Privacy Policy

1. Introduction

ShineCRM ("ShineCRM," "we," "us," or "our") is a software-as-a-service customer relationship management platform designed for exterior cleaning businesses. This Privacy Policy explains how we collect, use, share, store, and protect personal information when you use our mobile application, web dashboard, websites, and related services (collectively, the "Service").

ShineCRM is provided by SHINECRM CORP., based in Victoria, British Columbia, Canada. References to "ShineCRM" in this policy refer to this business and any successor entity.

This policy applies to:

• Customers: Businesses and individuals who sign up for and use ShineCRM (typically exterior cleaning companies, sole proprietors, and their employees).
• End Clients: The customers of our Customers, whose information our Customers enter into the Service (homeowners, property managers, etc.).
• Website Visitors: Anyone who visits our marketing website at shinecx.com or related domains.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

2. Plain-Language Summary

We've written this policy in detail to be transparent and legally complete. Here's the short version:

• ShineCRM is early-access, experimental software run by a solo developer, provided as-is and at your own risk. Protections are expected to grow as the product matures.
• To support you and improve the product, our founder and authorized personnel may access your data and your customers' data, including the content of messages, at the operator's discretion, for support, debugging, product development, and other operational purposes. The AI activity log below is one example of that access.
• We collect what we need to run the Service: your account info, the data you put into ShineCRM, and standard technical data like IP addresses and device info.
• We use Stripe for payments. We never see, store, or handle your credit card numbers directly.
• AI is a core part of the Service. We use AI to read, analyze, and generate responses to all communications processed through ShineCRM, and we use that data to operate and improve our AI models.
• Customers can opt out of AI training at any time. AI inference (using AI to help with your work) cannot be disabled while using AI features.
• We do not sell your personal information.
• Our founder and authorized support personnel may access Customer Data, including the content of your customers' messages, to operate, debug, and support the Service. To run and support our AI features, the full text we send to our AI providers and the full text they send back is recorded in an internal AI activity log that authorized ShineCRM staff can review across organizations. Those raw AI logs are automatically deleted 30 days after each AI call, leaving only metadata (organization, model, token counts, cost, and outcome). Other cross-tenant administrative dashboards continue to show metadata only. Every staff access to your records is recorded in an audit log that your administrators can review. See Sections 7.6 and 15.1.
• We use trusted third-party services (Supabase, Stripe, Twilio, Resend, Anthropic, OpenAI, Google, Cloudflare, GitHub, Cursor, and others) to operate. They process data on our behalf.
• When you report a bug, we collect what you write plus technical context and a link to the relevant session replay, and we may use development tools (including GitHub for issue tracking and AI coding assistants such as Cursor) to diagnose and fix it. Please do not include your End Clients' personal details in bug reports. See Section 4.4.
• Our servers are currently located in the United States.
• You have rights over your data: access, correction, deletion, portability, and more. Email sean@shinecx.com to exercise them.
• You must be 18 or older to use the Service.

3. Who We Are and How to Contact Us

Business Name: SHINECRM CORP. (ShineCRM)
Mailing Address: 1279 Derby Rd, Victoria, BC, Canada
Privacy Contact Email: sean@shinecx.com

For all privacy-related questions, requests, or complaints, email sean@shinecx.com. We respond to verified requests within 30 days.

4. Information We Collect

4.1 Information You Provide to Us (Customer Account Data)

When you sign up for and use ShineCRM as a Customer, we collect:

• Identity Information: Name, business name, job title.
• Contact Information: Email address, phone number, business address, mailing address.
• Account Credentials: Username, password (stored as a salted hash, never in plain text).
• Billing Information: Subscription tier, billing history, and limited payment metadata. Full payment card details are collected and stored by Stripe, not by ShineCRM. We receive only tokenized references and basic transaction data from Stripe.
• Communications with Us: Support emails, chat messages, survey responses, and feedback.
• Marketing Preferences: Whether you have opted in to marketing emails.

4.2 Information You Enter Into ShineCRM (End Client Data)

As a Customer, you may enter, upload, or generate the following information about your End Clients:

• Names, addresses, email addresses, phone numbers.
• Photos and other images exchanged with End Clients via SMS or email.
• Service history, estimates, invoices, and payment history.
• Notes, tags, and custom fields you create.
• SMS message content and metadata exchanged with End Clients via the Service.
• Call recordings and call metadata, where the calling feature is used.
• Email content and metadata exchanged through the Service.
• Job schedules, location data tied to jobs, and route information.

You are the controller of this End Client data. ShineCRM acts as your processor and handles this data on your behalf, in accordance with your instructions and this policy.

4.3 Information Collected Automatically

When you or your End Clients interact with the Service, we automatically collect:

• Device Information: Device type, operating system, OS version, app version, browser type and version, screen size, language, and time zone.
• Network Information: IP address, internet service provider, approximate geographic location derived from IP address.
• Usage Data: Pages visited, features used, buttons clicked, session duration, referral source, error logs, crash reports, and timestamps of activity. In the mobile app and the web dashboard, this usage data is tied to your account and your organization and is collected as part of the Service, so there is no separate analytics setting to switch it off; we use it to operate the Service, find and fix problems, and decide what to improve. On our marketing website, analytics cookies are subject to the choice described in Section 9. Session replay is separate and is described below.
• Service reliability record: Across our website, dashboard, customer portal, and signed-in mobile app, we record page or screen views, clicks or taps, request outcomes, timing, and changes to records. This record contains identifiers and source-defined interface labels, not form entries, message text, file contents, or URL query strings. Anonymous website and portal activity uses a random visitor identifier, which can link to your organization when you sign up. We retain this record for 90 days and restrict it to authorized platform administrators. Mobile crash reporting can run while signed out. This operational record is separate from PostHog session replay.
• Session Replay: We use PostHog session recordings to reproduce and fix problems in your account and improve how our interfaces work. Recordings show screen activity, including pages or screens visited, taps, clicks, and scrolling.

  Mobile app. We ask once before recording and save your choice for your signed-in account on that device. Recording stays off until you allow it. You can change your choice in Settings → Session recording. We configure text and image masking to reduce captured content.

  Web dashboard. Recording is on by default after sign-in and after we load your account preference. You can turn it off in Settings → Account → Session recording without losing access to ShineCRM. This stops future recordings. Your choice is saved to your account; other open devices check it when the dashboard becomes visible and approximately once a minute while active. We configure text and form masking, redact most element attributes and page identifiers, block images, embedded documents and media, and exclude network request payloads and console logs. Authentication, onboarding, Settings, billing and administration pages are excluded from dashboard recording.

  Masking has limits. These safeguards reduce collection but can miss information. Recordings may include customer names, addresses, job details, estimates, invoices, messages, or other personal or sensitive information shown on screen. Dashboard recordings are associated with your account and organization; masking does not make them anonymous. We do not promise that all personal or sensitive information will be excluded. Error reporting and product usage analytics continue separately when recording is off. Call recording has its own settings.

  Marketing website. We record page activity to find problems and improve the website. We configure form-entry masking and exclude embedded frames and network payloads; masking can miss content. Recording begins after the region check for visitors identified in the United States or Canada outside Quebec, and when the region cannot be determined, unless a prior choice prevents it. For visitors identified elsewhere, including Quebec, the European Economic Area, the United Kingdom, and Switzerland, recording requires acceptance. The website presents one analytics choice for cookies and session recordings, with more information under Details. You can change that choice in Cookie choices in the footer.

  Customer portal. The customer portal does not use PostHog session recording.

  Handling recordings. PostHog processes recordings for us, and authorized ShineCRM personnel can access them for the purposes above. Recordings are configured for 30-day retention. Turning recording off does not itself delete earlier recordings; contact us using Section 21 for withdrawal or deletion requests, including requests concerning further use of existing recordings.

• Mobile Location Data: Precise GPS location, when you grant the mobile app permission, used to support job routing, check-ins, and time tracking.
• Web Location Data: Approximate location derived from IP address, and precise location if you grant browser permission.
• Push Notification Tokens: Device-level identifiers used to deliver in-app and system notifications.
• Cookies and Similar Technologies: See Section 9.

4.4 Bug Reports and Diagnostic Data

When you submit a bug report through the Service, we collect the title, description, and reproduction steps you provide, together with technical context (the screen or route you were on, platform, operating system, device model, and app version), the email address associated with your account, and a link to the relevant session replay described in Section 4.3. To investigate and resolve reported issues, this information may be recorded in our internal issue-tracking and source-code tools (including GitHub) and processed by AI-assisted debugging and code-fixing tools (including Cursor) and the AI providers listed in Section 7.1, each acting as a service provider on our behalf. Bug reports are accessible only to authorized ShineCRM personnel and the service providers described above. Because the free-text fields of a bug report are written by you, you should not include End Client personal information or other sensitive data in them; the Service captures the necessary technical context automatically. See Section 18 (Customer Responsibilities).

4.5 Mobile Device Permissions

When you use the ShineCRM mobile app, we may request the following device permissions. Each permission is requested only when needed for the relevant feature, and you may revoke any of them at any time through your device's system settings.

• Camera: To take photos to attach to customer messages. Photos are only created and stored when you explicitly take or attach them.
• Microphone: To make and receive business phone calls through our in-app calling feature (powered by Twilio), and to record calls where the call recording feature is enabled and used.
• Photos and Media Library: To choose existing images from your device's photo library for your organization logo, customer contact cards, service photos shown on customer estimates, and message attachments.
• Location: To support job routing, on-site check-ins, and time tracking. Precise location is only collected when you grant permission and only while the relevant feature is in use. See also Section 4.3 (Mobile Location Data).
• Notifications: To deliver alerts for incoming calls, SMS messages, job updates, payment events, and other Service activity.
• Contacts (optional): If you choose to import contacts from your device, we use this permission to read selected contact entries you choose to import. We do not upload your full address book without your action.
• Phone State: On Android, used by the in-app calling feature so the app can manage call audio routing and respond appropriately when a native phone call interrupts an in-app call.

4.6 Information from Third Parties

We may receive information about you from:

• Stripe: Subscription status, payment outcomes, refund records.
• Analytics and Error Tracking Tools: Data about Service performance and usage, including aggregated statistics and the session replay recordings described in Section 4.3.
• Marketing and Referral Sources: If a third party refers you to us, we may receive limited information from that referral.

4.7 AI and Machine Learning Data

The Service includes AI-powered features (automated message drafting, summarization, transcription, lead scoring, scheduling assistance, and similar functions). To deliver these features, we send relevant data to AI service providers including Anthropic, OpenAI, and Google (Gemini). See Sections 7 and 8 for details on how AI inference and training work.

To operate, monitor, debug, and support these AI features, we record the full text we send to the AI provider and the full text it returns in an internal AI activity log. Authorized ShineCRM personnel can review this log across organizations for those limited purposes. Every such review is recorded in the audit log described in Section 15.1 (which your administrators can review), and the raw request and response text is automatically deleted 30 days after each call, leaving only metadata. See Sections 7.6, 14, and 15.1 for the access controls, audit logging, retention, and lawful basis that apply.

5. How We Use Your Information

5.1 To Provide the Service

• Create and manage your account.
• Process payments and subscriptions through Stripe.
• Deliver core features: contacts, estimates, jobs, invoices, scheduling, messaging, and reporting.
• Send transactional notifications (account updates, payment receipts, security alerts, service announcements).
• Provide customer support.
• Sync data between mobile and web platforms.

5.2 To Operate AI Features (Inference)

• Read, analyze, and process all inbound and outbound communications (SMS, email, calls, voicemails, notes) handled through the Service.
• Generate suggested replies, drafts, summaries, transcripts, lead scores, scheduling suggestions, and other AI-assisted outputs.
• Detect anomalies and flag items needing attention.
• Record the request text we send to AI providers and the response text they return in an internal AI activity log, so that authorized ShineCRM personnel can operate, monitor, debug, and support the AI features. See Sections 7.6 and 15.1 for the access controls, audit logging, and 30-day retention that apply to this log.

AI inference is a core part of the Service and cannot be disabled while using AI-dependent features.

5.3 To Train and Improve AI Models (Future Use)

We currently use third-party AI APIs (Anthropic, OpenAI, and Google) to power AI features. Under those providers' API terms, data submitted via their APIs is not retained for model training by default.

We may, in the future, use Customer Data (including communications processed through the Service) to train and improve AI models that power ShineCRM, but only using (a) data that has been de-identified, anonymized, or aggregated so that it no longer identifies any individual, and/or (b) Customer Data of Customers who have opted in to AI training and have not opted out. For personal information of End Clients who are residents of California, the EEA, or the UK, ShineCRM acts solely as a service provider and processor and does not use that personal information for AI training or any other purpose of its own, except in de-identified, anonymized, or aggregated form (see our Data Processing Agreement and Section 6.3 of the Terms of Service). Trained models may be used to benefit all ShineCRM users. We are disclosing this intent in advance so that ongoing use of the Service constitutes notice; if this practice begins, we will update this policy with the effective date.

Customers can opt out of AI training at any time through account settings or by emailing sean@shinecx.com. Opting out applies to future training; we cannot retrain or roll back models that have already incorporated data, as this is not technically feasible.

Where Customers have not opted out, the use of Customer Data for AI training is permitted under our Terms of Service. Customers represent and warrant that their own privacy notices and agreements with End Clients permit this processing. See Section 18 for Customer responsibilities.

ShineCRM (and any successor entity) owns all AI models, including any models trained or improved using Customer Data.

5.4 To Improve and Develop the Service

• Analyze how Customers use the Service to identify bugs, performance issues, and feature opportunities.
• Conduct internal research and product development.
• Test new features.

5.5 To Communicate with You

• Send transactional messages required to operate your account.
• Send marketing emails about new features, tips, and offers, only if you have opted in. You can unsubscribe at any time using the link in any marketing email.
• Respond to your inquiries.

5.6 To Protect the Service and Comply with Law

• Detect, investigate, and prevent fraud, abuse, security incidents, and policy violations.
• Enforce our Terms of Service.
• Comply with legal obligations, court orders, and lawful government requests.
• Establish, exercise, or defend legal claims.

5.7 With Your Consent

For any purpose disclosed to you at the time we collect the information or with your consent.

6. Legal Bases for Processing

(For users in the EEA, UK, and similar jurisdictions)

Where applicable law requires us to identify a legal basis for processing personal information, we rely on:

• Performance of a Contract: To provide the Service you have signed up for.
• Legitimate Interests: To operate, secure, and improve the Service, train and improve AI models that power the Service, prevent fraud, conduct internal analytics, and operate, monitor, debug, and support our AI features, including maintaining the internal AI activity log and providing the staff support access described in Sections 7.6 and 15.1, where these interests are not overridden by your rights. We have assessed that this processing is necessary for these interests and is balanced by the safeguards described in those sections (least-privilege access, audit logging that affected administrators can review, and 30-day deletion of raw AI content).
• Consent: For marketing emails, optional cookies, and any other processing where consent is required. You may withdraw consent at any time.
• Legal Obligation: To comply with applicable laws and regulations.

For End Client data, ShineCRM acts as a processor on behalf of Customers, who are responsible for establishing the legal basis for processing under their own agreements and notices to End Clients. Our processing of End Client data on a Customer's behalf, including the operating and support access and the AI activity log described in Sections 7.6 and 15.1, is carried out on the Customer's documented instructions and is governed by our Data Processing Agreement.

7. How We Share Your Information

We share personal information only as described below. We do not sell personal information.

Mobile numbers and text messages. We do not sell, rent, or share your mobile phone number or your consent to receive text messages from ShineCRM with third parties or affiliates for their marketing purposes. The only parties that handle them are the service providers that deliver our messages, such as Twilio, on our instructions. See our text messages page for how ShineCRM's own texts work.

Enterprise inquiries. We collect the email and phone number you submit, validated source/campaign details where allowed by your consent choices, and security information needed to prevent spam. We save the inquiry in a restricted lead record to respond and follow up about Enterprise. Inquiry submission does not provide marketing or SMS subscription consent. Raw inquiry email and phone are not sent to product analytics. A verified identity or private administrative review is required to link the lead to an organization and confirmed subscription payment.

7.1 Service Providers (Sub-Processors)

We share information with third-party service providers who help us operate the Service. These providers are contractually required to handle data securely and only on our instructions. Our current sub-processors include:

We may add, remove, or replace sub-processors as our infrastructure evolves. We will update this list when material changes occur.

7.2 With Your Customers and Their Authorized Users

If you are a Customer, your authorized team members can access the data in your ShineCRM account. If you are an End Client of one of our Customers, your data is accessible to that Customer and their authorized users.

7.3 Business Transfers

If ShineCRM is acquired, merged, sold, or otherwise transfers ownership or assets, your information may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and your rights regarding your data.

7.4 Legal and Safety

We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, enforce our Terms of Service, protect the rights or safety of ShineCRM or others, or detect and prevent fraud and security issues.

7.5 With Your Consent

We may share information for any other purpose disclosed to you and with your consent.

7.6 ShineCRM Internal Access

Because ShineCRM is early-access software built and run by a solo developer, ShineCRM's founder, Sean van Gessel, and any authorized support personnel may access Customer Data and End Client Data, including the content of communications processed through the Service, at the operator's discretion, for support, debugging, troubleshooting, monitoring AI behavior, product development and improvement, operating administrative tooling (including the AI activity log described in this Section and Section 15.1), enforcing our Terms of Service, and complying with legal obligations. By using the Service you agree to this access, as set out in Section 6.7 of the Terms of Service. We expect to narrow this access and add further safeguards as the product matures.

We aim to keep this access to what we reasonably need. Most cross-tenant administrative dashboards display aggregate metrics and structural metadata only, for example: organization name, billing usage, AI model identifiers, token counts, decision outcomes, latency, and cost. Raw Customer Data such as SMS and email message bodies and call recordings is not duplicated into those dashboards; it remains in tenant-scoped tables that authorized personnel can access under the controls described below and in Section 15.1.

AI activity log. One specific example of this access is the AI activity log. To operate, monitor, debug, and support our AI features, ShineCRM maintains an internal AI activity log. For every AI feature, this log records the full text we send to the AI provider and the full text the AI provider returns. The text we send can include the content of your customers' messages, your team's notes, call transcripts, and other Customer Data that the relevant feature passes to the AI, and the text returned can include AI-drafted reply bodies. Authorized ShineCRM personnel holding the super-administrator role can view these raw AI request and response records across organizations through the administrative surface, for the limited purposes of operating, supporting, and debugging the AI service on your behalf. We rely on this exception because we cannot reliably diagnose and support AI behavior without seeing what was actually sent to and returned by the AI provider.

We apply specific safeguards to this access:

• Least-privilege gating. Access to Customer Data, and in particular to the AI activity log, is gated behind an explicit super-administrator role. The list of users holding this role is small (initially: the founder only) and is maintained internally.
• Audit logging you can review. Every access by ShineCRM personnel to a specific Customer's records through the administrative surface, including each time a raw AI activity log entry is opened, is recorded in an append-only access log. The log captures the identity of the accessor, the action taken, the table and row identifier accessed, the affected organization, and the time of access. Tenant administrators can view the access log entries that touched their own organization through their account dashboard, and may also request a copy by emailing sean@shinecx.com. We will produce the log in response to a data subject inquiry, a regulator request, or a court order.
• Short retention of raw content. The raw request and response text in the AI activity log is automatically and permanently deleted 30 days after each AI call by a scheduled process, after which only metadata (organization, AI surface, model, token counts, cost, and success or error status) remains.
• Deletion on organization deletion. All AI activity log records for an organization, including any remaining metadata, are deleted when that organization is deleted.

Lawful basis. ShineCRM carries out this access and logging as your service provider and data processor, on your instructions, to provide and support the Service. Where data protection law requires a lawful basis, we rely on the performance of our contract with you and on our legitimate interests (and yours) in operating, securing, debugging, and supporting the AI features, balanced against the rights of affected individuals. This basis is recognized under PIPEDA and BC PIPA, under Quebec Law 25, and under Article 6(1)(f) of the GDPR and UK GDPR (legitimate interests). Under the California Consumer Privacy Act and California Privacy Rights Act, ShineCRM acts as a service provider: we do not sell or share this data and we do not use it for any purpose other than providing the Service. Our processing of End Client Data, including the AI activity log, is governed by our Data Processing Agreement, and you remain responsible for the disclosures and consents your own privacy notice must provide to your End Clients (see Sections 5.3 and 18).

8. International Data Transfers

ShineCRM is operated from Canada, and most of our infrastructure is located in the United States. If you are accessing the Service from outside Canada or the United States, your information will be transferred to, processed in, and stored in the United States and other countries where our service providers operate.

These countries may have data protection laws that differ from those in your country. By using the Service, you acknowledge and agree to the transfer of your information to these jurisdictions.

Where the Service is offered. ShineCRM is offered in the United States and in Canada excluding Quebec, and we do not onboard customers or personal information originating in Quebec, the European Economic Area, the United Kingdom, or Switzerland. We have not executed Standard Contractual Clauses, the UK International Data Transfer Addendum, or a transfer risk assessment, we do not maintain an EU or UK representative, and we do not represent that we have. If we expand to those regions, we will put appropriate transfer mechanisms in place before processing that personal information and will update this policy. Section 12 of our Data Processing Agreement states the same position for End Client data.

9. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, pixels, local storage, and similar technologies on our website and dashboard to keep you signed in, remember your preferences, measure and analyze how the Service is used, detect and prevent fraud, and deliver and measure marketing campaigns.

On our marketing website, analytics cookies are set only if you accept them. Without them, we measure visits using memory-only analytics without remembering the browser across visits. The compact banner offers one analytics choice for cookies and session recordings, with Accept, Decline, and Details. Accept enables both; Decline disables both. Previously saved choices remain in effect until you make a new choice, including any earlier separate refusal. Recording defaults depend on the region check described in Section 4.3. Cookie choices in the footer reopens the choice. Declining removes the stored analytics identifier and stops future replay. Necessary storage remembers your choices.

Personalized marketing links: When we send a prospect a unique link to our website and the visitor accepts analytics, we associate pages visited, visit times, and available PostHog recording links with that prospect’s lead record in our internal Cold to Hot app. This helps our team understand interest and follow up. The link contains a random token, not a name or email address. With analytics accepted, we remember the token in browser local storage for 30 days after the latest attributed page visit. Declining analytics removes that token and stops future lead attribution. Recordings still follow the recording choices described above. A forwarded link can attribute someone else’s visit to the original prospect; the link does not verify the visitor’s identity.

In the signed-in dashboard and mobile app, we use cookies and local storage to keep you signed in and to operate the analytics and session replay described in Section 4.3, on the legal bases described in Section 6.

Advertising measurement: if you reach our site from an ad, the advertising platform adds a click identifier to the link (for example Google's gclid), alongside campaign labels such as utm_source. We carry those identifiers, the page you landed on, and the time of the click through to our signup form, and store them on the business account if you create one, so we can tell which campaigns produce customers. They are not stored on your device. Where a visitor arrives from a ShineCRM ad and then creates an account, we share that ad click identifier with Google so that Google can measure which ads produced signups. We do not send the signup email address or a hash derived from it. Signups that did not follow an ad click have no click identifier and are not reported this way, and nothing else you type on this site is sent with it.

You can also control cookies through your browser settings. Disabling certain cookies may affect functionality.

10. Data Retention

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy.

• Active Accounts: We retain your account data for as long as your account is active.
• Subscription cancellation and account deletion: When new Starter service ends without continuing payment, operational access stops. Canceling a subscription does not automatically delete CRM data or begin a new export deadline. Your saved data stays in place, and billing remains available to resume the subscription. Permanent account deletion follows the existing requested-deletion process. Necessary billing, payment, consent, and legal records are retained for their disclosed purposes. Existing contracts retain their previously agreed cancellation and export terms. After you permanently terminate or delete your account, we delete or anonymize your account data and End Client data within 30 days, except where retention is required for legitimate business or legal purposes. When you delete your account, we retain only the minimal records needed for those purposes, for only as long as those purposes require.
• AI Activity Log: The full request and response text recorded in our internal AI activity log (see Sections 7.6 and 15.1) is automatically deleted 30 days after each AI call. After that, only metadata (organization, AI surface, model, token counts, cost, and success or error status) is retained, and all of an organization's AI activity log records are deleted when that organization is deleted.
• Backups: Deleted data may persist in encrypted backups for a limited period before being overwritten.
• Stripe Data: Payment-related records held by Stripe are retained according to Stripe's policies and applicable financial regulations.
• Anonymized and Aggregated Data: Once irreversibly anonymized or aggregated, data may be retained indefinitely for analytics, research, and AI model improvement.
• AI Models: If we use Customer Data to train AI models in the future (see Section 5.3), those models may be retained indefinitely. Account deletion would not remove a Customer's prior data contribution from previously trained models, as retraining or rolling back models is not technically feasible.
• Legal Holds: We may retain information longer when required by law or to establish, exercise, or defend legal claims.

11. Your Privacy Rights

Depending on where you live, you may have the following rights over your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Restriction: Request that we limit how we process your information.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw consent for processing that is based on consent.
• Opt Out of AI Training: Customers can opt out at any time through account settings or by emailing sean@shinecx.com.
• Automated Decisions: Request human review of significant decisions made solely by automated means.
• Non-Discrimination: Not be discriminated against for exercising your rights.
• Complain to a Regulator: Lodge a complaint with your local data protection authority.

To exercise any of these rights, email sean@shinecx.com. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

If you are an End Client whose data was entered into ShineCRM by one of our Customers, please direct your request to that Customer first, since they control your data. We will assist them in fulfilling valid requests.

Objecting to or stopping the AI activity log. The AI activity log records the text exchanged with AI providers as part of operating the AI features on the Customer's instruction. Because the Customer (operator) controls whether AI is used for a given individual, the operative way to stop further AI processing of an individual is for the Customer, as controller, to cease AI processing for that individual (for example, by disabling the relevant AI feature or excluding that End Client) or to delete the organization. ShineCRM will honor a documented controller instruction to stop AI processing for a given End Client. Raw content already recorded is deleted 30 days after each AI call (see Section 10), and all AI activity log records are deleted when the organization is deleted.

Self-Serve Options

You can exercise most rights directly within the Service: export your data from your account dashboard, edit your account information, delete portions of your account data, toggle AI training opt-out, and permanently delete your entire organization and account from the mobile app (Settings → Delete account) or from the web operator dashboard. Deletion is immediate and cascades through all of your organization’s data, cancels any active subscription, and releases any provisioned phone number. If you need help with deletion or want to verify it completed, email sean@shinecx.com.

12. Region-Specific Disclosures

12.1 Canada (PIPEDA, Quebec Law 25, BC PIPA)

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and BC's Personal Information Protection Act (PIPA). You have the right to access and correct your personal information and to file a complaint with the Office of the Privacy Commissioner of Canada or your provincial regulator.

For Quebec residents: ShineCRM's Privacy Officer is Sean van Gessel, reachable at sean@shinecx.com.

12.2 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have the rights described in Section 11. You may also lodge a complaint with your local supervisory authority. ShineCRM does not currently maintain an EU representative. For privacy inquiries, contact sean@shinecx.com.

12.3 California (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know, correct, delete, and opt out of sale or sharing. ShineCRM does not sell or share personal information for cross-context behavioral advertising.

To exercise California rights, email sean@shinecx.com.

12.4 Other US States

Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others) may have similar rights. Contact sean@shinecx.com to exercise these rights.

13. Marketing and Anti-Spam Compliance (CASL)

If you are in Canada, we comply with Canada's Anti-Spam Legislation (CASL). We send marketing emails only to recipients who have provided express or implied consent. Every marketing email includes our identity and contact information and a clear and functional unsubscribe link that takes effect within 10 business days.

Transactional and account-related messages are sent regardless of marketing preferences and do not require separate consent. You can opt out of marketing at any time by clicking unsubscribe in any marketing email or emailing sean@shinecx.com.

14. Automated Decision-Making and AI

ShineCRM uses automated processing and AI to support core features, which may include lead scoring and prioritization, automated message drafting and suggested replies, pricing suggestions, schedule optimization and route planning, call transcription and summarization, and anomaly detection.

These features assist Customers in making decisions but do not produce legal or similarly significant effects on End Clients without human review by a Customer. If you believe an automated decision has had a significant effect on you and you would like human review, contact sean@shinecx.com.

To operate, monitor, debug, and support these features, ShineCRM records the text exchanged with AI providers in an internal AI activity log. The least-privilege access controls and audit logging that govern that log are described in Sections 7.6 and 15.1, and the 30-day retention of its raw content is described in Section 10.

15. Security

We take reasonable technical and organizational measures to protect personal information, including encryption of data in transit using HTTPS/TLS, encryption of data at rest, Row-Level Security (RLS) policies in our database, salted password hashing, access controls limiting production database access to authorized personnel, and security monitoring and error tracking.

No security system is perfect. You are responsible for keeping your password secure and notifying us immediately if you suspect unauthorized access. In the event of a data breach, we will notify you and applicable regulators as required by law.

15.1 Internal Access Controls and Audit Logging

Production database access is limited to authorized personnel. Tenant data is segregated by Row-Level Security policies that scope every read and write to the calling user's organization. Cross-tenant access by ShineCRM personnel is gated behind an explicit super-administrator role recorded in a dedicated database table.

Every action taken by a super administrator against tenant-identifiable records through the administrative dashboards, including viewing the AI decisions log, opening a specific decision record, opening a raw AI activity log entry (the full request sent to, or response returned by, an AI provider), editing a global AI prompt or trigger setting, editing a tenant's AI instructions, cancelling a scheduled follow-up, clearing a contact's AI timer, or dismissing a Suds suggestion, is recorded in an append-only audit log. Each entry captures the identity of the accessor (auth user ID and email), the action performed, the table name and row identifier touched, the affected organization identifier, the time of access, and any contextual metadata about the action.

Audit log entries cannot be modified or deleted by any application user, including super administrators. Tenant administrators can view the audit log entries that touched their own organization at any time through their account dashboard, and may request a copy or export by emailing sean@shinecx.com. Audit log entries are retained for a minimum of twenty-four (24) months.

The AI decisions metadata surface stores structural metadata about each autonomous AI decision (model identifier, token counts, decision outcome category, latency, cost, and structural counts of messages and follow-ups passed to the model) and does not by itself store the conversation text.

Separately, to operate, monitor, debug, and support the AI features, ShineCRM maintains an internal AI activity log that, for every AI feature, records the full text sent to the AI provider (which can include conversation text and other Customer Data passed to the AI) and the full text returned (including AI-drafted reply bodies). Authorized personnel holding the super-administrator role can view these raw records across organizations through the administrative surface, for that limited purpose. Every such view is itself recorded in the append-only audit log described above, which the affected tenant's administrators can review. To limit how long this content is retained, the raw request and response text is automatically and permanently deleted 30 days after each AI call by a scheduled process (see Section 10), after which only metadata (organization, AI surface, model, token counts, cost, and success or error status) remains. AI activity log records are restricted to the super-administrator role by Row-Level Security policies, and they are deleted when the related organization is deleted.

16. Children's Privacy

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it. Contact sean@shinecx.com if you believe a child has provided us with personal information.

17. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services that we do not operate. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing them with personal information.

18. Customer Responsibilities

If you are a Customer using ShineCRM to manage End Client data, you are responsible for maintaining your own privacy notice and service agreements with End Clients that disclose the use of third-party software, AI processing, call recording, and data sharing; obtaining all consents required by applicable law; honoring privacy rights requests from End Clients; and configuring the Service in compliance with applicable law.

You are also responsible for ensuring that any bug reports, support requests, or other free-text submissions you send to us do not include End Client personal information or other sensitive data that is not necessary to resolve your request. The Service automatically captures the technical context needed to diagnose issues, so you do not need to include personal details in a report.

ShineCRM provides template language that Customers may incorporate into their own privacy notices as a starting point. Use of the template does not constitute legal advice; Customers should consult their own counsel.

Our Data Processing Agreement (DPA) governs how ShineCRM processes End Client Data on your behalf as your processor, including the operating and support access, AI activity log, sub-processors, security measures, breach notification, and deletion terms described in this policy. By accepting our Terms of Service at sign-up, you also agree to the DPA. If you require a countersigned copy, email sean@shinecx.com.

19. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 7 days before the changes take effect. For minor changes, we may make changes effective immediately with notice posted in the Service or on our website. For changes required by law or to address urgent security matters, changes may take effect immediately.

Your continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes.

20. Governing Law and Disputes

This Privacy Policy is governed by the laws of the Province of British Columbia and the federal laws of Canada applicable in BC. Any disputes arising out of or related to this Privacy Policy will be resolved in accordance with the dispute resolution provisions of our Terms of Service, except where applicable law provides you with a non-waivable right to seek resolution elsewhere.

21. Contact Us

Email: sean@shinecx.com
Mailing Address: 1279 Derby Rd, Victoria, BC, Canada