Privacy notice

Tiny CRM stores information about your contacts, companies, deals, projects and notes. Most of what it holds was typed by you and is about somebody else — a person who is not a user here and has no direct relationship with us. That asymmetry shapes everything below: you decide what goes in, and we handle it on your behalf.

Tiny CRM is operated by Artifact Digital LLC, 178 N. Cuyamaca St., El Cajon, CA 92020, United States.

Our role in handling personal data. Customers decide what personal data to enter into Tiny CRM and why. For that customer content, Artifact Digital LLC acts as a processor, handling the data on customers' behalf to provide the service and follow their instructions, subject to applicable law. For personal data we use to manage accounts, authentication, billing, security and our business operations, Artifact Digital LLC acts as a controller. Customers are responsible for having the necessary permissions or other lawful basis to enter personal data into Tiny CRM. We remain responsible for our own obligations under applicable data-protection law.

What you give us

• Your account: name, email address, password (hashed), time zone, optional job title and avatar.
• Your CRM content: contacts, companies, deals, opportunities, projects, tasks, notes, tags, custom fields, and files you upload.
• Workspace structure: workspace names, members you invite, their roles and record-level access.

What the service generates

• Sign-in sessions, with a truncated IP address and a device description, so you can review and revoke them.
• An audit log of security-relevant actions, which is append-only and cannot be edited or deleted by the application.
• Counts of AI model requests per month, used to enforce your plan's allowance.
• Relationship, momentum and health scores, computed locally from the data you entered.

What is never collected

• Payment card details. Card data is entered on Stripe's own pages and never reaches our servers. We store only a Stripe customer identifier, your plan, its status and its renewal or end date.
• Advertising or cross-site tracking identifiers. There is no advertising network, no analytics pixel and no third-party tracker.
• Your password in any readable form.

Tiny CRM uses a session cookie to keep you signed in and a security cookie to help protect against cross-site request forgery. We do not currently use advertising or analytics cookies. You can manage cookies through your browser settings. Blocking these functional cookies may prevent sign-in or other features from working.

• To run the product: storing and showing you your own data.
• To authenticate you and keep accounts secure, including lockout after repeated failed sign-ins and optional two-factor authentication.
• To enforce plan limits, which requires counting what you have created and how many AI model requests you have used this month.
• To take payment, through Stripe, if you subscribe.
• To send transactional email: verification, password reset, invitations. Not marketing.

We do not use your CRM content to train machine-learning models, or sell or share it for advertising. AI-provider handling is described in section 6 below.

We use service providers for hosting, database storage, file storage, transactional email, payment processing and, where enabled, AI inference. The table below describes the locations reported in our current configuration and provider documentation. It is not a guarantee that all provider processing is confined to those locations.

Resend delivers through Amazon SES, which is Resend's own subprocessor rather than a service we contract with directly. Transactional email carries your name, your email address and a link — never CRM record contents.

Resend stores account data, email metadata and delivery logs in the United States whatever sending region is selected; the sending region affects only where a message is dispatched from. Resend publishes its own subprocessor list and gives at least 14 days' notice before changing it.

International processing. Artifact Digital LLC is based in the United States. Tiny CRM and its service providers may process personal data outside your country. Our provider table describes the locations we have confirmed; we do not promise that data remains in your country.

We do not currently offer a data processing agreement. If your use requires processing terms or international-transfer safeguards, contact privacy@tinycrm.biz before uploading personal data, so we can determine whether we can support your requirements.

AI is controlled per workspace, not per account. One person may run their own business and a client's in the same account under different obligations, so the setting lives on the workspace.

• Disabled — nothing leaves. No workspace content is sent to a model provider. Built-in scoring, detection and brief features continue to run within the application.
• Enabled — a bounded slice of workspace content may be sent to the provider to write prose and answer questions. The amount is capped in code at 16,000 characters per request, including the question and any prior turns; longer context is truncated before it is sent, not after.
• Private model only — reserved for a provider covered by a zero-retention agreement. We currently hold no such agreement, so this mode behaves like Disabled.

If an AI request spans several workspaces and any of them has AI disabled, the answer is produced locally rather than sending workspace content to a model provider.

Never sent to a model provider, in any mode: passwords, session tokens, API keys or any other credential. A contact's email address or phone number is included only when that specific record is the one being summarised.

Only requests that actually reach a paid model count against your monthly allowance. The built-in engine is unmetered on every plan, including Free.

We hold no zero-retention agreement with Anthropic. Its published commercial policy describes deletion of API inputs and outputs within 30 days, subject to exceptions, and no model training without express permission. Content flagged by its safety systems may be retained longer, including for up to two years. These are provider policies, not a guarantee by Artifact Digital LLC. Disable workspace AI if you do not want workspace content sent to a model provider.

• Passwords are hashed with bcrypt and never stored in a readable form.
• Workspace isolation is enforced by the database itself through row-level security, not only by application code. A query that arrives without a workspace context returns nothing rather than everything.
• Optional two-factor authentication, with recovery codes.
• Sessions can be revoked individually or all at once, and a password change invalidates existing sessions.
• The audit log is append-only: the application's database role is not permitted to update or delete its rows.
• All traffic is served over HTTPS.

No security measure is a guarantee. If we become aware of a personal-data breach affecting your data, we will notify you without undue delay, subject to applicable legal requirements, by email to your account address. Our notice will describe the information available to us, the likely effects, the steps we are taking, and any steps we recommend you take. We may provide information in stages as our investigation progresses. We will comply with any applicable notification deadlines and obligations.

The following describes our current retention practices. These practices do not override applicable legal requirements or your statutory rights.

Deleted automatically, on a daily sweep

• Expired sessions, and authentication tokens once they have been used or have expired.
• Completed background jobs, 30 days after they finish.
• Expired idempotency keys, and rate-limit counters.
• Security alerts are deleted 365 days after they are acknowledged. Unacknowledged alerts are not automatically deleted. This is separate from the audit log below.

Not deleted automatically

• Business records are retained while stored in your workspace. Moving records to Trash does not permanently erase them.
• Records you delete go to Trash and stay there. They remain recoverable by you, and no job empties the Trash, so in practice they are kept indefinitely.
• Audit records are retained indefinitely by the current implementation; no automatic purge is configured. Requests concerning personal data in these records will be assessed under applicable law.

Deleting a workspace

Workspace deletion is scheduled rather than immediate. The workspace becomes read-only for a 7-day grace period during which the deletion can be cancelled, so an accidental or hostile deletion can be reversed before anything is destroyed. After the grace period it is carried out and cascades to that workspace's records.

Closing an account

Account closure is not currently available inside the product. Send closure or deletion requests to privacy@tinycrm.biz. Requests involving shared workspaces may require coordination with other authorised users, so that one person's request does not improperly remove another person's data.

Point-in-time recovery

Our configured database point-in-time recovery window is six hours. This is the period available for restoring the database to an earlier state; recovery is not guaranteed. That number is a recovery window, not a deletion guarantee — it does not mean data is erased six hours after you delete it.

Separately, our database provider publishes a 30-day retention period for its encrypted backups. Information permanently removed from the live database may remain in provider backups. We cannot remove individual records from those backups, and the published retention period is not a guarantee that every copy of a particular record will be erased exactly 30 days after a request.

Application recovery is separate: records remain in Trash until permanently removed, and scheduled workspace deletion can be cancelled during its seven-day grace period.

• You can export contacts, companies, deals, projects, opportunities and tasks as CSV, with up to 50,000 rows per export, excluding records in Trash. Notes, activity history, uploaded files, tags and custom field values are not included in these exports. Files can be downloaded individually.
• Turn AI off per workspace, and keep every deterministic feature.
• Review and revoke sessions; enable two-factor authentication.
• Delete records, or a whole workspace.

To make a request about your Tiny CRM account information, email privacy@tinycrm.biz. Depending on applicable law, you may have rights to access, correct, delete or receive a copy of your personal data, or to object to or restrict certain processing. You may also have the right to complain to your local data-protection authority. We may request information needed to verify your identity. We will respond within applicable legal deadlines and explain any lawful exception that prevents us from fulfilling a request.

If your request concerns information a Tiny CRM customer has entered about you, contact that customer first. If you contact us directly, we will coordinate with the relevant customer and assist as required by law. Account closure is not currently available inside the product; requests can be sent to the email above. Some information may remain in backups or be retained for lawful purposes, as described in section 8.

Stating the limits plainly is more useful than implying more than is true:

• No certification is claimed — not SOC 2, not ISO 27001, not HIPAA.
• No zero-retention guarantee from any AI provider.
• No uptime or availability commitment.
• We do not maintain an independent off-provider backup. Our tested database recovery is held by the same provider within the same project. It is not protection against every form of account loss, project deletion or provider failure. Consider keeping your own exports, noting the export limitations described above.
• No recovery-time guarantee is offered.

Tiny CRM is a business tool and is not directed at children.

If this notice changes materially, we will give at least 30 days' notice by email to your account address. Changes required sooner by law may take effect sooner, with notice as appropriate.

Artifact Digital LLC, 178 N. Cuyamaca St., El Cajon, CA 92020, United States. Contact: privacy@tinycrm.biz. The governing-law and dispute provisions are set out in our terms of service and do not limit mandatory privacy rights.