Privacy Policy

Last updated: draft — not yet in force.

Placeholder. Replace with a finalised, GDPR-compliant policy before launch. Because customers store personal data of their own contacts in HawkCRM, you act as a processor — you will also need a Data Processing Agreement (DPA) and a subprocessor list.

1. Who we are

Data controller identity and contact details.

2. Data we process

Account data, workspace/CRM content, usage and device data, cookies.

3. How we use it

Providing the service, billing, support, security, product improvement.

4. Legal bases

Contract, legitimate interests, consent, legal obligation (GDPR Art. 6).

5. Subprocessors

Vercel (hosting), Supabase (database, EU/eu-west-1), Anthropic (AI), Stripe (billing), Resend (email), and Google/Microsoft/Slack where you connect them.

6. Data residency & retention

EU-hosted; how long data is kept and when it is deleted.

7. Your rights

Access, rectification, erasure, portability, objection; how to exercise them.

8. Contact

Privacy contact and complaint/authority details.