Privacy Policy

Who we are

This notice is given by CRM Forge (AlgoForgeX LLC, a Texas limited liability company), whose registered address is 13423 Blanco Road, San Antonio, TX 78216, USA. Where this notice says we or us, it means that entity.

Our representative for data protection matters in the European Union and the United Kingdom: No representative is appointed in the European Union or the United Kingdom: the controller is established in the United States and does not offer the service to persons in the European Union or the United Kingdom at this time..

The two different roles we have

We are the controller of the information about you as a user of this product: your account, what you agreed to, how you use the service and what it costs.

We are a processor for the information you put into your workspace about other people, such as your contacts and the companies you sell to. For that information you decide what is collected and why, we act on your instructions, and the section below on a data processing addendum is how you put those instructions in writing.

That includes what our AI research brings into your workspace when you ask it to: the names and job titles of people named on a company's own web pages and, where this product is set to collect them and that company's own site prints one for the person, their work email address. Those pages are ones the research fetched itself or, where pasting a page is switched on, the text of a page on that company's own site that a member of your workspace copied and pasted into this product. Nothing is added until a person in your workspace accepts it. When it finds the people named on a company's own pages, each new contact it adds records the page that named them and the date that page was read, and each email address it adds records the page that printed it. A new contact added from a pasted page also records that the page was pasted, the date it was pasted, and the member of your workspace who accepted them. When you accept a prospect it proposes and a new contact comes with it, that contact records the page the research gave as its evidence for the prospect, which may describe the company rather than name the person, and the date the research ran. These records are there so that you can tell somebody where you got their details.

If you put one of your workspace's web forms on your website, we receive what your visitors type into it on your behalf, as your processor: the answers to the questions you chose to ask, the consent statement your form printed and whether they ticked it, and when their answers arrived. Their internet address is used to limit how often one address can send, and it is not stored with their answers. The form's page tells them that their answers go to your workspace, by name. What they send becomes a lead, or joins the one they already have from that form, for a person in your workspace to review. It is added to the history of any record it matches, and it never changes a detail already recorded on one.

If you send one of your workspace's quotes to a customer where quote pages are switched on, its link opens the quote on a page of this site, and we receive their answer on your behalf, as your processor: whether they accepted or declined it, the name they typed, the reason they gave for declining if they gave one, which version of the quote they were shown, and when they answered. Their internet address is used to limit how often one address can open, download or answer a quote, and it is not stored with their answer; nothing about their device is kept. The quote's page tells them that their answer goes to your workspace, by name, and once they have answered it shows the day and never the name they typed. Their answer is added to the history of the deal the quote was made from, for a person in your workspace to act on.

If you are not a user of this product but one of our customers holds your details, for example because your employer's website names you, that customer decides what it holds about you and is the one to ask. We act on its instructions.

What we collect about you

Your account: the name and email address you give us, a hashed password, whether you confirmed your address, the version of the terms you accepted and when, whether you opted in to marketing messages and when, and the times you signed in.

Your profile: a display name and a profile picture, both optional, and collected only where the profile features are switched on for the service you are using. If you set either, colleagues in a workspace you share with them can see it, and so can the people who operate this service. Where those features are switched on you can change or remove either of them at any time from your account, and removing a picture deletes it.

Your workspaces: the records you create or import, the notes and tasks you write, and the activity history the product keeps of what changed and when.

When you open a record, and when you open your dashboard, the product keeps the time of your current visit and of the one before it, for you alone, so it can tell you what changed since; it keeps no other record of what you opened.

Your usage of AI features: which feature ran, which model answered, how many tokens it used, how long it took and what it cost. This is what your credit balance is calculated from and it is what an operator sees on the usage page.

Billing: your plan, seat count and payment result. Card details are entered on the payment processor's own page and never reach this product.

Fault records: when something fails, we record the error, the page it happened on and enough context to fix it.

Searches you start from the command palette: the words you searched for appear in the page address, so they are kept in your own browser's history like any other address, and they reach our hosting provider's request logs if you reload or share that address.

Visits to this public site: the page path, the referring address and the day, counted as a daily total. No cookie, no identifier and no record of an individual visit.

Cookies and what is stored in your browser

These public pages set one cookie, and only one. While the contact form is switched on, opening the contact page gives your browser an anti-forgery token, so that a message sent to us can be checked as coming from the form you filled in. It carries no identifier, it tells us nothing about you, it is never read for advertising or analytics, and no other page on this site sets anything at all.

There is no analytics script, no advertising tag and no third party embedded in these pages, which is why you are not being asked to consent to anything to read them.

A web form one of our customers puts on its own website opens at an address on this site. It sets no cookie and runs no script, whether you open it, send it or read its thank-you page.

A quote one of our customers sends you opens at an address on this site. It sets no cookie and runs no script, whether you open it, answer it or download its PDF.

Once you sign in, the application sets four things, all of them necessary for it to work: a sign-in cookie that keeps you signed in, an anti-forgery token that stops a form being submitted from somewhere else, a hint recording which workspace you last used, and a hint recording whether you chose the light or the dark theme; and our hosting provider's load balancer sets a routing cookie that pins your session to one server. None of them is used for advertising and none of them is shared.

The application also keeps a few display choices in your browser's own storage, so that a page opens the way you left it: which pipeline the deal board was showing, which tab of your saved draft starters you last opened, whether the dashboard's AI insight was left open and, where more than one email design is switched on, the email template you last drafted with. They stay in your browser: the application reads them back only to lay a page out, keeps none of them on its side and shares none of them, and clearing this site's data in your browser removes them.

Why we use it, and on what basis

To provide the service you asked for, which covers your account, your workspaces and everything you do inside them. That is performance of our contract with you.

To keep the service working and safe: rate limits, abuse controls, error diagnosis and backups. That is our legitimate interest in running a service that stays up and is not abused.

To take payment and keep the records tax law requires. That is a legal obligation.

To send you marketing messages, if and only if you opted in. That is your consent, and the section below says how to take it back.

Marketing messages and how to withdraw consent

The marketing opt-in on the registration form is a separate, unticked box. Nothing about creating an account opts you in, and declining it changes nothing else.

You can withdraw that consent at any time, and it is as easy to withdraw as it was to give: reply to any marketing message we send you and say so, or write to us at the address on our contact page. We record the withdrawal and stop.

Withdrawing marketing consent does not stop the messages the service has to send you to work, such as address confirmation, password resets and billing receipts. Those are part of the contract rather than marketing, and they stop when your account does.

Account mail we send you (a confirmation, a password reset) is queued until it is accepted for delivery and then kept for a week as a record of what was sent; deleting your account deletes those records. A message can very occasionally be sent twice.

Who else processes your information

We use a small number of other companies to run this product: a hosting platform, a mail service, an AI provider, a payment processor and a map service. Each of them is named on our sub-processor page, with what they do, what reaches them and where.

Two of those are worth stating here. Our mail is sent through Azure Communication Services, whose data location is set to the United States, so the content of a message we send you is processed there. Our AI calls are answered by Anthropic, whose commercial terms say your content is not used to train their models.

One more works differently, and it is worth being plain about. Where the interactive map is switched on for the service you are using, the map's background imagery is fetched by your own browser directly from OpenFreeMap, a service operated from Hungary. That tells them which map tiles you asked for, which is the part of the world on your screen. When the map first opens that is the wide region your own records sit in, because it opens fitted around them - or around the one company a link named, at the same width, when you came from a link to a single company. Either way that first view is a region rather than a street. After that it is wherever you move the map to, which can be as close as a single street if you zoom in yourself or press "Zoom to this company" beside a company you have picked: the tiles fetched then are the ones you asked for. It also tells them your internet address, which any site your browser fetches from receives. Nothing else about your workspace goes with it: no company, no contact, no address and no marker. Your companies and their positions are drawn by this product, on top of that imagery, and are never sent to them. The request carries no cookie of ours, and they state that they set none of their own.

If you connect your own mailbox to send outreach from, the messages you send through this product leave from that mailbox, so the company that holds it - Microsoft for a Microsoft 365 mailbox, Google for a Google one - receives and processes them as it does the rest of your mail, under the terms you already have with it. We do not appoint that company, and our sub-processor page lists it separately, as one you choose.

If you connect a Google account, this product receives from Google the account's email address, whether the account belongs to a Google Workspace organization, Google's permission to send mail from it and, for each message it sends, the identifiers Gmail gives that message and its conversation. The answer that carries the address also carries the account's Google identifier, which this product does not keep. It reads none of your mail: it cannot read, list, search or delete any message, including the ones it sent. It stores the address, which kind of account it is, the permission Google granted, a refresh token, which is encrypted before it is stored, the error code Google gives if it stops honoring that permission, and, on each message sent, the identifiers Gmail gave it. It uses them only to send the messages you send through it and to show you what became of them. It sends nothing it receives from Google to any AI model, and it does not sell or share it: the address appears only as the sender of the messages you send and to the members of the workspace you connected it for. Disconnecting the mailbox here deletes the stored token; the messages already sent keep their identifiers. To withdraw the permission from Google itself, remove this application under your Google Account's third-party access.

This product's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

Where your information is held

In the United States. The application runs in the West US 2 region of Microsoft Azure and its database and secrets are in Central US. If you are outside the United States, using this product means your information is transferred there.

How long we keep it

Your account and workspace data for as long as you have an account. Once a workspace is deleted, for 30 days in which the deletion can be canceled and the workspace restored, and then until our backups age out. The workspace's sending-mailbox connections are the exception: they are deleted when the deletion is requested, and a cancel does not restore them.

Billing and tax records for as long as tax law requires, which is longer than your account.

Fault records are kept for a limited period, measured in weeks rather than years, except a fault still under investigation, which is kept until it is resolved and then for up to 180 days.

The public site's daily visit counts for a limited period, measured in weeks rather than years.

Your rights

You can ask us for a copy of your information, ask us to correct it, ask us to delete it, ask for it in a portable format, object to a use of it, or withdraw a consent you gave. Two of those you can do yourself right now: signed in, the personal data page in your account settings downloads your data and deletes your account.

For anything else, write to us at the address on our contact page. We answer within one month. If you are unhappy with the answer you can complain to your data protection supervisory authority.

Deleting your account is refused in three cases, and only these: while you are the only owner of a workspace that other people are in; while you are the only owner of a billing account that other people are on; and while a billing account that is yours alone has a subscription that will renew. The first two would leave people with records and a balance nobody could manage, and the third a card that would be charged again with nobody left who could stop it. A workspace or a billing account that nobody else is in does not stop you: the workspace is closed when you go.

The refusal names what to do first. For a workspace or a billing account other people are in, make somebody else an owner of it. For a subscription, cancel it on your billing page; once the cancellation is scheduled you can delete your account, and the subscription runs to the end of the period you have paid for and then stops. Deleting your account does not cancel it for you.

If you are a California resident, the rights above cover the requests the CCPA gives you. We do not sell or share personal information, so there is no opt-out for us to offer you.

A data processing addendum

Where we process your customers' information on your behalf, a data processing addendum is available on request. Write to us at the address on our contact page and we will send you one to sign.

AI features and automated decisions

AI features run when you ask for them. What they send is the records the feature is working on and, where an Admin or Owner has written them, the workspace's own descriptions of what it offers and what it is for. Research features also ask our AI provider to retrieve public web pages, such as a company's own website, and what comes back can include the names and work details of people those pages name. Where pasting a page is switched on, a member can instead paste the text of a company's own page into this product to find the people it names; that text is sent to our AI provider, used while the read runs, and not stored, logged or kept afterwards. What comes back is a draft, a summary, a set of findings or a list of proposed people that you read and accept before anything is written to a record or sent to anybody.

Where asking the guides is switched on, a question you type is sent to our AI provider with the parts of this product's own guides chosen to answer it, and no record. The question is never logged or written to our database: it is held in our server's memory with its answer for up to an hour, for you alone, so that the same question asked again in that time, of the same guides, is answered at no charge. Once the hour has passed, or the service has restarted, the question and its answer are gone, and asking again is charged.

One feature runs on a standing request rather than on each press: where the weekly summary email is switched on, a member who switches on the assistant's reading in it has it written once a week until they switch it off. It sends our AI provider that week's figures with the workspace's name, time zone and its pipelines' names and stages, and never a follow-up, a note or a contact detail.

Nothing in this product makes a decision about a person automatically and acts on it. A person is always the one who accepts a finding, sends a message or changes a record.

Where writing to a firm's contact form is switched on for the service you are using, reading that form sends our AI provider the address of the firm's public web page, and the provider's own tool fetches that page from the firm's site. Its text is used while the read runs, to check which fields the form really has, and it is not stored, logged or kept afterwards. Drafting the answers, or a message for a form you write into yourself, sends the form's fields where you saved them and the records you are writing from, and never your own name or email address: this product fills those in after the assistant has answered.

This product never submits a form to anybody. You submit it yourself, in your own browser. What is kept in your workspace is the form's fields and page address if you save them, and what you log: the message as it was drafted, the page it was written into and the day, on the firm's timeline.

Where research is set to keep the email addresses a firm's own pages print, an address is kept only when a page fetched from that firm's own site prints it, on that site's domain or, on another domain, under the page's own contact label with no other organization named beside it, together with the label the page gives it. An address kept from another domain reaches a record only when a person chooses it.

Security

Each workspace is isolated from every other one in the data layer, on every read and every write, and that isolation is checked by a test suite that has to pass before anything ships. Secrets are held in a managed key vault, connections are encrypted, and sign-in cookies are protected by a key ring the application does not keep on disk.

Children

This product is for business use and is not directed at children. Do not create an account if you are under 16.

Changes to this notice

This notice carries a version and an effective date at the top. When it changes materially we tell account owners before the new version takes effect.

How to reach us about your information

Our contact page lists every way to reach us. Use any of them to exercise the rights above, to withdraw marketing consent, or to ask for a data processing addendum.

Contact us

By post: 13423 Blanco Road, San Antonio, TX 78216, USA.