Privacy Policy

1. Information We Collect

We collect the following categories of information in connection with your use of the Service:

• Account Information: When you register for an account, we collect your name, email address, phone number, password, and billing information (processed securely through Stripe).
• Lead and Contact Data: Information you input into the Service about your leads and contacts, including names, email addresses, phone numbers, notes, tags, custom fields, and any other data you choose to store.
• Usage Data: Information about how you interact with the Service, including pages visited, features used, actions taken, timestamps, frequency of use, and session duration.
• Call Recordings and Transcriptions: Audio recordings of calls made through the Service and AI-generated transcriptions of those calls, when call recording is enabled on your account.
• Communications Content: The content of emails and SMS messages sent and received through the Service, including message bodies, subjects, sender and recipient information, and delivery status.
• Device and Technical Information: Your IP address, browser type and version, operating system, device type, screen resolution, referring URLs, and other technical identifiers collected automatically when you access the Service.
• Security and Location Data: We collect IP-based geolocation data, login history, failed login attempts, and device fingerprints for security monitoring and fraud prevention, including detection of logins from new countries or suspicious activity.
• Marketing Attribution Data: When you register for an account, we may capture UTM parameters and referring URLs from the link that brought you to our registration page, for the purpose of understanding how users discover our Service.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Operation: To provide, maintain, and improve the Service, including processing your communications, managing your leads, and delivering the features included in your subscription plan.
• Payment Processing: To process subscription payments, wallet top-ups, and overage charges through our payment processor, Stripe.
• AI-Powered Insights: To generate call transcriptions, lead scores, coaching recommendations, email and SMS drafts, and other AI-generated insights that enhance your use of the Service.
• Notifications and Communications: To send you transactional emails, account alerts, billing notifications, and important service announcements.
• Platform Improvement: To analyze usage patterns, diagnose technical issues, and improve the performance, reliability, and user experience of the Service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests, and to protect the rights, property, and safety of Asan CRM, our users, and the public.

3. Information Sharing

Asan CRM does not sell, rent, or trade your personal information or your lead data to any third party. We share information only with the following categories of service providers, solely to the extent necessary to operate the Service:

• Twilio: For voice calling, SMS messaging, phone number provisioning, and related telecommunications services.
• SendGrid: For email delivery and transactional email services.
• OpenAI: For AI-powered features including call transcription, content generation, lead scoring, and coaching analysis.
• Stripe: For secure payment processing, subscription management, and billing.
• DigitalOcean: For cloud infrastructure, server hosting, and data storage.

Each of these service providers is contractually obligated to handle your data in accordance with their respective privacy policies and applicable data protection laws. We may also disclose your information if required to do so by law, regulation, subpoena, court order, or other governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4. Data Storage & Security

All data is stored on servers located in the United States. We employ industry-standard security measures to protect your information, including Transport Layer Security (TLS) encryption for all data transmitted between your browser and our servers, AES-256 encryption for data at rest, and strict access controls that limit data access to authorized personnel only.

Our platform implements multi-tenant data isolation, ensuring that your data is logically separated from other customers' data at the database level. While we take extensive measures to protect your data, no method of electronic storage or transmission over the internet is completely secure, and we cannot guarantee absolute security.

5. Your Rights

You have the following rights with respect to your personal information:

• Access: You may request access to the personal information we hold about you at any time by contacting us at hello@asancrm.com.
• Export: You may request a machine-readable export of your data, including lead records, communications, and account information.
• Deletion: You may request deletion of your account and associated data at any time. Upon cancellation, your data will be retained for a thirty (30) day grace period and then permanently deleted.
• Correction: You may update or correct your personal information through your account settings at any time.

For Canadian users, Asan CRM respects your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access, correct, and challenge the accuracy of your personal information held by us. To exercise any PIPEDA rights, please contact our privacy team at hello@asancrm.com.

6. Call Recording Disclosure

The Service includes the ability to record telephone calls. When call recording is enabled, all outbound calls made through the platform may be recorded and stored on our servers. It is your sole responsibility to comply with all applicable federal, state, and provincial laws regarding call recording consent. Many jurisdictions require that all parties to a call be notified of and consent to recording.

Call recordings are stored securely using encryption and are accessible only to authorized users within your account. Recordings are retained for a maximum of ninety (90) days from the date of the call, after which they are automatically and permanently deleted.

SMS messages and email communications sent and received through the Service are retained for the duration of your active subscription. Upon account cancellation, SMS and email data are subject to the same thirty (30) day grace period and permanent deletion process described in Section 5 of this Privacy Policy.

7. AI Data Processing

Certain features of the Service utilize OpenAI's API to process your data, including call transcription, content generation, lead scoring, and coaching analysis. When your data is sent to OpenAI for processing, it is transmitted securely via API and is processed in accordance with OpenAI's data usage policies.

As of the date of this Privacy Policy, OpenAI's API data usage policy provides that data submitted through the API is not used to train or improve OpenAI's models. Asan CRM relies on this policy but cannot guarantee that OpenAI's policies will not change in the future. We will update this Privacy Policy if we become aware of material changes to OpenAI's data processing practices.

8. Cookies & Analytics

The Service uses essential cookies that are strictly necessary for authentication, session management, and the proper functioning of the platform. These cookies do not track your browsing activity across other websites and cannot be disabled without impairing the functionality of the Service.

We may also use analytics tools to collect anonymized usage data for the purpose of understanding how users interact with the Service and identifying areas for improvement. We do not use advertising cookies, tracking pixels, or any third-party advertising technologies. We do not engage in behavioral advertising or cross-site tracking.

9. Children's Privacy

The Service is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a person under 18 years of age, we will take immediate steps to delete such information from our systems. If you believe that a minor has provided us with personal information, please contact us at hello@asancrm.com so that we can address the situation promptly.

10. Data Breach Notification

In the event of a data breach that compromises your personal information, Asan CRM will notify affected users within seventy-two (72) hours of becoming aware of the breach via the email address associated with your account. The notification will describe the nature of the breach, the types of data affected, the measures we are taking to address the breach, and recommended steps you can take to protect yourself. We will also notify applicable regulatory authorities as required by law, including the Office of the Privacy Commissioner of Canada where PIPEDA applies.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. For material changes to this Privacy Policy, we will provide at least thirty (30) days' prior notice by sending an email to the address associated with your account. Non-material changes, such as clarifications or formatting updates, may be made without prior notice. The "Last updated" date at the top of this page indicates when this Privacy Policy was most recently revised. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us at: