Privacy Policy

1. Information we collect

• Account & workspace data — name, email address, role, workspace name and identifiers, authentication data.
• CRM data you enter — contacts, companies, deals, tasks, notes and comments you create in the Service.
• Connected-channel message data — inbound messages and sender identity from the channels you connect (Telegram, WhatsApp, email/Gmail, Shopify), so they appear in your unified inbox.
• Google / Gmail data— when you connect a Gmail mailbox, we read only messages you have labeled with the "YCRM" label. From those messages we import the sender address and name, subject, plain-text body and thread identifier. We request read-only access; we do not send email on your behalf.
• Usage & technical data — application logs, and IP addresses used transiently for security and rate-limiting. We do not use third-party advertising trackers.

2. How we use data

• To provide the Service: unified inbox, CRM records, notifications, search and related features.
• To match incoming messages to the correct contact, or create a contact when none exists.
• To secure the Service, prevent abuse, and maintain reliability (logging, rate-limiting).
• To provide support and communicate service-related messages.

3. Google user data & Limited Use

CLIENTMIND's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for data obtained from your Gmail mailbox via the Gmail API:

• We access only messages you label with “YCRM”, with read-only permission (gmail.readonly).
• We use this data solely to provide the user-facing Email Inbox feature (showing your labeled emails in the CRM and linking senders to contacts).
• We do not use Gmail data for advertising, and we do not sell it.
• We do not use Gmail data to train generalized or standalone AI/ML models.
• We do not transfer Gmail data to others except as necessary to provide or improve the feature, to comply with applicable law, or as part of a merger or acquisition — and only with adequate safeguards.
• Humans do not read your Gmail data except with your consent for specific messages, where necessary for security or abuse investigations, to comply with law, or in aggregated/anonymized form for internal operations, as permitted by the Limited Use policy.
• You can disconnect a mailbox at any time in Settings; this stops further access. You can also revoke access at myaccount.google.com/permissions.

4. Legal bases (EEA/UK)

Where the GDPR applies, we process personal data on the following bases: performance of a contract (providing the Service to you), our legitimate interests (securing and improving the Service), and consent where required (for example, connecting a mailbox or channel). You are responsible for having a lawful basis to import third-party personal data (such as your customers' contact details and messages) into the Service.

5. Service providers & sub-processors

We share data with vetted providers only to run the Service. Confirm this list matches current use:

• Supabase — database, authentication and file storage (EU region).
• Vercel — application hosting and serverless execution.
• Google — Gmail API for connected mailboxes.
• Meta / WhatsApp — WhatsApp Business Cloud API for connected numbers.
• Shopify — commerce data for connected stores.
• Resend — transactional email delivery (e.g. password reset, invitations).
• Axiom — application log storage for monitoring.

6. Storage & international transfers

Primary data is stored in the European Union (eu-west-1). Some providers listed above may process data outside the EEA; where they do, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses. Provider-issued tokens are encrypted at rest.

7. Retention & deletion

• We retain account and workspace data while your account is active.
• Audit records are retained for approximately 365 days.
• Disconnecting a channel or mailbox stops further data collection from it; previously imported messages remain in your workspace until deleted.
• You may request deletion of your workspace data by contacting us (see “Contact”). We will delete or anonymize data within a reasonable period, subject to legal retention obligations.

8. Your rights

Subject to applicable law, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You may also withdraw consent and lodge a complaint with a supervisory authority (in Cyprus, the Office of the Commissioner for Personal Data Protection). To exercise these rights, contact us at seo@yourshield.com.cy.

9. Security

We apply technical and organizational measures including encryption in transit, tenant isolation with row-level security, encryption of provider tokens at rest, and signature verification on inbound webhooks. No method of transmission or storage is completely secure, but we work to protect your data.

10. Cookies

Inside the authenticated application we use strictly necessary cookies for authentication and session management. On our public marketing website we may use Google Analytics (GA4) and the Meta Pixel — but only after you give explicit consent through the cookie banner. If you decline, these are not loaded. You can change your choice by clearing the site's local storage. We do not use cross-site advertising trackers inside the app.

11. Children

The Service is intended for business use and is not directed to children under 16.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

13. Contact

Yourshield Solutions LTD, Nikou Pattihi 105, Limassol, Cyprus. Questions or requests: seo@yourshield.com.cy.