Privacy

Last updated · September 8, 2026 (removed a promise that cancelled accounts close and delete themselves after 30 days — nothing did that; deletion is by request, which is what this page now says)

The short version

Your CRM data lives in our cloud database so it can sync across your devices. We hold it for you, but we don't sell it, share it for advertising, or look at it for any purpose other than supporting the service you're paying for. You can export the whole thing as JSON at any time, and we delete it after you close your account.

What we collect about you (not your CRM data)

Independent of your CRM data, we collect:

• Your email address — for signup, signin, and the handful of transactional emails we send (welcome, password reset, trial ending, payment failed, etc.).
• Billing details — collected by our payment processor (Stripe), not by us. We see the last four digits, brand, and expiration of your card so we can show them in the billing screen; we never see the full card number.
• A small amount of session metadata — IP address, browser/device fingerprint, last sign-in time. Used to invalidate stolen sessions and to show you a list of where you're signed in.
• Usage logs for SMS, voice, and transcription — for activity history shown on contact detail pages and for service reliability. Not used for billing (Twilio bills you directly), not analyzed for marketing.

Service providers we use

The product relies on third-party infrastructure. We share only the data necessary for these providers to do their job; none are permitted to use your data for their own purposes (including training models, marketing, or resale).

• Cloud database & application infrastructure — stores your CRM data and runs the auth, API, and background sync services. Data is encrypted in transit and at rest.
• Payment processor — handles subscription billing. We see card brand, last four digits, and expiration; never the full card number.
• Twilio (your connected account) — Twilio is your own connected account, not a Groundbase subprocessor. Message and call content flows from Twilio to your contacts under your own agreement with Twilio. Groundbase only orchestrates the API calls using your encrypted Twilio credentials; we never see your Twilio bill.
• Resend (your connected account) — when you connect Resend for email campaigns, mail traffic flows directly from Resend to your recipients under your own agreement with Resend. Groundbase orchestrates the API calls using your encrypted Resend API key.
• Transactional email — sends the small set of system emails Groundbase generates (welcome, password reset, trial reminders). Doesn't handle the email you send from your own inbox connection.
• AI transcription — voicemail and call transcription. Audio is sent to a speech-to-text API for transcription only; the provider's terms prohibit training their models on this data. Disable transcription in Settings → Voice if you'd rather it not happen.
• Your email provider — if you connect Gmail, Outlook, or any IMAP account, the actual mail traffic flows directly between Groundbase and your provider. We hold an encrypted copy of your password server-side so the IMAP/SMTP connection can run from our background sync.

What we don't do

• We don't sell your data. To anyone. Ever.
• We don't share your data with advertisers or data brokers.
• We don't embed advertising trackers or sell audience data to anyone. We do use one product-analytics tool inside the app — see Product analytics for exactly what it collects and how to turn it off.
• We don't train any model on your CRM data.

Google Workspace APIs — Limited Use

When Groundbase connects to a Google account (for example, to sync Google Calendar or read mail from a connected Gmail inbox), the use and transfer of any data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What that means in practice:

• Google user data is used only to provide or improve features the user has signed in for (e.g. showing your calendar events alongside Groundbase tasks).
• Google user data is not transferred to any third party except as necessary to provide or improve those features, comply with applicable law, or as part of a merger / acquisition / sale of assets with appropriate notice.
• Google user data is not used for serving advertisements, and we do not allow humans to read it except where you have given affirmative consent, where required for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized.
• Google user data is not used to develop, improve, or train generalized AI or ML models.

How we protect sensitive data

CRM data — and especially the categories that lean sensitive (contacts' phone numbers, SMS/email content, voicemail recordings and transcripts, Google account tokens) — is protected by the following mechanisms:

• Encryption in transit. All API traffic between your browser/app and our backend, and between our backend and every subprocessor (Cloud DB, payments, SMS/voice, transcription, email provider), uses TLS 1.2 or higher.
• Encryption at rest. The cloud database storing your CRM data encrypts all customer data at rest using AES-256. Backups inherit the same encryption.
• OAuth tokens, IMAP/SMTP passwords, and Twilio API keys are stored with an additional layer of application-level encryption on top of the database's at-rest encryption. They are decrypted only at the moment of use to make an authenticated call to the relevant provider.
• Authentication. Sessions are bearer-token (JWT) based, 30-day rolling, and can be revoked from any session at any time. Time-based one-time-password (TOTP) MFA is available under Settings → Security — we recommend turning it on.
• Access controls. Production data access is restricted to the small set of operators (currently: the founder) who need it to support the service. Access is gated behind the same MFA-protected account credentials, never shared, and audit-logged. No third party has direct database access.
• Retention. Active CRM data is retained while your subscription is active. Cancelling stops the billing and opens a 30-day reactivation window — your data is kept intact so you can pick up where you left off. Nothing is deleted automatically when that window closes; if you want your data gone, ask us and we'll remove it (see “Delete your account” below). Voicemail recordings older than 90 days are pruned automatically unless you star them. SMS/email content stays as long as the contact does — deleting a contact removes their conversation history.
• Subprocessor scope. Each subprocessor receives only the data it needs to do its job (e.g. the transcription provider receives audio files; the payment processor never sees CRM data). Twilio is your own connected account rather than a Groundbase subprocessor — phone numbers and message bodies flow to Twilio under your own agreement with them. None of our subprocessors are permitted to use the data for their own purposes.
• Incident response. In the unlikely event of a breach affecting your data, we will notify affected users by email within 72 hours of confirmation, including the nature of the incident and what data was involved.

Product analytics

We measure aggregate product usage — how many people complete signup, finish onboarding, or get stuck along the way — so we can find rough spots and fix them. We use PostHog for this, in their US region.

What is sent: your account's internal ID, named product events (signup, onboarding step completed, first campaign sent), and the page paths you visit inside the app.

What is not sent: your email address, and the content of your CRM data — contacts, messages, deals, notes, emails, or anything you type into form fields. Text is masked by default before any event leaves your browser.

One honest caveat: page paths include record identifiers, so a page view of a contact reads as /contacts/<id>. That tells us a record was opened; it carries nothing about who the contact is or what the record contains.

This is pseudonymous, not anonymous — the account ID is stable, so events from one account group together, and we could match that ID back to your account if we had reason to.

You can turn analytics off in Settings → General → Help improve Groundbase on web and desktop. The setting applies to the device you set it on. The mobile app does not currently expose this toggle — if you want analytics off everywhere, email support@groundbasecrm.com and we'll disable it for your account.

Cookies & local storage

The web app stores a JSON Web Token (JWT) in your browser's local storage to keep you signed in across page refreshes. It expires after 30 days of inactivity or when you sign out.

Our product-analytics tool also sets a first-party cookie on groundbasecrm.com so a visit to the marketing site and a later session in the app are counted as one person rather than two. No advertising cookies are set, and no third party can read these from another site. Turning analytics off (below) stops it.

Your rights over your data

• Export — Settings → Backup & Export gives you a full JSON dump of every CRM table.
• Correct or delete individual records — built in to the app.
• Reset to empty — Settings → Backup & Export → Reset to empty database wipes all your CRM records (contacts, deals, tasks, messages, calls, etc.). Your do-not-contact list is deliberately kept: someone who asked you to stop messaging them stays opted out.
• Delete your account — email support@groundbasecrm.com from your account email and we'll close the account and remove your data within 7 business days. This is the only thing that deletes an account. Cancelling your subscription stops the billing and keeps your data; it does not close the account or erase anything.

Data residency

Your data is currently hosted in the United States, and some processors are located in the United States and process data subject to U.S. law. If you have a data residency requirement that needs a specific region, email us and we'll see what we can do.

Contact

Questions about anything here? Email support@groundbasecrm.com.