Privacy Policy
How Crimson collects, uses, and protects information.
Information we collect
Account details you provide, workspace data you import or create, and technical logs required to operate and secure the service.
How we use it
To provide the platform, deliver messages you send, support your team, and improve reliability. We do not sell personal information.
Data retention and deletion
Workspace data is retained while your account is active. On request we delete workspace data within thirty days, excluding records we must keep for legal or billing purposes.
Google Workspace and Gmail integration
When an authorized user connects a Google account, Crimson uses Google user data only to provide CRM communication, email synchronization, and email delivery features. Crimson currently requests the following Google permissions: openid, email, profile, gmail.send, and gmail.readonly.
Google data we access and how we use it
With gmail.readonly, Crimson may access sender and recipient information, CC information where applicable, subject lines, timestamps, Gmail message and thread identifiers, Message-ID and threading references where applicable, and plain-text and HTML message content. We use this information to synchronize customer communications, display conversations inside Crimson, associate messages with CRM contacts and conversations, preserve thread context, and identify and display inbound replies. With gmail.send, Crimson transmits user-authored emails and replies, recipient addresses, and attachments where applicable. These messages are sent through the authorized user's own Google account.
Security and OAuth credentials
Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM, and the encryption keys are stored separately in secured environment secrets. Access to workspace data is restricted by workspace isolation enforced in the database through row-level security. Data in transit is protected using HTTPS/TLS.
Disconnecting Gmail, retention, and deletion
Users can disconnect Gmail at any time from Crimson's Sending settings, and may separately revoke access through their Google Account permissions page. When a mailbox is disconnected, Crimson immediately deletes the stored Google OAuth access and refresh tokens for that mailbox and stops sending and synchronizing through it. Email messages already synchronized into CRM conversations remain part of the workspace's records and are retained and deleted under the retention and deletion terms described above, including deletion on request.
Prohibited uses of Google data
Crimson does not sell Google user data, does not use Google user data for targeted, retargeted, personalized, or interest-based advertising, and does not transfer Google user data to data brokers. We transfer Google user data to third parties only as necessary to provide user-facing Crimson features, to comply with applicable law, or as explicitly instructed or consented to by the user.
Human access to Google data
Crimson personnel do not read Google-derived message content except where the user gives explicit consent for specific messages (for example, to resolve a support request), where necessary for security purposes such as investigating abuse or a vulnerability, or where required to comply with applicable law. Members of your own workspace can view synchronized conversations according to the access your workspace grants them.
AI-assisted features
Crimson includes optional AI-assisted features such as conversation summarization, reply drafting, and suggested next actions where applicable. When a user invokes one of these features, relevant conversation content may be transmitted to Crimson's AI processing provider solely to generate the requested result. Crimson does not use Google user data to train, retrain, or fine-tune generalized AI or machine learning models.
Google API Services User Data Policy
Crimson’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
SMS and mobile information
Crimson is a CRM platform that businesses use to text their own contacts. Mobile phone numbers and SMS consent or opt-in information are not sold, and are not shared with third parties or affiliates for their marketing or promotional purposes. SMS consent information is used only to deliver the messaging the contact agreed to and for related operational purposes, such as honoring STOP and HELP requests, keeping consent records, and preventing abuse. When we share mobile information with service providers, such as the telecommunications provider that delivers messages, we share only what is needed to provide the service, and those providers must protect it under applicable privacy and security obligations. Each business using Crimson is responsible for obtaining and documenting consent from the people it texts. Contacts can reply STOP to any message to opt out, or HELP for help.
Contact
Privacy questions can be sent to hello@gocrimson.io.