SIMPLY FREE CRM
Privacy policy
Simply Free CRM is operated by Sean Shahkarami. This policy describes the CRM, internal back office, client portal, website analytics, inquiry forms, and Simply Free CRM Scheduler. Contact seankshahkarami@gmail.com with privacy questions or requests.
Information we handle
We handle the information you or your workspace owner provide: names, email addresses, company and phone details, client records, sales information, projects, tasks, notes, messages, uploaded documents, and service inquiries. We also store workspace memberships, sharing choices, booking settings, meeting records, and application activity entries. Sign-in and infrastructure providers may process technical information such as IP addresses, device information, and service logs under their own policies. The public CRM demo stores its sample edits in your browser; it is separate from the private back office.
Why we use information
We use information to authenticate users, check workspace permissions, operate the features you request, share selected information with authorized team members and clients, arrange meetings, respond to inquiries, maintain backups, and investigate service or security problems. Creating a sign-in account alone does not grant access to a workspace. Workspace owners choose which client information is shared.
Google Calendar access and use
Only an authorized workspace owner connects Google Calendar. We request your Google account email and verified-email status to identify the connected account, availability access to check busy periods, and permission to see, create, change, and delete events on calendars you own. The current scheduler uses your primary calendar. It checks free/busy intervals and creates, retrieves, or cancels the events booked through this scheduler. It does not copy the titles or descriptions of unrelated calendar events into the CRM. The granted event permission is broader than the subset of actions currently used by the scheduler.
Google data storage and sharing
We store the connected email, encrypted Google refresh credentials, and booking information including the guest's verified email, name, optional notes, meeting time, event identifier, status, and meeting link. Booking information is sent to Google Calendar and appears in invitations shared with the host and attendees. Authorized workspace staff can access workspace bookings; clients can access their own bookings. Google credentials stay on the server and are excluded from CRM recovery exports. Booking records are included in backups. Calendar data is not sold, used for advertising, or used to train generalized AI models. Simply Free CRM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Service providers
We use OpenAI Sites and Cloudflare for application hosting and storage, Clerk for team and client email-code authentication, Google for Calendar and Meet, and Formspree for delivery of service inquiries. Each provider receives information needed for its role. Loading this site's fonts also makes requests to Google Fonts. These services have their own privacy policies. Calendar data is not sent to Formspree for inquiry delivery or to an AI model by this application. We may disclose information when required by law or as necessary to protect the service and its users.
Website analytics and visitor identification
The optional website analytics script waits for an affirmative analytics-consent signal from the installing website and respects Global Privacy Control. It uses a random first-party browser identifier and records basic visit information, such as page paths, referring hostnames, and campaign labels. The analytics implementation does not store personal IP addresses, scrape forms, or fingerprint browsers. Website owners are responsible for obtaining appropriate consent and avoiding sensitive information in tracked paths or labels. Anonymous-person and company identification through a paid identity-data provider is not currently configured. Any future identity service requires separate setup and updated disclosures before activation. With permission for contact-linked analytics, successful connected website forms and confirmed bookings may associate this browser’s existing and subsequent visits with its CRM contact. Form email addresses are self-reported; bookings use a verified sign-in email. A one-hour opaque handoff links a website visit to a booking without putting an email address in the booking URL. Declining analytics prevents this browsing link but does not prevent saving the contact details you submit for your request. You may withdraw through Analytics preferences on the installing website; this removes that browser’s current visit history and identity association, while operational contacts, bookings, and form notes remain. Visit events expire after 30 days and inactive browser associations after 90 days. MailerLite manages the Backchannel newsletter and its subscription preferences; a CRM contact is not itself a newsletter subscription.
Retention, backups, and requests
Client records, messages, notes, documents, and booking history are retained for workspace operations until removed through supported controls or a deletion request is handled. Documents and their recovery copies do not currently have an automatic expiry. We retain up to 30 nightly snapshots and 20 recent change, manual, or pre-deletion snapshots; older snapshots are removed after a new backup is verified. Backups share the hosting account and are not an independent archive of that account. For access, correction, export, or deletion requests, contact your workspace owner or seankshahkarami@gmail.com. We may need to verify your identity and authority. Copies already downloaded by others or stored in their calendars are controlled by those recipients.
Disconnecting Google and security
You can revoke Simply Free CRM's Google access in your Google Account connections settings. The workspace owner can also use Disconnect calendar in Meetings; the app may require upcoming or unsettled bookings to be resolved first. Disconnecting removes the stored Calendar connection credentials, but does not automatically erase booking history or existing Google Calendar events. We use authenticated access, server-side permission checks, HTTPS, encrypted stored Google refresh credentials, and private document storage. No service can guarantee absolute security. This service is not represented as SOC-audited or approved for storing protected health information.
Policy updates
We will post updates on this page. Before materially changing how Google user data is used, we will update the disclosures and obtain any required consent. Contact seankshahkarami@gmail.com with questions about this policy.
Google API Services User Data Policy ↗Manage your Google connections ↗