Privacy policy
1. Who we are
Glime CRM ("Glime", "we") provides customer-relationship-management and configure-price-quote software at glimecrm.com. Glime is the data controller for the marketing site and your account information, and the data processor for the customer data you store in your workspace (your customers' records belong to you — see the DPA).
2. What we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, work email, company, password hash | Provide the service, authentication | Contract |
| Billing data | Plan, invoices; card details are held by Stripe, never by us | Billing, tax compliance | Contract, legal obligation |
| Workspace content | The CRM records you create | Processed only on your instructions | DPA / contract |
| Usage analytics | Page views, feature events, UTM attribution | Improve the product and marketing | Consent — collected only after you accept the banner |
| Diagnostics | Client error reports | Reliability | Legitimate interest |
3. What we don't do
- No selling or renting personal data. Ever.
- No advertising trackers or cross-site tracking; analytics are first-party and consent-gated.
- No training of shared AI models on your workspace content. AI features process your data to produce output for you, and that's where it ends.
4. Retention
Account data: life of the account plus 60 days. Workspace content: until you delete it, you cancel (60-day read-only export window, then deletion), or you exercise deletion rights. Backups age out within 35 days. Analytics events: 13 months.
5. Your rights (GDPR / CCPA)
Access, correction, portability, deletion, restriction, and objection. Two are self-serve in the product right now: export everything and delete my data (Settings → Your data). For the rest, email privacy@glimecrm.com — we respond within 30 days and don't discriminate against accounts that exercise rights.
6. International transfers
Primary processing occurs in the United States under Standard Contractual Clauses; EU residency for workspace content is available on Enterprise. Subprocessors and their regions are listed here with 30-day advance notice of changes.
7. Cookies
Strictly necessary: session cookie (signed-in users only). Optional: first-party analytics, set only after consent via the banner; decline and the site works identically. No third-party advertising cookies exist on this site.
8. Contact
privacy@glimecrm.com · {{COMPANY_LEGAL_NAME}}, {{COMPANY_ADDRESS_INLINE}} · Full contact routing and response times: Contact · EU representative: [to be appointed before EU launch].