Privacy Policy

1. Who we are

Thinkweb CRM is operated by Thinkweb Digital (“Thinkweb,” “we,” “us”). It is a business tool sold to organizations. Accounts are created and managed by an organization administrator; the app is not offered to consumers and has no public sign-up.

This distinction matters for how data is handled. For information about the people who work at a customer organization and log into the app, we are the controller. For the business records those people store in the app — their own clients, deals, and jobs — we act as a processor on that organization’s behalf, and the organization remains the controller.

2. What we collect

We collect only what the product needs to function. Specifically:

• Account information. Your name, email address, organization membership, and role. This is how we authenticate you and decide what you are permitted to see.
• Business records you enter. Contacts, companies, deals, activities, quotes, invoices, tickets, expenses, and any notes or files you attach. This content belongs to your organization, not to us.
• Photos and documents you choose to upload. Business card scans, receipt photos, and file attachments. These are only read when you explicitly select or capture them. We do not scan your photo library in the background.
• Device push token. If you enable notifications, an anonymous token that lets us deliver alerts to your device. It is not tied to advertising and cannot be used to identify you outside the app.
• Basic operational logs. Timestamps and error diagnostics used to keep the service running and investigate faults.

3. What we deliberately do not do

• We do not sell or rent personal information to anyone, ever.
• We do not use your data for advertising, and we do not embed advertising or tracking SDKs.
• We do not track you across other companies’ apps or websites.
• We do not use your business records to train machine learning models.
• The app contains no third-party analytics or attribution services.

4. Face ID and biometrics

The mobile app can be locked behind Face ID or Touch ID. This check is performed entirely by iOS on your device. Apple never shares the underlying biometric data with apps, and Thinkweb therefore never receives, transmits, or stores it. We only receive a yes-or-no result indicating whether the unlock succeeded.

5. Where your data lives and how it is protected

Application data is stored in Supabase (PostgreSQL), hosted on Amazon Web Services in the United States. Traffic between the app and our servers is encrypted in transit with TLS, and data is encrypted at rest by the hosting provider.

Access is enforced at the database level with row-level security, so a signed-in user can only reach records belonging to their own organization. This is enforced by the server, not merely hidden in the interface.

The mobile app keeps a local cache so it remains usable offline, and stores your session in the device’s system keychain (iOS Keychain / Android Keystore). Please note that the offline cache itself relies on your device’s own disk encryption — we recommend keeping a device passcode enabled.

6. Service providers

We share data only with vendors required to operate the service, and only to the extent they need it:

• Supabase / Amazon Web Services — database, authentication, and file storage.
• Expo — delivery of push notifications to your device.
• Vercel — hosting for the web application.
• Stripe — payment processing for invoices and subscription billing.
• Intuit (QuickBooks Online) — when your organization connects QuickBooks, we send the customer, invoice, and payment records needed to keep your books in sync. This happens only for organizations that enable the integration, and only for records you choose to send.

We may also disclose information where we are legally compelled to, or where it is necessary to investigate a security incident or enforce our terms.

7. How long we keep it

Data belonging to your organization. The contacts, deals, activities, and files you store in the app are retained in full for as long as your account is active — a CRM is only useful because it keeps its history, and we never age records out from under you. Following termination we retain that data for 30 days, during which you may request an export; after that it is permanently deleted. This matches the commitment in our Terms of Service and Data Processing Agreement.

Our own business records. Separately from the above, invoices, payment records, and correspondence relating to your subscription are our own accounting records rather than data we process on your behalf. We retain these for seven years to meet tax, accounting, and audit obligations, and we may retain records for longer where we are required to preserve them for a legal claim or investigation. These records concern the commercial relationship between our two businesses; they are not your stored CRM content.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. To exercise any of these, contact us at privacy@thinkwebdigital.com.

If your request concerns records held by a customer organization rather than your own account, we will refer you to that organization, since it is the controller of that data, and will assist them in responding.

You can also revoke camera, photo, notification, and biometric permissions at any time in your device’s system settings. The app will continue to work, minus the features that depend on them.

9. Children

Thinkweb CRM is a workplace tool intended for business use. It is not directed at children, and we do not knowingly collect information from anyone under 16.

10. Changes to this policy

If we make a material change, we will update the date at the top of this page and notify account administrators before the change takes effect.

11. Contact

Questions, requests, or complaints can be sent to privacy@thinkwebdigital.com.