CRM Privacy Policy

Who we are

Kabooly CRM is run by Kabooly Ltd, a company registered in England and Wales (company number 15653819), at 23 Carisbrooke House, Seven Kings Way, Kingston Upon Thames, KT2 5BS, United Kingdom. We are registered with the Information Commissioner's Office, registration number ZC086840.

We have two roles under UK data protection law:

Controller of the data about the businesses that use the CRM and the people on their teams: account details, sign-in, billing and support.
Processor of the data those businesses keep in the CRM about their own customers, leads and contacts. The business is the controller of that data, and we handle it only on its instructions, under our terms of service.

If a business keeps your details in Kabooly CRM and you want to see, correct or delete them, contact that business first. We will help it answer you.

What we collect about you as a user

When you sign up: your company name, your name, email address and password, and the name of anyone who referred you
Your profile: your photo, job title and phone, if you add them
Your account: your logo, mailing address, company email and phone, if you add them
Billing: your subscription and payment records, held with Stripe. We never see your card details
Security records: a log of important actions in your account, with the IP address and browser they came from
Messages to us: what you send through Feature Requests or by email, with any attachment
Connections you make: the Google, Microsoft or Facebook account you connect, described below

What the CRM holds for a business

A business decides what it keeps in the CRM. That can include:

contact details, such as names, email addresses, phone numbers, companies, job titles and addresses
notes, activities, tasks, deals, tags, stages, contact properties and custom fields
files and images
bookings, with the guest's name, email address, phone, notes and timezone
leads from the business's website forms, its booking widget, Facebook and Instagram lead ads, and its other systems through our API
the emails it sends, and whether each one was delivered, opened or clicked

When someone fills in a business's form or books through its widget, the CRM also records:

the IP address and browser used, and an approximate location worked out from the IP address
where the visit came from: the campaign tags (UTM parameters) and ad click IDs in the page address, and the referring website

Campaign emails carry a small invisible image that tells the CRM when an email is opened, and their links pass through our servers so clicks can be counted. Our email provider tells us when an email is delivered, bounces or is marked as spam, and the CRM stops marketing emails to anyone who unsubscribes, hard bounces or complains.

The CRM keeps a consent history for each contact: every time their marketing subscription changes, what it changed to, when, how (for example a ticked box on a form, the unsubscribe link in an email, or a team member), who made the change, and the wording the person saw. When the change is the person's own, such as ticking a box or unsubscribing, the history also keeps the IP address and browser used.

How we use personal data, and our lawful bases

For the data we control:

Providing the CRM, your account and billing: our contract with you
Keeping the service secure and preventing abuse, such as security records and limits on repeated requests: our legitimate interest in a safe, reliable service
Service and support messages, and answering what you send us: our contract with you, and our legitimate interest in helping you use the CRM
Improving the CRM from feedback and support requests: our legitimate interest
Keeping financial records: our legal obligations

We handle the data a business keeps in the CRM only to provide the service to that business, as its processor. We do not sell personal data or use it for advertising, and we make no automated decisions about people that have legal or similarly significant effects.

Who can see the data in an account

Only the people on the account's team. As part of our managed service, a business can add Kabooly to its team so we can help directly; we then see what any team member sees, and the business can remove us at any time. Otherwise, we look at the data in an account only when the business asks us to help with something, or where the law requires it.

The services we use

We use these providers to run the CRM. Each one handles personal data only to provide its service to us, under a contract that requires it to protect that data.

Supabase: the database, sign-in and file storage, hosted in Ireland
Cloudflare: hosting for the CRM and its API, and protection against attacks, on its worldwide network
Resend: sending the CRM's emails, and telling us whether they were delivered, in the United States
Stripe: subscriptions and payments, in the United States
Google: Google Calendar, when a user connects it; and YouTube video pictures, when a user adds a video to an email
Microsoft: Outlook calendar, when a user connects it
Meta: Facebook and Instagram lead ads, when a business connects a Facebook Page

Where data goes outside the UK, the transfer is protected by the UK's adequacy regulations (for the European Economic Area, including Ireland), by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or by the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

Calendar sync

Calendar sync is optional. Each user connects their own Google or Outlook calendar, and only after agreeing on Google's or Microsoft's own sign-in page.

What we read

the email address of the calendar account, to show which account is connected
your list of calendars, so you can choose one
the times your calendar shows as busy, so the booking widget never offers them. We do not read the content of your events

What we write

For each booking assigned to you, the CRM creates, updates or removes an event in the calendar you chose. The event holds the booking's title, time, location and description, and the guest's name, email address and phone, with the guest added as an attendee.

What we store

The connected account's email address, the calendar you chose, the access granted by Google or Microsoft (encrypted), and the IDs of the events the CRM created. Busy times are checked when needed and not stored.

Disconnecting

Disconnect at any time under Integrations → Calendar Sync. The stored access and connection details are deleted straight away, and we ask Google to end our access, unless another of your connections uses the same Google account. Events the CRM already created stay in your calendar. You can also remove Kabooly from the apps with access to your Google or Microsoft account, in that account's settings.

Kabooly CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use calendar data only to provide calendar sync, never for advertising, and never share it except as this section describes.

Facebook Lead Ads

Connecting a Facebook Page is optional, and is done by an admin of the business, who signs in to Facebook and chooses which Pages to connect.

What we access

the Pages you manage, so you can choose which to connect
access to each Page you connect, stored encrypted, to receive its new leads
the questions on the Page's lead forms, so you can match them to your contact fields
each lead's answers, when it was submitted, whether it came from Facebook or Instagram, and the names of the campaign, ad set and ad where Meta provides them

How we use it

Each lead becomes a contact, or updates one, in the business's own account, with every answer kept on the contact and in a note
The account's admins are told about each lead in the CRM and by email, and the business's automations can follow up, for example with a welcome email
Only the people on the business's team can see its leads, as described above
Lead data is never sold, used for advertising, or shared with other businesses

Disconnecting

Disconnect a Page under Integrations → Facebook Lead Ads. Its stored access is deleted and no new leads arrive. Leads already imported stay in the account until they are deleted; see data deletion.

Cookies and browser storage

The CRM sets no cookies. It keeps your sign-in, and a few choices such as light or dark mode and the account you last used, in your browser's local storage. The forms and booking widget it shows on a business's website, and the form code a business can put on its own pages, keep the visit's campaign tags in the browser's session storage until the tab is closed, so a lead can be credited to its campaign. A business that uses them is responsible for asking its visitors' consent where the law requires it.

How we keep data safe

Everything travels encrypted (HTTPS), and the database is encrypted at rest
Calendar and Facebook access is encrypted again before it is stored
Each account's data is kept apart from every other account's, and team roles limit what each person can do
Files are private, and their download links stop working after an hour
Users are signed out after 30 minutes without activity

Images added to emails, account logos and profile photos are stored at public addresses, because email apps have to load them without signing in. Do not put anything private in them.

How long we keep data

While an account is active: its data is kept until the business deletes it
After a business cancels: its data is kept for 90 days in case it comes back, then deleted. A week before, we email the account's admins the date. It can ask us to delete it sooner, and we will do so within one month
Deleted contacts: an admin can delete a contact for good, with everything linked to them. Only three things are kept: if they had unsubscribed, bounced or marked an email as spam, their email address, the reason and the date, so they are not emailed again; their place in campaign figures, with nothing that identifies them; and a record that a contact was deleted, when and by whom, without their name or email
Unsubscribes and consent history: kept for as long as the account exists, so there is a record of what the person agreed to and they are not emailed again after unsubscribing. Deleting a contact deletes their consent history, and keeps their unsubscribe as above
Short-lived records: password reset links last an hour and invitations 7 days. While you connect a calendar or a Facebook Page, the sign-in waiting for you to finish lasts an hour
Financial records: kept for 7 years, for our accounts
Backups: deleted data can stay in our backups for up to five weeks, until they are replaced

Your rights

You have the right to:

ask for a copy of your personal data
have inaccurate data corrected
have your data deleted
ask us to limit how we use it, or object to how we use it
take your data to another provider
withdraw any consent you have given

Email privacy@kabooly.com, and we will reply within one month. Account admins can download their data at any time from Settings → Export Data. How to delete data is set out on our data deletion page.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would welcome the chance to put it right first.

Children

Kabooly CRM is a tool for businesses and is not meant for children.

Changes to this policy

When this policy changes, we update the date at the top of this page, and we email account admins about any significant change before it takes effect.

Contact us

Email privacy@kabooly.com, or write to Kabooly Ltd, 23 Carisbrooke House, Seven Kings Way, Kingston Upon Thames, KT2 5BS, United Kingdom.