Privacy Policy

Last updated: 2026-10-26

This policy explains what AshwoodCRM (the "Service") collects, why, and what we do with it. The Service is operated by Ashwood Data ("we", "us", "our").

Two kinds of information run through the Service, and they are treated differently.

• Your account information — who you are as a user of the Service. We decide what to do with it, and this policy covers it.
• Your workspace's data — the contacts, calls, messages and records a business puts into its workspace. The business decides what goes in and what happens to it. We process it for that business, on its instructions. If you are a contact in someone's workspace, section 9 tells you what to do.

1. What we collect

1.1 Account information

Your name, your email address, your role in a workspace, and the workspace you belong to. Passwords are stored by our authentication provider as a hash. We never see your password.

1.2 Workspace data

Everything a workspace puts into the Service or connects to it:

• Contacts and organizations — names, phone numbers, email addresses, postal addresses, job titles, company details, notes and custom fields, uploaded or imported by the workspace or captured by its own web forms.
• Deals, tasks and notes — the sales records a workspace keeps.
• Email — messages sent and received through a connected mailbox, including their content, and delivery, open and click events for messages the workspace sends.
• Calls and text messages — call logs, recordings and transcripts from a connected phone system, and the text messages that move on its lines.
• AI calls — where a workspace switches AI calling on, the recording, the transcript and the analysis of every call it places.
• Website visits and chats — where a workspace installs our tracking script or website assistant on its own site, the pages a visitor viewed, the times, and the messages a visitor sent in a chat. A visit is anonymous until the visitor submits a form or clicks a link in an email the workspace sent.
• Meetings — calendar events, attendees, and, where a workspace turns meeting notes on, the notes document attached to a meeting.

1.3 Technical information

Log records of requests to the Service, including the time, the page or endpoint, and error details. Our public forms and signup pages count requests per address to block abuse; that counter stores a one-way hash and never the address itself.

We also count how the Service is used: which pages are opened and which actions are taken (for example, a note added or an email sent), per workspace and per user, per day. These counts never include what you type, the content of your workspace's records, or which contact or record you opened. We use them to understand how the Service is used and to improve it, and they stay with us.

1.4 Cookies and browser storage

The Service stores your session and a few preferences in your browser's local storage so you stay signed in and your screens open the way you left them. We do not use advertising cookies and we do not run third-party analytics or advertising trackers on the Service.

2. How we use it

• To run the Service and to give you the features you turn on.
• To file calls, email, text messages and website activity against the right contact in your workspace.
• To generate AI output — drafts, summaries, briefings, coaching and AI calls.
• To keep the Service secure, to investigate abuse and to enforce our Terms.
• To support you when you ask us to.
• To bill for usage.
• To meet legal obligations.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use your workspace's data to advertise to anyone.

3. Google user data and Limited Use

Where you connect a Google account, the Service reads and writes Google data on your behalf. AshwoodCRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.1 What we ask for, and why

When you connect your Google account, the Service asks for permission to:

• Read, send and organize your Gmail messages — so your sent and received email files against the right contact, so you can send from your own mailbox, and so replies thread correctly.
• Read and create calendar events — so your schedule appears in the Service, so a meeting booked from the Service lands on your calendar, and so it carries a Google Meet link.
• Create and read Google Meet spaces — so a meeting booked from the Service has a video link, and so the Service can read the transcript of a meeting you held, where your organization turned transcription on during the call. The Service reads a transcript only for meetings on your own calendar, and files it against the contact. A transcript is a record of what everyone in the meeting said, including people who do not use the Service, so it is handled under the same commitments as everything else in this section.
• See your Google email address — so we can attach the connection to your account.
• See and change your email settings — so that, when you ask, the Service can copy the signature you saved into Gmail for one of your addresses. It changes no other Gmail setting.
• View files Google Meet created — so the Service can read the written summary Google Meet produced for a meeting you held and file it against the contact. This access is read-only and reaches only the files Google Meet itself created in your Drive, never the rest of it. Meeting transcripts do not need it.

Google names each of these on the consent screen before you grant it, and you can review or withdraw them at any time.

3.2 What we do with Google data

We use it to deliver the features described above and for nothing else.

• We do not sell it.
• We do not use it for advertising, and we do not transfer it to anyone for advertising.
• We do not use it to develop, improve or train generalized artificial intelligence or machine-learning models.
• No person at Ashwood Data reads it, except where we need to for security, to comply with the law, or where you give us explicit permission — for example when you ask us to look into a problem.
• We send it to the AI model providers in section 4 only to produce the drafts, summaries, briefings and search results you asked for.
• We transfer it to any other third party only where it is necessary to deliver a feature you turned on and it is described in this policy, to comply with the law, or as part of a merger or acquisition, in each case under confidentiality obligations at least as protective as this policy.

3.3 Turning it off

You can disconnect Google at any time from your Google connection settings in the Service, and you can revoke the Service's access at myaccount.google.com/permissions. Disconnecting stops any further access. Email and calendar records already filed in your workspace stay there until the workspace deletes them.

4. Who we share it with

We use other companies to run the Service. Each one gets only what it needs for its part, and each is bound by contract to use it only to provide its service to us. We use providers in these categories:

• Cloud hosting and database — where the Service and its data run.
• Email delivery — to send email a workspace sends through the Service, and our own operational email such as invitations and password resets.
• Telephony — to place and receive calls and text messages, and to store their recordings and transcripts.
• AI model providers — to produce drafts, summaries, briefings, coaching and search results.
• AI voice calling — to place AI calls and to transcribe them.
• Electronic signature — to run a signing ceremony on a document a workspace sends.
• Address validation and mapping — to check and complete postal addresses.

We also disclose information where the law requires it, to protect our rights or someone's safety, and to a successor in a merger or a sale of our business.

5. Where it is processed

The Service runs in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States.

6. How long we keep it

• Workspace data stays while the workspace is active.
• Deleted notes, tasks and email go to the workspace's recycle bin, where an administrator can restore them for 30 days. After that the content is permanently removed and only a record of the deletion — what was deleted, when, and by whom — remains.
• Call recordings and transcripts stay for as long as the workspace keeps the call record.
• Account information stays while your account exists.
• When a workspace closes, we delete its data within 30 days, except where we have to keep something to comply with the law.
• Usage counts (section 1.3) are kept for 13 months and then deleted.
• Request logs are kept for a short period and then removed. They record requests, not the content of your workspace's records.

7. Security

We encrypt data in transit. Every workspace is separated at the database level, so one workspace cannot read another's records, and a workspace's own visibility rules decide which of its members can see which records. Access to production systems is limited to the people who need it. No system is perfectly secure, and we cannot guarantee that yours will never be compromised.

8. Your choices

• See and correct your information. Your profile and your workspace's records are editable in the Service.
• Export. An administrator can export a workspace's records from the Service.
• Delete. An administrator can delete records and close a workspace.
• Disconnect a service. You can disconnect Google, your phone system or any other connected service from your workspace's settings.
• Email from us. Operational email about your account is part of the Service. You can unsubscribe from anything else.

Depending on where you live, you may have additional rights over your personal information, such as the right to a copy of it, to correct it, to delete it, or to object to how it is used. Write to support@ashwooddata.com and we will respond.

9. If you are a contact in someone's workspace

If a business holds your details in AshwoodCRM, that business decides what it keeps and how long it keeps it. Ask them to see, correct or delete your record. If you write to us instead, we will pass your request to that business and help them act on it.

10. Children

The Service is a business tool. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to support@ashwooddata.com and we will delete it.

11. Changes to this policy

We may update this policy. We will post the updated policy here with a new "Last updated" date, and we will tell you by email or in the product before a material change takes effect.

12. Contact

Ashwood Data support@ashwooddata.com