Privacy

Last updated · October 22, 2026 (Groundbase Free is now called Groundbase Classic. October 21: downloading Groundbase Classic, and what the free app sends us, which is nothing; applications on the tester page also reported to Meta by our server; the private 24-hour live demo; Emma, the assistant on our website; Cloudflare's Turnstile Privacy Addendum; continuing a website chat with Emma by phone, or having her call you. October 20: the live demo on the homepage; the Meta Pixel on the tester application page, and only there. October 17: the one thing kept after an account is deleted: an email fingerprint that stops repeat free trials. October 14: what happens to your data after you cancel. October 9: documents sent for signing, and emails Groundbase sends on your behalf until you connect your own.)

The short version

Your CRM data lives in our cloud database so it can sync across your devices. We hold it for you, but we don't sell it, share it for advertising, or look at it for any purpose other than supporting the service you're paying for. You can export the whole thing as JSON at any time, and we delete it after you close your account.

What we collect about you (not your CRM data)

Independent of your CRM data, we collect:

• Your email address — for signup, signin, and the handful of transactional emails we send (welcome, password reset, trial ending, payment failed, etc.).
• Billing details — collected by our payment processor (Stripe), not by us. We see the last four digits, brand, and expiration of your card so we can show them in the billing screen; we never see the full card number.
• A small amount of session metadata — a hashed copy of your sign-in token, when it was issued and when it expires. Used to end a session when you sign out or change your password. We do not store your IP address or a device fingerprint against your sessions. IP addresses are used only as short-lived counters (an hour at most) to slow down repeated sign-in attempts.
• Usage logs for SMS, voice, and transcription — for activity history shown on contact detail pages and for service reliability. Not used for billing (Twilio bills you directly), not analyzed for marketing.

Service providers we use

The product relies on third-party infrastructure. We share only the data necessary for these providers to do their job; none are permitted to use your data for their own purposes (including training models, marketing, or resale).

• Cloud database & application infrastructure — stores your CRM data and runs the auth, API, and background sync services. Data is encrypted in transit and at rest.
• Payment processor — handles subscription billing. We see card brand, last four digits, and expiration; never the full card number.
• Twilio (your connected account) — Twilio is your own connected account, not a Groundbase subprocessor. Message and call content flows from Twilio to your contacts under your own agreement with Twilio. Groundbase only orchestrates the API calls using your encrypted Twilio credentials; we never see your Twilio bill.
• Resend (your connected account) — when you connect Resend for email campaigns, mail traffic flows directly from Resend to your recipients under your own agreement with Resend. Groundbase orchestrates the API calls using your encrypted Resend API key.
• Transactional email — sends the system emails Groundbase generates (welcome, password reset, trial reminders). Until you connect your own email, it also sends your booking confirmations, invoices and receipts, and signing requests on your behalf, from a Groundbase address with your name on it and replies going to you. It doesn't handle email you send from your own connected inbox or Resend account.
• AI transcription — voicemail and call transcription. Audio is sent to a speech-to-text API for transcription only; the provider's terms prohibit training their models on this data. Turn transcription off in Settings → Preferences on web and desktop, or Settings → Voice & calls on mobile, if you'd rather it not happen.
• AI phone answering (Frontdesk), only if you turn it on — the caller's audio and the conversation go to a voice-AI provider to run the call, and an AI model writes the call summary. Neither provider may train on it. If you don't use Frontdesk, nothing goes to them.
• People who book with you or fill in your forms — what they enter on your booking page or lead form (name, email, phone, answers) is stored in your CRM, on your behalf, like any contact you add yourself. Their browser's IP address is used briefly to limit abuse and is not stored with the booking or submission. When a customer accepts one of your quotes online, the name they type and their IP address are kept with the acceptance, as a record that they accepted.
• People who sign documents you send — when you send a document for signing, the signer's name and email, what they fill in, and their signature (drawn or typed) are stored in your account, on your behalf. To make the signature verifiable, the time, IP address and browser of each step (opened, signed, declined) are recorded and kept with the document for as long as you keep it. The signed copy ends with a certificate page listing each signer's name, email, signing time and IP address, and it is emailed to everyone who signed. Document files and signature images are kept in our cloud file storage, encrypted at rest. A document you delete is permanently removed, files included, 30 days later; deleting your account removes them all.
• Your email provider — if you connect Gmail, Outlook, or any IMAP account, the actual mail traffic flows directly between Groundbase and your provider. We hold an encrypted copy of your password server-side so the IMAP/SMTP connection can run from our background sync.

What we don't do

• We don't sell your data. To anyone. Ever.
• We don't share your data with advertisers or data brokers.
• We don't sell audience data to anyone, and we don't put advertising trackers in the app or on the booking pages and forms you share with your own customers. The one advertising tracker anywhere is on a single page of our own website, the tester application page — see Advertising measurement. We also use one product-analytics tool inside the app — see Product analytics for exactly what it collects and how to turn it off.
• We don't train any model on your CRM data.

Google Workspace APIs — Limited Use

When Groundbase connects to a Google account (for example, to sync Google Calendar or read mail from a connected Gmail inbox), the use and transfer of any data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What that means in practice:

• Google user data is used only to provide or improve features the user has signed in for (e.g. showing your calendar events alongside Groundbase tasks).
• Google user data is not transferred to any third party except as necessary to provide or improve those features, comply with applicable law, or as part of a merger / acquisition / sale of assets with appropriate notice.
• Google user data is not used for serving advertisements, and we do not allow humans to read it except where you have given affirmative consent, where required for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized.
• Google user data is not used to develop, improve, or train generalized AI or ML models.

How we protect sensitive data

CRM data — and especially the categories that lean sensitive (contacts' phone numbers, SMS/email content, voicemail recordings and transcripts, Google account tokens) — is protected by the following mechanisms:

• Encryption in transit. All API traffic between your browser/app and our backend, and between our backend and every subprocessor (Cloud DB, payments, SMS/voice, transcription, email provider), uses TLS 1.2 or higher.
• Encryption at rest. The cloud database storing your CRM data encrypts all customer data at rest using AES-256. Backups inherit the same encryption.
• OAuth tokens, IMAP/SMTP passwords, and Twilio API keys are stored with an additional layer of application-level encryption on top of the database's at-rest encryption. They are decrypted only at the moment of use to make an authenticated call to the relevant provider.
• Authentication. Sessions are bearer-token (JWT) based and last 30 days from sign-in, after which you sign in again. Signing out ends the session on that device; changing or resetting your password ends every other session. There is no per-device session list yet. Time-based one-time-password (TOTP) two-factor authentication is available under Settings → Account & billing — we recommend turning it on. API keys you create for AI integrations are separate credentials: they are not covered by two-factor, so treat them like passwords and delete any you no longer use.
• Access controls. Production data access is restricted to the small set of operators (currently: the founder) who need it to support the service. Access is gated behind the same MFA-protected account credentials, never shared, and audit-logged. No third party has direct database access.
• Retention. Active CRM data is retained while your subscription is active. Cancelling stops the billing at the end of the period you've paid for and keeps your data intact, with no time limit, so you can pick up where you left off if you subscribe again; you can still export it while the subscription is inactive. Nothing is deleted automatically; if you want your data gone, delete your account or ask us to (see “Delete your account” below). Call and voicemail recordings are stored in your own Twilio account, not by us; we keep the link, the transcript and the call record until you delete them or your account is removed, and you can delete the audio itself in your Twilio Console at any time. Deleting a contact removes the contact, their tags, addresses and custom field values. Their texts, emails and call records stay in your history until you delete those conversations, or until your account is removed.
• Subprocessor scope. Each subprocessor receives only the data it needs to do its job (e.g. the transcription provider receives audio files; the payment processor never sees CRM data). Twilio is your own connected account rather than a Groundbase subprocessor — phone numbers and message bodies flow to Twilio under your own agreement with them. None of our subprocessors are permitted to use the data for their own purposes.
• Incident response. In the unlikely event of a breach affecting your data, we will notify affected users by email within 72 hours of confirmation, including the nature of the incident and what data was involved.

Product analytics

We measure aggregate product usage — how many people complete signup, finish onboarding, or get stuck along the way — so we can find rough spots and fix them. We use PostHog for this, in their US region.

What is sent: your account's internal ID, named product events (signup, onboarding step completed, first campaign sent), the pages you visit inside the app (the path, and any filters in the address after the ?), and PostHog's standard interaction events — that a button or link was clicked, and which one.

What is not sent: your email address, and the content of your CRM data — contacts, messages, deals, notes, emails, or anything you type into form fields. Inside the web and desktop apps, on-screen text is masked before any event leaves your browser. The public marketing site has no such masking, and nothing on it is yours.

One honest caveat: page paths include record identifiers, so a page view of a contact reads as /contacts/<id>. That tells us a record was opened; it carries nothing about who the contact is or what the record contains.

This is pseudonymous, not anonymous — the account ID is stable, so events from one account group together, and we could match that ID back to your account if we had reason to.

You can turn analytics off in Settings → Preferences → Help improve Groundbase on web and desktop, and under Account → Help improve Groundbase on mobile. The setting applies to the device you set it on. The mobile app also records when it is opened.

Advertising measurement

We advertise Groundbase on Facebook and Instagram. To see whether those ads lead to anyone applying, one page of our website, the tester application page (groundbasecrm.com/testers), loads the Meta Pixel. No other page of the website loads it, and nothing in the app, and none of the booking pages or forms you share with your own customers.

What it sends to Meta: that the page was visited, and that the application form was sent. Like anywhere the pixel runs, Meta also receives your IP address, your browser's details and the page's address, and the pixel sets a Meta cookie (_fbp) on our site. When an application is sent, our server also tells Meta directly that one was made, so it is counted even if your browser blocks the pixel; that message carries your IP address, your browser's details and Meta's cookie ids from the page. If you're signed in to Facebook or Instagram in the same browser, Meta can connect the visit to your account and use it for measuring and targeting ads, under Meta's privacy policy. What you type into the application form is never sent to Meta.

To limit it: block trackers in your browser (most privacy settings and extensions block this one), or use Meta's ad preferences to limit how activity from other websites is used.

Website demo

Questions typed into the live demo on our homepage are sent to Anthropic to generate the answer, which comes from a sample account, never yours. Groundbase does not store the questions; our server keeps only a count of how many were asked and what they cost. Cloudflare Turnstile checks that a person, not a bot, is using the demo, the live demo or Emma, usually without showing anything; see Cloudflare's Turnstile Privacy Addendum and privacy policy.

"Explore the live demo" opens a private copy of the same sample account for 24 hours. Anything you type into it, including requests to Claude (sent to Anthropic to carry them out), stays in that copy and is deleted with it. Nothing in the demo sends an email, text or payment.

Questions typed to Emma, the assistant on our website, are handled the same way: sent to Anthropic to answer them, and not stored by Groundbase.

The one exception is if you ask Emma to talk by phone: she gives you a four-digit code, and from then on that chat is kept for 24 hours under the code, so she can pick up where you left off when you call. Then it is deleted.

If you ask Emma to call you instead, we text a code to the number you give to confirm it is yours, then Emma (an AI assistant) calls you once. Your first name and number are kept as a contact in Groundbase's own customer records, with that chat attached so Emma knows what you were asking, the same as anyone who calls us. You can ask us to delete them at any time.

Groundbase Classic

To download Groundbase Classic, our free desktop app, you give us your name and email address (and your type of business, if you choose to), and agree that we can email you. We keep them as a contact in Groundbase's own customer records, email you the download link, and send a few short emails on getting the most out of the app and on Groundbase cloud. Each of those has an unsubscribe link, and you can ask us to delete your details at any time.

The app itself keeps everything you put in it on your computer. It has no account and sends us none of your data. It goes online for one thing: to check whether a newer version is out, by fetching a small file from our website, which carries nothing from your CRM.

Cookies & local storage

The web app stores a JSON Web Token (JWT) in your browser's local storage to keep you signed in across page refreshes. It expires 30 days after you signed in, or when you sign out.

Before you sign in — on the marketing site, and on the app's sign-up and sign-in pages — our product-analytics tool sets no cookie and stores nothing in your browser: a visit is counted only while the page is open. Once you're signed in to the web app, it keeps an analytics ID in your browser's local storage so your sessions count as one account. It sets no cookies, and no third party can read this from another site. Turning analytics off (see Product analytics, above) stops it.

The only advertising cookie anywhere on our site is the Meta Pixel's, on the tester application page alone (see Advertising measurement).

Your rights over your data

• Export — Settings → Backup & Export gives you a full JSON dump of every CRM table.
• Correct or delete individual records — built in to the app.
• Reset to empty — Settings → Backup & Export → Reset to empty database wipes all your CRM records (contacts, deals, tasks, messages, calls, etc.). Your do-not-contact list is deliberately kept: someone who asked you to stop messaging them stays opted out.
• Delete your account — Settings → Backup & export → Delete my account in the web or desktop app removes the account and your data immediately; it asks for your password (and your two-factor code) and cannot be undone. One thing is kept: if the account ever had a subscription, a one-way scrambled fingerprint of its email address (not the address itself), so the same email can't start a second free trial. Nothing else about the account is kept. Or email support@groundbasecrm.com from your account email and we'll do it within 7 business days. Cancelling your subscription is different: it stops the billing and keeps your data. Your Twilio account and phone numbers are yours and are not touched by either.

Data residency

Your data is currently hosted in the United States, and some processors are located in the United States and process data subject to U.S. law. If you have a data residency requirement that needs a specific region, email us and we'll see what we can do.

Contact

Questions about anything here? Email support@groundbasecrm.com.