Privacy policy
How Subul CRM collects, uses and protects personal data — on our website and inside customer workspaces.1About this policy
This Privacy Policy explains how [COMPANY LEGAL NAME] (“Subul CRM”, “we”) collects, uses and protects personal data when you visit our websites, request a demo or use the Subul CRM platform and mobile apps (the “Services”).
It applies to visitors, trial users, account administrators and users invited to a customer workspace. It does not cover third-party sites or services you connect to Subul CRM.
2Our role: controller and processor
Controller: we decide how and why personal data is processed for our own website, marketing, billing and account administration — for example your sign-up details and demo requests.
Processor: for the data our customers (“tenants”) load into their workspaces — leads, contacts, follow-up notes, call outcomes — the customer is the controller, and we process it only on their documented instructions, as set out in our Data Processing Agreement.
If you are a lead or contact of one of our customers, please send requests about your data to that business first; we will help them respond.
3Data we collect
We collect only what we need to provide and improve the Services:
4How and why we use it
To create and secure accounts, run the Services, provide support and send service messages (performance of contract).
To improve reliability, measure feature usage and prevent abuse (legitimate interests).
To send product news and marketing only where you agreed or the law allows; you can opt out at any time (consent / legitimate interests).
To meet legal, tax and accounting obligations (legal obligation). [Confirm the legal bases for each jurisdiction with counsel.]
5Tenant data ownership
Customers own their workspace data. We do not sell it, rent it or use it to market to their leads or contacts.
Each workspace is logically isolated. Our staff access customer data only to provide support the customer requests, to keep the service secure, or when required by law — and every such access is logged.
Customers can export their data at any time in standard formats (CSV, Excel, API) and ask us to delete it when they leave.
6AI processing
Subul CRM offers AI features such as classifying follow-up comments into structured attributes, summarising activity and drafting performance reviews. These features process workspace content only to produce results for that customer.
Customer data is not used to train our or our providers’ general-purpose AI models. [Confirm with legal and with each AI provider contract before publishing.]
AI outputs are suggestions: users review and approve them, a confidence level is shown with each one, and administrators can switch AI features off per workspace.
AI providers acting as our subprocessors are bound by data-processing terms, are listed in Section 7, and run with [zero-retention / limited-retention — confirm] settings.
7Subprocessors and sharing
We share personal data only with service providers that help us run the Services, under written agreements that require confidentiality and security. The current list is below and at [SUBPROCESSOR LIST URL].
We may also disclose data when required by law, to protect rights and safety, or as part of a merger or acquisition, with notice to customers.
8International transfers
Our primary hosting region is [REGION — e.g. EU / KSA / UAE]. Where data crosses borders we use appropriate safeguards, such as standard contractual clauses or equivalent mechanisms recognised by applicable law [Egypt PDPL, KSA PDPL, UAE PDPL, GDPR — confirm].
9Retention
Workspace data is kept while the customer’s subscription is active, then deleted or anonymised within 30 days of termination unless the customer exports it or the law requires longer storage.
Backups are overwritten on a rolling 35-day cycle. Account and billing records are kept for 5 years for tax and accounting purposes.
Website analytics data is kept for up to 13 months.
10Security
We use encryption in transit (TLS) and at rest, role-based access, multi-factor authentication, audit logs and regular testing. See our Security page for details.
If a personal data breach affects you or your customers, we will notify the affected customer without undue delay and within the timeframe required by law and the DPA.
11Your rights and requests
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent.
To make a request, email [EMAIL] with the subject “Privacy request”. We will verify your identity and reply within [30] days. If your data sits in a customer workspace, we will pass your request to that customer.
You can also complain to your local data protection authority.
12Children
The Services are built for businesses and are not directed to children under [16]. We do not knowingly collect their personal data.
13Changes and contact
We post updates on this page and change the “Last updated” date; account administrators are told about material changes in advance.
Questions: [EMAIL] · [COMPANY LEGAL NAME], [REGISTERED ADDRESS] · Data protection officer: [DPO CONTACT].