Privacy policy
1. Who we are
Glime CRM ("Glime", "we") provides customer-relationship-management and configure-price-quote software at glimecrm.com. Glime is the data controller for the marketing site and your account information, and the data processor for the customer data you store in your workspace (your customers' records belong to you — see the DPA).
2. What we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, work email, company, password hash | Provide the service, authentication | Contract |
| Billing data | Plan, invoices; card details are held by our payment processors (PayPal at checkout, Stripe for invoiced plans), never by us | Billing, tax compliance | Contract, legal obligation |
| Workspace content | The CRM records you create | Processed only on your instructions | DPA / contract |
| Contact details you give us | Email, name, phone, company — from a newsletter, guide, demo or partner form, sign-up, sign-in, or checkout | Answer you, send what you asked for, marketing email if you subscribed, and the visitor history below | Contract / your request; marketing email only if you subscribe |
| Visitor history | A visitor ID cookie; every page you view on this site, with title, referring page, campaign (utm_*) parameters, Facebook click ID, device/browser and time — linked to your contact record once you give us your email, including pages you viewed before that | Understand which pages and campaigns lead to sign-ups and sales; follow up with people who have shown interest | On by default — switch it off with Reject optional (section 7) |
| Advertising (Meta) | See section 8 | Measure and target Facebook and Instagram ads | On by default — opt out under section 9 |
| Product analytics | Feature events inside the app | Improve the product | On by default — same switch as visitor history |
| Diagnostics | Client error reports | Reliability | Legitimate interest |
3. What we do and don't do
- We do not sell personal data for money. We do share marketing-site activity with Meta for advertising (section 8), which California law calls "sharing" and may treat as a "sale". You can opt out (section 9).
- Workspace content — the CRM records you and your team create — is never used for advertising, never shared with Meta, and never tracked by the Meta Pixel: the pixel and visitor tracking do not run inside the app.
- No training of shared AI models on your workspace content. AI features process your data to produce output for you, and that's where it ends.
4. Retention
Account data: life of the account plus 60 days. Workspace content: until you delete it, you cancel (60-day read-only export window, then deletion), or you exercise deletion rights. Backups age out within 35 days. Page views and analytics events: 13 months, then deleted automatically. Contact records from forms: until you ask us to delete them or unsubscribe and ask for removal. What Meta keeps is governed by Meta's own data policy.
5. Your rights (GDPR / CCPA)
Access, correction, portability, deletion, restriction, and objection. Two are self-serve in the product right now: export everything and delete my data (Settings → Your data). Both act on the server: the export streams your workspace's stored records and quotes, and the deletion removes them from our database — not merely from your browser. Deletion keeps your user accounts, billing history, and the audit log, so the workspace still exists to sign into and the erasure itself stays on the record; closing the account entirely is a request to support@glimecrm.com. An export returns what your role can see, so an administrator's export covers the workspace and a representative's covers their own records. For the remaining rights — including a copy or deletion of the contact record and page history we keep about you as a site visitor — email support@glimecrm.com. We respond within 30 days and don't discriminate against anyone who exercises their rights. To opt out of sharing with Meta, see section 9.
6. International transfers
Primary processing occurs in the United States under Standard Contractual Clauses; EU residency for workspace content is available on Enterprise. Subprocessors and their regions are listed here with 30-day advance notice of changes.
7. Cookies and local storage
Your signed-in session is a token held in your browser's local storage, not a cookie — clearing site data signs you out. The marketing site sets these cookies:
vid— our first-party visitor ID (random, one year), used for the visitor history in section 2._fbpand_fbc— set by the Meta Pixel to recognize your browser and an ad click (section 8).
Optional cookies are on unless you turn them off. The cookie popup explains this on your first visit and offers three categories, each with its own on/off control:
- Essential (always on) — your session token and the record of your choice. The site cannot work without them.
- Analytics (on by default) — the visitor ID and page history in our own database, and product analytics in the app.
- Advertising (Meta) (on by default) — the Meta Pixel and Conversions API, and remembering which campaign brought you here.
Choose Reject optional to turn both off; the site behaves identically. You can
change your mind at any time from Cookie choices in the footer of any page, or in
the app under Settings → Privacy & cookies. Switching a category off stops it immediately and
deletes what it had stored in your browser (including the vid, _fbp and
_fbc cookies).
8. Advertising: Meta Pixel and Conversions API
Unless you opt out, the marketing site (not the app) uses the Meta Pixel in your browser and Meta's Conversions API from our server. Meta Platforms, Inc. receives:
- the pages you view and the actions you take here — page views, viewing pricing, adding a plan to the cart, starting checkout, submitting a form, signing up, and purchases with their value;
- your IP address, browser user agent, and the
_fbp/_fbccookie values; - if you have given us them, your email, first and last name, phone number and our internal contact ID — always SHA-256 hashed before they leave your browser or our server, never in readable form.
Meta uses this to match the activity to Facebook and Instagram accounts, so we can measure which ads lead to sign-ups and purchases and show ads to people likely to be interested. Meta processes it under its own data policy.
9. Do Not Sell or Share My Personal Information
You can opt out of the sharing in section 8 at any time on our Do Not Sell or Share page (also linked in the footer of every page), or by turning off Advertising in Cookie choices. If your browser sends a Global Privacy Control signal, we treat it as an opt-out automatically. Once you opt out, the pixel no longer loads in that browser and our server stops sending your events to Meta — and if you have given us your email, it stops for every device we have linked to you. Opting out of sharing does not turn off our own first-party visitor history; use Reject optional for that, and email support@glimecrm.com to have the history we already hold deleted.
10. Contact
support@glimecrm.com · Glime Systems, 55 Tinson rd. Unit 1, Quincy, MA 02169 · Full contact routing and response times: Contact · EU representative: [to be appointed before EU launch].