emyCRM App Privacy Policy

1. The Operator's two roles

The Operator processes the employee's own data (name, work email, sign-in session, device details) to make the App work: sign-in, notifications and account protection.

The data a company keeps in its CRM about its own customers (companies, contacts, deals, tasks, messages, calls and call recordings) belongs to that company. The Operator stores and processes it only on the company's behalf. The App shows and changes it within the permissions the company has given the employee.

2. What the App stores on the phone

The sign-in session key, the workspace address and the work email. The key is kept in the phone's secure storage (Keychain on iPhone, Keystore on Android) and is deleted when you sign out.

Recently opened CRM data — My day, tasks, lists and records, chats — so the App can show it without a connection. It is kept in the App's cache, is not included in phone backups, is stored for no longer than three days and is erased when you sign out. Clinic medical records and appointments are not stored on the phone.

Upcoming items for the My day widget on the phone's home screen — in storage shared by the App and the widget; they are erased when you sign out.

Phone numbers and names of clients for caller ID — if the employee has turned it on. The list includes only the clients the employee can see in the CRM within their permissions. The phone checks an incoming call's number against it and shows the client's name; the App does not send the caller's number anywhere and does not read the call log. The list is updated from the CRM, the App does not include it in phone backups, and it is erased when you sign out or, if caller ID has been turned off, the next time the App is opened.

App settings: the order of sections and whether Face ID or fingerprint unlock is turned on.

Face ID and fingerprint checks are performed by the phone's operating system. The App only receives a yes or no answer; biometric data is never available to the App or the Operator.

3. What the App sends to the Operator

When you sign in and work: your work email, your password (only to obtain the session key; the App does not store it) and requests to your company's CRM.

When you register a new workspace: your name, company name, work email, phone number (if you provide it) and password, as well as the country from the phone's region and the App's language — to create the workspace, send a confirmation email and show prices for your country.

Device details: platform (iOS or Android), model and OS version, App version and the push notification token. They are used to deliver notifications and to show the employee their active sign-ins. Every sign-in is listed in the employee's profile in the CRM and can be ended there.

Content you add yourself: notes, tasks, comments, photos and files, voice messages and voice notes.

Crash reports: if the App hits an error or closes unexpectedly, it sends a technical report to the Sentry service: the error and the screen, the App and OS versions, the phone model and the address of the company's CRM. The report contains no email, name or CRM data. We use the reports to find and fix bugs.

The App does not read your contacts, photos, calendar or location without your action, does not collect advertising identifiers and does not track you across other apps or websites. The App has no ads and no third-party analytics.

4. Phone permissions and why they are needed

Microphone — for calls to customers and colleagues through your company's phone system, for voice messages in chats and for voice notes. Audio is sent to the company's PBX. Whether calls are recorded is decided by the company in its telephony settings.

Camera and photos — only when you choose to send a photo or a file to a chat, or scan a QR code to sign in. Frames from the scan are not saved or sent anywhere. The App does not browse your whole photo library.

Calendar — write-only, only when you tap "Add to calendar": the App adds an event (a call, a task) and does not read your calendar.

Notifications — to tell you about new messages, tasks, missed calls and reminders. You can turn them off in the phone's settings.

Notification buttons (Done, Tomorrow, Call, Reply) open the App and perform the action on your behalf — the same as the matching button inside the App.

Caller ID — optional: on iPhone it is turned on in the phone settings (Call Blocking & Identification), on Android by agreeing in the system dialog that makes the App your caller ID app. The App does not block calls. On Android, the calling client's name is shown as a notification and, if the employee has allowed the App to display over other apps, also as a card over the call screen.

Face ID or fingerprint — so that only the phone's owner can open the App. Optional.

5. Voice notes and artificial intelligence

A voice note is sent to the Operator, converted to text and analysed by an artificial intelligence model: what to write in the record, which task to create and when the next contact is due. You see the result as a draft, and it is saved only after you confirm it.

The Emy AI assistant answers questions about the CRM data the employee has access to and performs actions only after confirmation.

The Operator may use external providers for speech recognition and AI models. They act on the Operator's behalf and may not use the data to train their models. The customer company can turn AI features off in the CRM settings.

6. Messaging customers in messengers

If the company has connected a messenger integration in its CRM, the App opens that service's conversation window. Messages there are processed by the integration provider under its agreement with the customer company and on its terms.

7. Who receives the data

The Operator does not sell data and does not share it with third parties, except contractors the App cannot work without: hosting and data centres; Apple Push Notification service and Firebase Cloud Messaging (Google) for notifications; Sentry (Functional Software, Inc., USA) for App crash reports; telecom operators for calls; speech recognition and AI model providers. They are bound by confidentiality. Data is also disclosed where the law requires it.

The current list of contractors is available on request at [email protected].

8. Storage and security

Data is transferred only over encrypted connections (HTTPS). Inside the CRM access is limited by the permissions the company gives its employees; actions are logged; data is backed up regularly.

Account data is kept while the company uses emyCRM and for a limited period afterwards to restore access and meet legal requirements, and is then deleted.

9. Signing out and deleting data

"Sign out" in the App ends the session on the server, deletes the key from the phone and unlinks the phone from notifications. Deleting the App erases everything it stored on the phone.

The Delete account button in the More section. For an employee, it closes their sign-in immediately and emails the company's administrators: the account is part of the company's data (clients and deals are assigned to it), so the administrators delete it after handing the clients over to colleagues. For a workspace owner, it closes the workspace for all employees immediately and deletes it with all its data after 14 days; until then the deletion can be cancelled.

Employee accounts are created and deleted by the company's CRM administrator. Ask them to delete your account or to give you a copy of your data.

You can also write to the Operator at [email protected]. If your data was entered into the CRM by a company you are a customer of, the request is forwarded to that company: it controls such data, and the Operator assists it technically.

10. Children

The App is designed for company employees and is not intended for children. The Operator does not knowingly collect children's data.

11. Changes to this Policy

The Operator may change this Policy by publishing a new version on this page. The date of the version is shown at the top. The Operator announces significant changes in the App or by email.

12. Contact

Questions about data processing: ECOMMERCE LLC, 77 Buyuk Turon street, Mirabad district, Tashkent 100031, Uzbekistan, email: [email protected].

13. Operator details

ECOMMERCE LLC
TIN: 304986313; OKPO: 27244374; OKED: 63110; Registered address: 77 Buyuk Turon street, Mirabad district, Tashkent 100031, Uzbekistan; E-mail: [email protected].