all access.

Who can see it

Mail filed onto a contact and calendar-derived CRM meetings are visible to the members of your workspace, like every other record in it. Your workspace's administrators control membership. Gigadev staff do not read your Google data except to investigate a support request you have made, to address a security incident, or where required by law.

Sharing and transfer

We do not transfer Google user data to any other application or third party except the infrastructure providers in section 5, who process it on our behalf to run the service. We do not use it for advertising, do not sell it, and do not use it to build or train AI/ML models.

Retention and deletion

Stored messages stay in your workspace so your team's history is complete; disconnecting a mailbox stops collection and revokes our access but keeps what was already filed — the same way removing a mailbox from your phone keeps the contacts you saved from it. Your administrator can delete any filed message or contact at any time. A workspace's data is deleted when the customer ends service or on request (section 6). Database backups are retained for a short rolling window (currently 7 days) and then expire.

Revoking access

Settings → Email or Settings → Calendar in NinjaProspecting CRM, or at Google Account → Security → Third-party apps & services.

Outlook mail and calendar connections work the same way as section 3 with the equivalent Microsoft Graph permissions (Mail.Read, Mail.ReadWrite, Mail.Send, Calendars.Read or Calendars.ReadWrite, offline_access) and the same storage, encryption, visibility, retention, and revocation rules. Access can also be revoked at Microsoft account → Privacy → App access.

NinjaProspecting CRM runs on infrastructure providers acting as our processors:

• Vercel — application hosting (US West).
• Supabase — PostgreSQL database and authentication (AWS, US West / Oregon). Data is encrypted at rest and in transit (TLS).
• Sentry — error monitoring. Error reports carry technical context and identifiers (user id, workspace id); message bodies and record contents are not sent.
• Resend — transactional email (invitations, sign-in codes, notices).
• SendGrid — receives email that users choose to Bcc to their workspace's private intake address and forwards it to the service.
• Cloudflare Turnstile — bot protection on the public sign-up form.

Every workspace's data is isolated at the database layer (row-level security) so one customer can never read another's.

Users can view and edit their own profile in the app. Workspace administrators can correct or delete any record, remove members, and disconnect mailboxes and calendars. For access, correction, deletion, or export requests that you cannot complete in the app — including deletion of an entire workspace — contact support@ninjaprospectingcrm.com. Because NinjaProspecting CRM processes data on behalf of the customer that operates your workspace, we may refer requests about third-party contact data to that customer.

TLS for all traffic; encryption at rest; encrypted OAuth tokens; per-workspace row-level isolation enforced by the database; audit logging of every create, change, and delete; role-based permissions within a workspace; daily backups.

NinjaProspecting CRM is business software and is not directed at children under 16.

We will post changes on this page and update the effective date. Material changes will be announced in the application.

Privacy questions or requests: support@ninjaprospectingcrm.com. The service is operated by Gigadev (scott.shepherd@gigadev.net).