Summary: Savvana CRM collects only the data necessary to deliver our services. We do not sell your personal data. You have full rights to access, correct, or delete your information at any time.
We collect information you provide directly to us and information generated through your use of Savvana CRM.
Account & Profile Information
- Name, email address, phone number, and job title
- Company name, billing address, and subscription details
- Profile photo (optional)
- Password (stored as a secure hash — never in plain text)
CRM Data You Enter
- Customer records, contact details, and interaction history
- Lead and pipeline data, notes, and tags
- Call logs, recordings, and SMS messages processed through Twilio
- Invoice and payment records
- Support tickets and customer communications
Usage & Technical Data
- Log data: IP address, browser type, pages visited, timestamps
- Device information: operating system, screen resolution
- Session data and authentication tokens
- Feature usage patterns (to improve the product)
Payment Information
Payment card details are processed directly by our payment processor (Stripe). We store only the last 4 digits of your card and the billing address for record-keeping. We never store full card numbers on our servers.
2. How We Use Your Data
We use the information we collect to:
- Deliver and operate the service — authenticate users, process transactions, and provide CRM functionality
- Communicate with you — send transactional emails, billing receipts, security alerts, and product updates
- Provide support — diagnose technical issues and respond to helpdesk requests
- Improve the product — analyse usage patterns to develop new features and fix bugs
- Comply with legal obligations — retain records required by applicable law and respond to lawful requests
- Prevent fraud and abuse — detect suspicious activity and enforce our Terms of Service
We do not use your CRM data (customer records, call logs, invoices) for any purpose other than providing the service to you.
3. Data Sharing
We do not sell, rent, or trade your personal information. We share data only in the following circumstances:
Service Providers (Sub-processors)
- Twilio — call and SMS processing
- Stripe — payment processing and subscription billing
- Amazon Web Services (AWS) — cloud infrastructure and data storage
- Mailgun / SMTP providers — transactional email delivery
All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security standards.
Legal Disclosures
We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Savvana CRM, our users, or the public.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or a prominent notice on our platform before your data becomes subject to a different privacy policy.
4. Data Security
We implement industry-standard security measures including:
- TLS/SSL encryption for all data in transit
- AES-256 encryption for sensitive data at rest
- Multi-tenant data isolation — each organisation's data is logically separated
- Role-based access controls limiting data access to authorised personnel
- Regular security audits and vulnerability assessments
- Two-factor authentication (2FA) available for all accounts
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you within 72 hours as required by applicable law.
5. Data Retention
We retain your data for as long as your account is active or as needed to provide services. Specifically:
- Active accounts: data is retained for the duration of your subscription
- After cancellation: account data is retained for 30 days to allow reactivation, then permanently deleted
- Billing records: retained for 7 years as required by financial regulations
- Call recordings: retained according to your configured retention settings (default 90 days)
- Log files: retained for 90 days for security and debugging purposes
You may request early deletion of your data at any time (see Your Rights below).
6. Your Rights
Depending on your location, you have rights including:
- Access: request a copy of all personal data we hold about you
- Correction: update inaccurate or incomplete information
- Deletion: request erasure of your personal data ("right to be forgotten")
- Portability: receive your data in a machine-readable format
- Restriction: ask us to limit how we process your data
- Objection: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at privacy@savvanacrm.com or use the data management tools in your account settings. We will respond within 30 days.
7. Cookies
We use cookies and similar technologies to operate the platform and improve your experience. See our Cookie Policy for full details, including how to manage your cookie preferences.
8. Children's Privacy
Savvana CRM is designed for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the updated policy on this page with a revised "Last updated" date
- Sending an email notification to your registered address
- Displaying an in-app notification when you next log in
Continued use of Savvana CRM after the effective date constitutes acceptance of the updated policy.
For privacy-related questions, requests, or complaints:
If you are located in the European Economic Area and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.