Custromix CRM Privacy Policy

This Privacy Policy explains how CUSTROMIX LIMITED handles personal information in connection with Custromix CRM, including accounts, customer workspaces, connected reporting and SAM AI assistance.

In this policy, Customer Data means information submitted, imported or generated on a customer's behalf through the service, including workspace content and AI outputs. Customer Personal Data means personal data processed on the customer's behalf. Our customer Data Processing Agreement (DPA) is Appendix 1 to our Terms and Conditions.

1 Who we are

Custromix CRM is operated by CUSTROMIX LIMITED, registered in England and Wales under company number 17414571, with its registered office at 174 Hammersmith Road, London W6 7JP, United Kingdom. In this policy, “Custromix”, “we”, “our” and “us” mean that company. Privacy questions, rights requests and complaints can be sent to support@custromix.com or by post to our registered office, marked for the Privacy Lead.

This policy covers our website, business enquiries, accounts, customer support and personal information processed through Custromix workspaces, including SAM AI assistance. It applies to relevant UK and EEA activities. An organisation using Custromix may also need to give you its own privacy notice. Where a data protection officer or EEA representative is required, their contact details will accompany this policy before the relevant processing begins.

2 Our role and your organisation

We are a controller for activities whose purposes and means we determine, including our own business enquiries, subscription administration, billing, necessary service security and handling legal matters. Section 5 explains the bases for those activities.

For personal information that a customer puts in a workspace or connects to the service, we generally act as that customer's processor under its instructions and the Data Processing Agreement in Appendix 1 to our Terms and Conditions. A customer acting for another controller must have authority to appoint us as a subprocessor. We do not become entitled to reuse workspace information for independent purposes merely because we host it.

The customer decides whose information to add, why it is needed, who can access it and which permitted workflows to enable. If your employer, supplier or another organisation placed your information in Custromix, contact that organisation about its processing. You may also contact us and we will route your request and assist the responsible customer. An administrator's acceptance of service terms does not provide consent on behalf of everyone mentioned in its records.

3 Information we process and where it comes from

Information can come from you, your organisation, authorised workspace users, customer-connected services and use of the website or service. Depending on the features used, it can include:

• Names, business contact details, organisation details, user identifiers, account membership and permissions, and information supplied by a chosen sign-in service.
• Subscription, invoicing and payment-status information, business correspondence and support requests. Payment processing, if offered, follows the payment arrangements disclosed at checkout; ordinary CRM fields are not a place for payment-card authentication details.
• Customer contacts, leads, linked board fields, messages, tasks, notes, campaign information, operational and financial records, and attachments submitted or imported by the customer.
• Prompts, tool inputs and results, AI-generated text or extracted fields, workflow instructions, approval records and execution outcomes.
• Technical information necessary for service operation and protection, which may include IP addresses, device or browser information, timestamps, authentication events, errors and usage records. The actual tracking technologies are identified in the accompanying cookie information.

For an uploaded receipt or invoice, the whole image or PDF can contain personal information, including names, addresses, bank details and transaction information. The whole submitted file is sent for AI extraction, even if only a few extracted values are saved in the final record. Submit only what the task requires.

Customer workspace information may concern people who have never opened a Custromix account. The responsible customer must explain its specific sources, purposes and disclosures to those people where required. We do not authorise undisclosed collection or scraping through this policy.

3A Connected stores and sales sources

Where included in your plan and released for use, Website Performance can connect supported websites, stores and sales sources, such as Shopify, WooCommerce, Wix, Webflow, Squarespace, Google Analytics purchase events or your own website's sales link. The connection reads paid orders or purchase events and refund updates where the source provides them, so the customer can view its own sales reports. A named platform is not a promise that every connector or function is available.

Where available and necessary for that reporting, imported records contain order numbers, dates and status; total, tax, shipping, discount and refunded amounts and currency; item names or codes, quantities and prices; the payment method name; and source or campaign information such as referral channels and campaign tags. A payment method name is not a payment-card number or authentication detail.

We do not add buyer names, email addresses, phone numbers, postal addresses or payment-card details to Website Performance order records. A source API may nevertheless include those fields in its response. Such information must be filtered out before those reporting records are stored and unnecessary copies must not be retained in application logs, error traces or other reporting derivatives. Order identifiers, purchase details and referral information can still be personal data even when direct buyer contact details are excluded. The exclusion concerns these reporting records; it does not say that a customer's other CRM records contain no contact information.

We process this information on the customer's instructions to provide its own sales reporting, with necessary contracted hosting and operational providers under the DPA. We do not sell it, use it for advertising or reuse it for another customer's reports. Connecting a reporting source does not by itself authorise an unrelated AI use, model training or another independent purpose. Any further enabled feature must have appropriate instructions, notices, permissions and provider safeguards.

Access keys and tokens for these connections are encrypted at rest and transmitted over encrypted HTTPS connections. The customer controls which permitted sources it connects. Imported Website Performance order records remain while the relevant sales source is connected, subject to earlier lawful deletion instructions. Disconnecting the source or deleting its workspace stops further authorised imports and triggers deletion of those imported order records and derived reports to the extent they contain the deleted source data, under the specific timing and residual-copy rules in Appendix 2 to our Terms and Conditions. Independently retained lawful CRM records are assessed separately.

If a Shopify app is removed, we act on the removal information and applicable compliance requests we receive. Shopify's shop-redaction request is normally sent 48 hours after removal; delivery may be later or affected by reinstallation. This describes Shopify's notification timing, not a promise of erasure exactly 48 hours after removal or a reason to postpone an earlier valid deletion instruction. We process verified redaction and access requests under the DPA and the shorter applicable contractual, platform or statutory deadline. If you are a store customer seeking access or deletion, contact the store first; we help it respond and also route requests received by us.

3B Website visitor information

When a customer adds the Custromix tracking code to its website, the code collects information about page views, link and button clicks, referral sources such as search engines or social networks, device category and visit times, to provide that customer's website traffic reports. Collection must exclude unnecessary personal information from page addresses, query strings, click labels and submitted content. The standard tracker is not intended to capture form contents, passwords or payment details.

The Custromix tracking code does not set cookies or write tracking identifiers to local storage or other persistent browser storage. To estimate unique visitors, it uses the visitor's IP address and browser information to create a protected identifier that changes each day. This requires processing the IP address even though raw IP addresses and names are not fields in the stored traffic event records. Any separate necessary infrastructure or security logs follow their own disclosed schedule. A rotating identifier is not a guarantee that information is anonymous; we protect it as personal data where applicable and do not use it to build cross-customer advertising profiles.

Visitor events are used to show the customer's own website traffic reports and are deleted no later than 13 months after collection. Removing the tracked website or deleting its workspace also triggers deletion of its visitor events and source-linked identifiable derivatives under Appendix 2 to our Terms and Conditions. The customer is generally the controller for its website visitor analytics and must provide the required information, identify a lawful basis and obtain any consent or provide an objection mechanism required for the actual technology and country. The absence of cookies does not automatically remove UK or EEA privacy or device-access obligations. Other trackers on the same website, and Custromix account sign-in technologies, require their own assessment and disclosures.

3C Google Analytics and Google Search Console

When an authorised customer connects the relevant Google account, we read its permitted Analytics and Search Console reports, such as visits, searches, page performance and search-result positions, and the account, property or site identifiers needed to display those reports in Custromix. Report retrieval uses read access. If the customer separately asks us to create, configure or verify an Analytics or Search Console resource during supported setup, we request only the additional permissions necessary for those disclosed actions. Permission to read a report is not general authority to change the customer's Google resources.

You can disconnect the integration in Custromix or revoke access through Google account settings. We stop future authorised access through the revoked connection; imported records follow the relevant deletion instructions and schedule, including the specific sales-source rule where the connection supplies Website Performance purchase events. Signing in to Custromix with Google does not itself authorise Analytics or Search Console access.

Custromix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used for the disclosed user-facing features, with transfers and human access limited to what the applicable Google policies permit. We do not use that information for advertising targeting or general-purpose AI model training. Neither an administrator's agreement nor this policy overrides Google's applicable data-use restrictions.

3D Keyword rankings

For a supported keyword-ranking feature, we send the customer-selected keywords and website address to a contracted search-data provider so it can return ranking information for that website. The ranking request does not include website visitor events, buyer records or customer contact information. Customers must not put unnecessary personal information into keywords or website addresses submitted for this feature. The provider's identity, locations and relevant safeguards are recorded in the applicable Service Processing Register.

4 SAM and automated workflows

SAM is an AI assistant that uses a contracted provider of hosted language-model inference and document extraction. For Records and Boards requests, the instruction and information returned by the tools used for the task are sent to that provider for processing. This can involve several record lookups in one workflow. For receipt or invoice extraction, the whole submitted image or PDF is sent to that provider, and a separate copy is held in Google Cloud Storage. The applicable provider's identity and processing arrangements are included in the Service Processing Register supplied to customers.

SAM can produce drafts, summaries, classifications, extracted values, recommendations, plans and permitted record changes. Outputs can be inaccurate, incomplete or misleading and may themselves be personal information. A source-record correction may not automatically update every saved summary, export or log; ask the workspace administrator or contact us for assistance.

SAM must operate within the applicable workspace, board, field and action permissions. Authorised automation policies may allow defined event-based or scheduled actions without a new prompt for each run. High-impact actions follow the product's human approval controls. Logs must not give an owner or administrator access to fields or boards they are otherwise prohibited from viewing. Our internal access is limited to authorised personnel performing permitted duties.

The standard service does not authorise solely automated decisions about people that produce legal or similarly significant effects, such as automated employment, credit or essential-service decisions. Such a use requires separate written agreement and the applicable legal and technical safeguards. If we introduce such decisions for our own purposes, we will provide the legally required information and safeguards before doing so. Relevant rights can include information about a decision, making representations, human intervention and contesting the outcome.

We do not use Customer Data to train general-purpose AI models or enable optional provider training or data-sharing programmes with it under the standard agreement. Our arrangements with AI processing providers must support this commitment. Training restrictions do not mean that no data is stored. Provider abuse-monitoring records, stored responses, uploaded files and caches may have different retention rules. We do not promise Zero Data Retention or UK-only or EEA-only processing.

5 Our controller purposes and lawful bases

The following explains our own controller activities. Processing workspace information on a customer's behalf instead follows that customer's documented instructions; the customer determines its lawful basis and any additional conditions.

Our legitimate interests must be balanced against individuals' rights and reasonable expectations. We do not rely on the customer's business contract as a contractual basis for every employee or contact. Access to workspace content for support or security remains subject to the DPA and purpose limits. A new independent use requires a separate role, necessity and lawful-basis assessment and appropriate information to affected people.

6 Sharing and service providers

Information may be shared with authorised people in the relevant customer workspace, our authorised personnel, and contracted providers where necessary for the described purposes. These include contracted providers of hosted language-model inference and document extraction, Google Cloud Storage for receipt and invoice storage, Firebase Hosting for hosting, Google for authentication, and Google Workspace for business email. Hostinger provides domain registration; domain registration alone does not mean it hosts CRM records.

Our Service Processing Register identifies the relevant legal entities, services, roles, locations and retention arrangements. It distinguishes subprocessors handling Customer Personal Data from providers used for our own administration and customer-selected integrations. We proactively provide the applicable register to customers before processing, keep it updated and readily available to them, and provide further information at support@custromix.com. Appointments and changes to subprocessors follow Appendix 1 to our Terms and Conditions. Describing a provider category in this policy does not restrict a right to obtain recipient identities where applicable law requires us to provide them.

Customer-connected platforms receive the information needed for the authorised connection and may have their own controller responsibilities and notices. We may also disclose necessary information to professional advisers, insurers, competent authorities or a business successor for a lawful purpose, with appropriate confidentiality and safeguards. We do not sell personal information or use Customer Data for cross-customer advertising profiles under the standard service.

7 Processing locations and overseas employees

Custromix is a UK company with authorised employees in the Philippines who may access live customer information for their duties. Access must be limited, confidential and protected under the security arrangements in Appendix 2 to our Terms and Conditions. Direct employees of the same legal entity are not described as a separate Philippine subprocessor merely because of their location.

Cloud, authentication, AI and email providers may process or permit access in other countries, including the United States where the applicable provider arrangements involve US processing. A hosting selection does not establish the location of authentication, AI, support or every backup. The Service Processing Register identifies the actual destinations and safeguards.

For restricted international transfers, we use a valid adequacy arrangement or appropriate contractual safeguards, such as the applicable EU Standard Contractual Clauses and UK Addendum or UK International Data Transfer Agreement, together with the required assessment and supplementary measures. We verify that a route covers the actual recipient and processing; a provider's brand or certification alone is insufficient. You can request information about safeguards or a copy, with necessary confidential details redacted, from our Privacy Lead.

8 Retention and deletion

Appendix 2 to our Terms and Conditions sets the service retention and deletion commitments. Workspace records are kept under the customer's instructions during the subscription and agreed exit period. The specific connected-source and visitor-event rules in sections 3A to 3D and Appendix 2 to our Terms and Conditions take priority for those categories. Raw AI prompts, tool contents and response bodies have a default maximum retention of 90 days from creation, with earlier deletion where the relevant source data is deleted. A supported customer-selected shorter period takes priority. Minimal execution and approval metadata may be kept for up to 12 months for traceability; it must not reproduce deleted source content.

Temporary Redis execution checkpoints expire after 60 minutes of inactivity. Activity can extend a checkpoint, so that is not an absolute maximum for every AI record. Deletion must also prevent affected active or resumed runs from reusing deleted information. Receipt and invoice source files in our Google Cloud Storage environment are deleted within seven calendar days after the corresponding authorised deletion instruction, rather than seven days after upload.

Custromix-controlled backup copies are put beyond ordinary use when deletion is applied and removed within the maximum 30-day backup cycle in Appendix 2 to our Terms and Conditions. If a backup is restored, deletion instructions must be reapplied before ordinary use. Provider-managed copies follow the verified provider-specific schedule; these are not covered by an unconditional promise of immediate deletion from every provider's systems.

AI processing provider storage follows the provider-specific retention and deletion arrangements disclosed in the Service Processing Register. Different rules can apply to abuse-monitoring records, stored responses, uploaded files and caches; deleting a CRM record does not necessarily erase every provider-held copy at the same time. We apply supported provider deletion or expiry controls and disclose material residual retention in the Service Processing Register.

For our own controller information, the default schedule is:

• Account administration records: while needed for the active account and up to 90 days after closure, apart from separately justified billing, security, contractual or legal records.
• Billing and mandatory company tax/accounting records: normally six years after the end of the relevant company financial year, or longer where the applicable requirement requires it.
• Routine support correspondence: up to 24 months after closure of the issue. Unnecessary attached workspace content is removed sooner under the applicable service deletion rule.
• Security event records: up to 12 months from the event, unless a specific incident or legal obligation requires a documented extension. Raw Customer Data is not retained under that label by default.
• Unconverted business enquiries and prospect records: up to 12 months after the last meaningful interaction, unless continued retention is justified and communicated.
• Minimal evidence of objections or opt-outs: as long as needed to honour the preference, reviewed at least annually, with unnecessary contact history removed.
• Contract, privacy request, complaint and legal-claim records: only the relevant evidence, normally up to six years after the relationship or matter ends, subject to a documented shorter period or specific legal requirement or hold.

These are maximum defaults, not a requirement to retain every item for the whole period. We restrict any specific legal hold to the necessary information, review it and delete when the justification ends. A general desire to keep an audit trail does not justify indefinite retention of raw personal information.

An authorised customer can request deletion or use available controls. Removing a user account does not automatically delete all business records about that person; the responsible controller determines which records must be removed or retained lawfully. Deleting data in Custromix cannot recall a delivered message or erase a copy independently controlled by a recipient. Our own copies and subprocessors remain subject to our legal and contractual duties.

9 Security and incident handling

We apply technical and organisational measures appropriate to the nature and risks of processing, including the contractual measures in Appendix 2 to our Terms and Conditions. Access must be limited by role and workspace permissions, with authorised internal access, confidentiality obligations and appropriate review. No service can promise complete security. We do not claim an independent certification of Custromix merely because a supplier holds one.

We investigate and respond to suspected incidents. For Customer Personal Data, we notify and assist the responsible customer under the DPA. For our controller activities, we meet our own applicable regulator and individual notification duties. This policy does not shift those duties to customers.

10 Sensitive information and children

The service is for business organisations and authorised adult users aged 18 or over. The standard subscription does not permit special-category data, criminal-offence data or children's personal information without a separate written arrangement and appropriate safeguards. This restriction includes such information in attachments, free-text fields, messages or AI prompts. A school, healthcare or other industry template does not approve those uses.

If restricted information is submitted unexpectedly, notify us promptly so we can help contain access and arrange lawful handling. We do not treat accidental receipt as consent to continue processing it. The responsible organisation must identify any additional lawful conditions, notices and sector requirements before an approved restricted use begins.

11 Your rights and how to use them

Subject to applicable law and the circumstances, you may request access, correction, erasure, restriction and portability of personal information, and exercise applicable safeguards concerning significant automated decisions. You may object on grounds relating to your situation to processing based on legitimate interests. You can object to direct marketing at any time, including related profiling, by contacting us or using the unsubscribe control. Where consent is used, you may withdraw it without affecting processing that was lawful before withdrawal.

Contact support@custromix.com. We may ask for proportionate verification of identity and authority. We normally respond to rights requests within one month, with any legally permitted extension or adjustment explained under the applicable law. Requests are normally free; we will explain any charge or refusal allowed by law. A complaint acknowledgement period is separate from the time limit for responding to a rights request.

For Customer Personal Data, we pass the request to or coordinate with the responsible controller. Our processor role does not remove our assistance duties or any direct statutory responsibility. A requester is not entitled to another person's information merely because they administer a workspace.

12 Cookies and marketing choices

The cookie information accompanying this policy identifies the actual cookies and similar storage or tracking technologies used on our website and application, their providers, purposes and durations, and how to change choices. Where consent is required, the technology must not run before consent. Where a legal exemption is relied on, the relevant conditions and any required objection control must be met. EEA tracking and electronic marketing rules are assessed for the countries and channels concerned.

Accepting service terms does not consent to optional tracking or marketing. Optional choices must be as easy to withdraw as to give. Browser controls can affect some storage; disabling essential authentication or security storage may prevent parts of the service from working. Necessary account, security and billing messages may still be sent when marketing is declined. We do not treat an installed Firebase service as evidence that Google Analytics is enabled.

13 Information you must provide

We identify information necessary to create or administer an account, provide a chosen feature or comply with a legal requirement. Without it, we may be unable to provide that account or feature. Optional information and permissions should be identified at collection. The customer controls its workplace requirements, integrations and permitted features. The effects of disconnecting an integration or disabling a feature must be explained through the relevant controls or by support.

14 Complaints

You can complain about our handling of personal information by emailing support@custromix.com or writing to the Privacy Lead at our registered office. Explain the concern and the outcome you seek; please avoid including unnecessary sensitive information. We acknowledge data protection complaints within 30 calendar days, investigate and take appropriate steps without undue delay, keep you informed and explain the outcome and any corrective action. Investigation begins on receipt; the acknowledgement period is not permission to postpone it.

You may also complain to a competent supervisory authority. For UK matters, see https://ico.org.uk/make-a-complaint/. In the EEA, you may complain to the authority in the country of your habitual residence, work or the alleged infringement, as applicable; the EDPB lists authorities at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. Our internal process does not remove your regulatory or court rights.

15 Changes to this policy

We publish the current policy with its revision date and provide appropriate notice of material changes through the service or the account contact. A new purpose, lawful basis, consent requirement or contractual change must be addressed separately where required. Updating this policy does not itself provide consent or expand our contractual permission to use Customer Data.