This Privacy Policy describes how ClivoCRM (the "Service"), available at crm.clivo.io, accesses, uses, stores, shares, and deletes information, including data obtained from third-party platforms such as Google and Meta. By using the Service you agree to this Policy.
When you explicitly connect a third-party account, we access only the data required to deliver the feature you enable, using the permissions you grant. This may include data from Google (Gmail, Calendar, Contacts), Meta (Facebook Lead Ads, WhatsApp Business), Slack, Notion, Zoom, Calendly, and Typeform.
When you connect a Google account, ClivoCRM requests the following OAuth scopes. We use each scope only for the purpose stated below and for no other purpose.
| Google OAuth scope | How ClivoCRM uses it |
|---|---|
gmail.readonly | To read and display your emails inside the CRM's unified inbox, and to associate emails with the relevant contact. |
gmail.send | To send an email that you compose and explicitly choose to send from within the CRM. |
gmail.modify | To create email drafts and to change message state you initiate (mark read/unread, apply labels) on your behalf. |
calendar.readonly | To read and display your calendar events inside the CRM. |
contacts.readonly | To read your Google contacts so you can reference and import them into the CRM. |
ClivoCRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, with respect to data obtained through the Gmail, Google Calendar, and Google Contacts scopes listed above (the "Google user data"):
If you connect a Meta product (e.g. Facebook Lead Ads or WhatsApp Business), we access only the data needed to deliver that feature — for example, retrieving leads you have authorized, or sending and receiving WhatsApp messages you initiate. We use this data solely to provide the connected feature, do not sell it, and delete it in accordance with Section 6 and Meta's requirements.
We do not use data from sensitive or restricted scopes for any purpose other than those explicitly disclosed in this Policy.
Data is stored on Supabase (PostgreSQL) infrastructure. Integration credentials and API keys are encrypted at rest. Access is restricted by database row-level security and is limited to the account that owns the data. OAuth tokens are held by us or by our integration broker and are used only to provide the features you enable. We apply administrative, technical, and organizational safeguards designed to protect your data.
We retain your data while your account is active and for as long as needed to provide the Service. You can control and delete data at any time:
When you disconnect Google, we delete the stored Google tokens and any synced Google user data we hold for that connection. When you disconnect or delete a Meta connection, we delete the associated Meta data we hold.
We do not sell your personal data. We share data only with sub-processors that operate the Service (such as Supabase for hosting and Nango for OAuth connection management), with the third-party services you choose to connect, and where required by law.
Subject to your jurisdiction, you may have rights to access, correct, export, restrict, or delete your personal data. Contact us to exercise these rights.
The Service is not directed to children under 16 and we do not knowingly collect their data.
We may update this Policy. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice within the Service.
Clivo Ventures Private Limited
Privacy & Data Requests: support@clivotech.io
Note for operators: Before final submission, confirm the contact email is monitored, set up a Meta "Data Deletion Instructions URL" pointing to Section 6, and have this Policy reviewed by qualified legal counsel for your jurisdiction.