BasicCRM Privacy Policy

Effective date: October 19, 2026

BasicCRM is a simple CRM for small B2B teams that work in Google Workspace and Gmail. This policy explains what information we collect, why we collect it, who we share it with, and the choices you have. We have tried to keep it short and plain.

1. Who we are

BasicCRM (https://basiccrm.io) is operated by Spottsco LLC ("Spottsco," "BasicCRM," "we," "us").

Business address: Spottsco LLC, 12904 ElRond Drive, Oklahoma City, OK 73170
Support and privacy questions: support@basiccrm.io
Legal notices: david@spottsco.com

2. Two kinds of data, two roles

BasicCRM holds two kinds of information:

Account data about the people who use BasicCRM (you and your teammates). For this data, we decide how it is used, as described in this policy.
Customer data that your team puts into your workspace: contacts, companies, deals, notes, calls, next steps, and logged email. This data belongs to your organization. We process it only to provide BasicCRM to you, following your instructions and our Terms of Service.

If you are someone whose details were added to a BasicCRM customer's workspace (for example, a customer of theirs), that organization controls your information. Please contact them first. We will help them respond to your request.

3. Information we collect

You sign in with Google. Sign-in requests only the basic openid, email, and profile permissions. From that we receive your name, email address, and profile photo (if Google provides one). We do not receive your Google password.

Information your team enters

Contacts, companies, deals, pipeline stages, notes, calls, next steps, email drafts, and email signatures that you or your teammates add by hand, through a CSV import, from the Gmail sidebar, or through a connected AI assistant (see Section 5).

Email you choose to log

BCC or forward. Each workspace has its own private logging address (in the form log-<token>@in.basiccrm.io). When you BCC or forward a message to it, our inbound email provider receives it and passes it to BasicCRM. We store the message only if the sender or a recipient (From, To, or Cc) matches a contact that already exists in your workspace. Everything else is dropped and not stored. For matched messages we keep the sender, recipients, subject, date, message text, and up to five PDF attachments. Other attachment types are ignored.
Gmail sidebar. When you click "Log this email" in the BasicCRM Gmail add-on, we store that one message.
Email you send from BasicCRM. If you turn on sending, the messages you confirm and send are stored on the matching contact's timeline.

Information we collect automatically

Cookies. We use only essential cookies: a secure session cookie that keeps you signed in, a cookie that remembers which workspace you are in, and small preference cookies that remember your display theme (look and light/dark mode). We do not use advertising cookies, tracking pixels, or third-party analytics.
Service logs. Our hosting provider records standard technical information when you use the site, such as IP address, browser type, the page requested, and the time. We use these logs to keep the service running, troubleshoot, and protect against abuse.

Payment information

Paid subscriptions are not live yet. When they are, payments will be handled by a third-party payment processor (such as Stripe). The processor collects your card details directly; we will not store full card numbers. We will receive limited billing information such as your billing name, email, plan, and payment status.

4. Google user data

BasicCRM connects to Google in a few specific, limited ways. Each one is something you choose to use.

Feature	Google permission	What it does
Sign in with Google	`openid`, `email`, `profile`	Identifies you and creates or opens your account.
Send from BasicCRM (optional)	`gmail.send`	Sends an email you wrote and confirmed in BasicCRM, from your own Gmail account. It cannot read your mailbox.
Gmail sidebar add-on (optional)	`userinfo.email`, `gmail.addons.current.message.readonly`, `gmail.addons.current.message.action`	When you open the sidebar on a message, it reads that one message to show the sender's contact, company, open deals, and next step, and logs that message only if you click "Log this email." It does not read the rest of your mailbox.
Mailbox sync (limited)	`gmail.readonly`	Available only to a small number of internal workspaces that we approve individually. It is not offered through public sign-up. Sync looks only for mail to or from people who are already contacts in the workspace, and stores only those messages. Everything else is skipped and not stored. Promotions, social, forums, spam, trash, and drafts are skipped.

BasicCRM does not request access to Google Contacts or your Workspace directory. (An earlier Google Contacts import has been removed. Anyone saved through it remains an ordinary contact that you can edit or delete.)

Limited Use

BasicCRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms:

We use Google user data only to provide and improve the user-facing features described above, which you can see and control in the product.
We do not sell Google user data.
We do not use or transfer Google user data for advertising, including retargeting, personalized, or interest-based ads.
We do not use Google user data to train generalized artificial intelligence or machine-learning models.
We do not use Google user data to determine creditworthiness or for lending.
We transfer Google user data to others only as needed to provide the features you use (for example, to our hosting and database providers), to comply with law, for security, or as part of a merger or acquisition with notice to you.
No person at BasicCRM reads your email or other Google user data unless (a) you give us permission, for example to help with a support request; (b) it is necessary for security purposes, such as investigating abuse; (c) it is required to comply with applicable law; or (d) the data has been aggregated and anonymized and is used only for internal operations.

5. AI assistants you connect (MCP)

You can connect an AI assistant (for example Claude, ChatGPT, Cursor, or Grok) to your workspace through BasicCRM's connector. Here is how that works:

Nothing is connected until you sign in and click Allow on BasicCRM's consent screen.
Each connection acts on your behalf and is limited to one workspace that you belong to. It can do only what you could do there, and it cannot delete records or send email. (It can save an unsent draft.)
Changes made through a connection are labeled with the assistant's name.
You can see and revoke connections at any time in Settings → Connected apps. Removing a person from a workspace also cuts off their connections.
When you ask an assistant to read your BasicCRM data, that data goes to the assistant's provider, and their privacy policy applies to what they do with it. Choose assistants you trust.

6. How we use information

We use information to:

Provide BasicCRM: show your records, file logged email on the right contact, company, and deal, send email you confirm, and run the features you turn on.
Keep accounts and workspaces secure, prevent abuse, and fix problems.
Respond to your support requests.
Send service messages, such as security notices, billing receipts, or important changes. We do not send marketing email from your customer data.
Bill for subscriptions once paid plans are live.
Comply with the law.

We do not sell personal information, and we do not use your workspace data or Google user data for advertising.

We share information only with service providers that help us run BasicCRM, and only as needed for that:

Vercel — hosts the BasicCRM application.
Neon — hosts our Postgres database, on Amazon Web Services in the US East region.
Postmark — receives the email you BCC or forward to your logging address.
Google — provides sign-in, sending, and the Gmail add-on you choose to use.
Payment processor (such as Stripe) — will process payments once paid plans are live.

We may also share information:

With AI assistants or other apps you connect, at your direction.
When required by law, or to protect the rights, safety, or property of our users, the public, or Spottsco.
As part of a merger, acquisition, or sale of assets, in which case this policy (including the Google Limited Use commitments) will continue to apply to your information, and we will notify you.

Within a workspace, members can see the workspace's records. Workspace owners decide who is invited.

8. How long we keep information

Workspace records stay until you delete them or delete the workspace.
Deleted contacts and companies are hidden right away (with a short undo window) and permanently removed from our database after 30 days. Deleting a contact also removes their notes, calls, and logged email that are not tied to someone who remains.
Deleted workspaces are removed along with every record in them. Removal from backups maintained by our database provider follows that provider's backup cycle.
Logged email stays until you delete the contact it belongs to, or the workspace.
Gmail connections. Disconnecting Gmail in Settings deletes that mailbox's synced messages and its stored token. Turning off sending deletes the sending token.
AI assistant access tokens expire after one hour; refresh tokens expire after 30 days, and you can revoke them at any time.
Account data is kept while your account is active and deleted when you ask us to delete your account, except where we need to keep limited records for legal, tax, or security reasons.
Unmatched inbound email is never stored.

9. Security

We take reasonable measures to protect your information, including:

Encryption in transit: all connections to BasicCRM use HTTPS (TLS).
Gmail tokens used for sending and sync are encrypted before they are stored (AES-256-GCM).
AI assistant tokens and personal API keys are stored only as one-way hashes. A new API key is shown once.
Session cookies are secure and HTTP-only, and each workspace's data is separated so only its members can see it.
Access to production systems is limited to the operator (Spottsco).
Our database provider encrypts stored data at rest.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify you as required by law.

10. Your rights and choices

You can, at any time:

Access and correct your records directly in BasicCRM.
Export your workspace's contacts, companies, and related data as a CSV file from Settings.
Delete individual records, or (if you are an owner) delete the whole workspace from Settings.
Disconnect Gmail sending or sync, and revoke connected AI assistants, from Settings.
Revoke BasicCRM's access to your Google account at https://myaccount.google.com/permissions.
Ask us to delete your account or workspace, or for a copy of your data that the product does not already provide, by emailing support@basiccrm.io. We will respond within 30 days and may need to confirm your identity.

Depending on where you live, you may have additional rights under local law, such as the right to object to or restrict certain processing. Email support@basiccrm.io and we will honor the rights that apply to you.

11. Children

BasicCRM is a business tool and is not intended for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact support@basiccrm.io and we will delete it.

12. International users

BasicCRM is operated from the United States, and our data is stored in the United States. If you use BasicCRM from outside the US, your information will be transferred to, stored, and processed in the US, where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this policy as BasicCRM changes. We will post the new version on this page with a new effective date. If a change is significant, we will give you notice in the product or by email before it takes effect. We will not use Google user data in a new way without first asking for your consent.

14. Contact

Spottsco LLC, 12904 ElRond Drive, Oklahoma City, OK 73170

Questions and requests: support@basiccrm.io
Legal notices: david@spottsco.com