Privacy Policy

IronVail CRM ("IronVail", "we", "us") is operated by [BUSINESS NAME]. This policy describes what we collect, why, and the choices you have. The short version: your CRM data is yours, we don't sell it, and every workspace is isolated from every other.

What we collect

Account data — your name, email address, and password hash when you create an account.

Workspace data — the accounts, contacts, deals, notes, tasks, and email content you and your team put into your workspace. This data belongs to your workspace and is processed only to provide the service.

Connected services — if you connect a mailbox (e.g. Microsoft 365) we store OAuth tokens, encrypted at rest, and use them solely to send email you compose and to detect replies to that email. If you connect Apollo, we store your API credential encrypted and use it only to import the leads you request. We never read mail or data beyond what the feature you enabled requires, and disconnecting removes our access.

Usage data — standard server logs (IP address, browser type, pages requested) used for security and debugging.

How we use it

To provide and improve the service, to send transactional email (invites, password resets, billing receipts), and to keep the platform secure. We do not sell personal data, and we do not use your workspace data to train models or for advertising.

Email you send through IronVail

You are the sender of campaigns and sequences you create. Every bulk email includes an unsubscribe link; suppression lists are enforced automatically. You are responsible for having a lawful basis to contact your recipients.

Sub-processors

We use Supabase (database and authentication), Vercel (hosting), Stripe (payments — we never see full card numbers), and Resend (email delivery). Each processes data only as needed to provide their service to us.

Security & retention

Workspaces are isolated with database-level row security. Credentials and tokens are encrypted at rest. Data is retained for as long as your workspace exists; when you delete your account or workspace, associated data is deleted within 30 days, excepting records we must keep for legal or billing reasons.

Your rights

You can access, correct, export, or delete your personal data. Contact us at [CONTACT EMAIL] and we'll respond within 30 days. EU/UK residents may also lodge a complaint with their supervisory authority.

Contact

[BUSINESS NAME]
[BUSINESS ADDRESS]
[CONTACT EMAIL]

We'll post any material changes to this policy here and update the effective date above.