Privacy Policy

This policy covers two things that work together: this marketing site at syncedupcrm.app, and the SyncedUp CRM application at app.syncedupcrm.app. Both are operated by Simply Synced (“we,” “us”). If you have questions, reach us at [email protected].

Marketing site (syncedupcrm.app). This site does not use cookies, does not run advertising or tracking scripts, and does not have any forms that collect personal information. If you email us, we receive whatever you choose to include in that email.

The application (app.syncedupcrm.app). When you create an organization or sign in, we collect account information (name, email address, organization name, and a securely hashed password), and usage data needed to operate the product (login activity, error logs). The application uses a small number of essential, strictly-necessary cookies (session and CSRF-protection cookies via Auth.js) required to keep you signed in securely — these aren’t used for tracking or advertising, and can’t be disabled without disabling sign-in itself.

Data you enter into the CRM. As part of using SyncedUp CRM, your organization may enter data about your own clients, contacts, vendors, and jobs. That data belongs to your organization, not to us — we process it only to provide the service to you, as described in our Terms of Service.

We use account and usage information to provide, secure, and improve the service; to communicate with you about your account (including invitations, password resets, and trial status); and to respond when you contact us. We don’t sell personal information, and we don’t use your data to serve you third-party advertising.

Cloudflare provides content delivery, security, and DDoS protection for both the marketing site and the application, and can see network-level metadata (like IP address) as a normal part of routing traffic. Cloudflare’s own web analytics beacon, used on this marketing site, is cookieless and does not use client-side identifiers.

Paddle is our payment processor and acts as merchant of record for paid subscriptions. When you enter billing details, Paddle collects and processes that payment information directly under its own privacy policy — we don’t receive or store full card numbers.

Passwords are hashed, not stored in plain text. Every organization’s data in SyncedUp CRM is isolated at two independent layers — application-level scoping and Postgres Row-Level Security — so one organization’s data is never visible to another. No method of transmission or storage is 100% secure, but we design the system so that a mistake in one layer doesn’t expose another tenant’s data.

We retain account and organization data for as long as your account is active, and for a reasonable period afterward in case you want to reactivate or as required for legal, accounting, or security purposes. You can request deletion of your account and associated data at any time by contacting us.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing (for example, under the GDPR if you’re in the EU/UK, or the CCPA/CPRA if you’re in California). To exercise any of these rights, email [email protected] and we’ll respond promptly.

SyncedUp CRM is a business tool and is not directed at children. We don’t knowingly collect personal information from anyone under 16.

Our infrastructure providers (including Cloudflare) operate globally. If you’re accessing the service from outside the United States, your information may be processed in the United States or other countries with different data protection laws than your own.

If we make material changes to this policy, we’ll update the date at the top of this page and, where appropriate, notify account owners directly.

Questions about this policy or your data? Email [email protected].