Privacy Policy

COLABR8 TECH is a multi-tenant CRM. Personal data on the platform falls into two categories, and our legal role differs between them.

We are the controller for account data

Where you sign up for an account, contact us, or use our website, we decide how and why your data is processed. This covers your name, work email address, company details, billing records, login activity and support correspondence.

We are a processor for your customer data

Everything you put into your CRM — your contacts, companies, deals, bookings, invoices, documents and mailbox contents — remains yours. You are the controller of that data. We process it only on your instructions, to provide the platform to you. We do not use it for our own purposes, we do not sell it, and we do not mine it to build products.

If you handle personal data of people in the UK or EU through COLABR8 TECH, you are responsible for having a lawful basis to do so, and for responding to requests from those individuals. We will assist you with such requests — see Your rights.

Account data

Your name, email address, company name, job role, and billing details when you register.

Payment data

Payments are processed by Stripe. We receive subscription status, plan and invoice records. We never see or store your full card number.

Customer data you enter

Contacts, companies, deals, bookings, invoices, quotes, tasks, notes, uploaded documents and anything else you or your team record in the CRM.

Mailbox data from connected accounts

If you connect a mailbox, we process the contents of that mailbox to display it in the CRM inbox and to send mail on your behalf. See Connected mailboxes.

Usage and technical data

Pages visited, features used, actions taken in the CRM, IP address, browser and device information, and error logs — used to operate, secure and debug the service.

Under UK GDPR we rely on the following bases:

• Contract — to provide the platform you have subscribed to, take payment, and provide support.
• Legitimate interests — to secure the platform, prevent abuse, diagnose faults, and improve the product. We balance this against your rights and do not use it to justify marketing to you without consent.
• Legal obligation — to keep accounting and tax records and respond to lawful requests.
• Consent — for marketing emails, and for connecting a third-party mailbox or social account. You can withdraw consent at any time by unsubscribing or disconnecting the account.

Where we act as processor for your customer data, the lawful basis for that processing is yours to establish, not ours.

COLABR8 TECH includes an inbox that connects to your existing business mailbox so you can read and send mail alongside your CRM records. Connecting a mailbox is entirely optional and is always initiated by you. What we access depends on the provider you connect.

Microsoft Outlook / Microsoft 365

We connect using Microsoft OAuth and the Microsoft Graph API. We request the permissions Mail.Read (read your mail), Mail.Send (send mail as you), User.Read (your basic profile and email address) and offline_access (so the connection persists without asking you to sign in repeatedly). This means we retrieve message content, subject lines and headers, sender and recipient addresses, timestamps and attachments for the mailbox you connect, and store them so the CRM inbox can display them.

Google Gmail

Gmail connection is built but not yet enabled for customers, pending Google verification. When enabled, we will request only gmail.send (send mail on your behalf) and userinfo.email (confirm which Google account you connected). We do not currently request read access to Gmail, and we will update this policy before requesting any additional Google scope.

Google Limited Use disclosure. COLABR8 TECH's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In plain terms, for data we obtain from Google:

• We use it only to provide the mailbox features you can see in the CRM inbox.
• We do not sell it, and we do not transfer it to third parties except to provide those features, for security purposes, or where the law requires.
• We do not use it for advertising, ad targeting, or building advertising profiles.
• We do not use it to create, train or improve any generalised artificial intelligence or machine learning model. Mailbox contents are not sent to our AI features at all — see AI features.
• We do not allow our staff to read your mail, except where you have specifically asked us to look at a message to resolve a support issue, where it is necessary to investigate a security problem or abuse, or where the law requires it.

IMAP and SMTP mailboxes

You can also connect a generic mailbox using IMAP and SMTP. In that case you supply the hostname, port and login credentials for your mail provider, and we connect to that provider directly on your behalf. Your mail provider is determined by you, not by us.

How mailbox credentials are stored

We think you should know exactly how your credentials are held, including where that is not yet ideal.

• OAuth tokens (Microsoft, and Google when enabled) are encrypted at rest in our database using a symmetric key held in a separate secrets vault. They are decrypted only inside server-side functions at the moment they are used, and the decryption routine is not callable by any signed-in user.
• IMAP and SMTP passwords are not currently encrypted at rest. They are stored in our database as supplied, protected by database access controls and row-level security that restrict them to your account, but not by encryption. We are working to bring them in line with the OAuth tokens above. Until that is done, if you would rather not store a mailbox password with us, connect via Microsoft OAuth instead, which does not require us to hold your password.

Disconnecting a mailbox removes its stored credentials. You can disconnect at any time from the Inbox settings in the CRM.

The platform includes an AI workspace and AI generation tools for email templates, social posts and account summaries. These send the relevant CRM records to a third-party AI provider to generate a response.

AI requests are routed through our AI infrastructure provider to Google Gemini models. The data sent is limited to what the feature needs — records drawn from your contacts, companies, deals, bookings, invoices, services, tasks, activities and campaigns, scoped to your account only.

Mailbox content is not sent to any AI feature. The AI workspace has no access to your connected mailboxes, messages or attachments.

We do not use your data, or your customers' data, to train generalised AI models, and our AI provider is engaged on terms that do not permit it either. AI interactions are logged against your account so you can review what was asked and answered.

Our platform lets you connect third-party social media accounts — including Facebook Pages, Instagram, LinkedIn, X (Twitter) and TikTok — so that you can schedule and publish content directly from COLABR8 TECH.

When you connect an account, we may receive:

• Public profile information, such as your name, username, and profile picture
• Account and Page identifiers (IDs)
• Page access tokens issued by the platform
• The permissions required to publish or schedule content on your behalf

We only request the access needed to provide these features. We do not access your private messages or direct messages on these platforms.

Our use of data obtained through Facebook and Instagram complies with the Meta Platform Terms, the Meta Developer Policies, and the Facebook Login requirements.

We use Facebook Login solely to authenticate you, connect your Facebook Pages, and enable post creation and scheduling within the platform.

We do not:

• Sell or rent data obtained from Meta
• Use Meta data for advertising or to build user profiles
• Share Meta data with any third party outside the Service

Data obtained through Meta is retained only while your account is active and the relevant Page remains connected. It is deleted when you disconnect the account or delete your COLABR8 TECH account. To request deletion, see our Data Deletion Instructions.

For LinkedIn, TikTok and X (Twitter) we request only the permissions necessary to authenticate you and to schedule or publish posts on your behalf, and we comply with each provider's API terms. The same retention, deletion and no-sale rules apply.

We use the following third parties to run the platform. Each is engaged under terms incorporating data processing provisions and may process personal data on our behalf.

• Supabase — database, authentication, file storage and server-side functions. This is where CRM data is held.
• Cloud application hosting and AI gateway infrastructure providers — engaged under terms incorporating data processing provisions. A full list of subprocessors is available on request from support@colabr8.tech.
• Google — Gemini models serving AI features (via our AI gateway), and the Gmail API where you connect a Google mailbox.
• Microsoft — Microsoft Graph API where you connect an Outlook or Microsoft 365 mailbox.
• Stripe — subscription billing and payment processing.
• Resend — delivery of transactional email and email campaigns sent from the platform.
• Twilio — delivery of SMS and WhatsApp messages, where you use those features.
• Vercel — hosting for the colabr8.tech marketing website. No CRM data is held here.
• Your own mail provider — where you connect a mailbox over IMAP and SMTP, we connect to the provider you nominate. That provider is your choice and your relationship, not ours.

We will update this list before adding a new subprocessor that handles customer data. If you need advance notice of changes for your own compliance purposes, contact us and we will arrange it.

Platform data is held in our Supabase project and processed by server-side functions associated with it. Some of our subprocessors — including Stripe, Google, Microsoft, Resend and Twilio — operate globally and may process data outside the United Kingdom.

Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as applicable to the provider concerned. You can ask us which mechanism applies to a particular provider.

While your subscription is active — we retain your account data and your CRM data for as long as you keep using the platform. You control your CRM data and can delete records at any time.

If payment fails — your account enters a grace period of 7 days, during which the service continues and you can update your payment details. If payment is not resolved, access may be suspended. Suspension disables sign-in; it does not delete your data, so your account can be restored if you resume payment.

On account closure — you may export your data before closing. We will delete your account data and CRM data within 30 days of a written deletion request to support@colabr8.tech. Deletion is permanent and cannot be reversed.

Records we must keep — invoices and accounting records are retained for 6 years to meet UK tax and company law requirements, even after account closure.

Connected accounts — mailbox credentials and social access tokens are deleted when you disconnect the account, and in any event when your account is deleted.

We protect the platform using:

• Encryption in transit (TLS) for all connections to the platform and to third-party APIs
• Row-level security in the database, so each tenant can reach only its own records
• Role-based access control within each tenant
• Encryption at rest for OAuth mailbox tokens, using a key held in a separate secrets vault
• Restricted administrative access, with support access to a tenant recorded

As noted in Connected mailboxes, IMAP and SMTP passwords are not yet encrypted at rest. No system is completely secure, and we do not claim otherwise. If you believe you have found a security problem, please report it to support@colabr8.tech and we will investigate.

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Request erasure of your data
• Object to or restrict processing
• Receive your data in a portable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these, email support@colabr8.tech. We will respond within one month. We do not charge for this.

If you are a customer of one of our users. Where your data is in a COLABR8 TECH account operated by a business you deal with, that business is the controller and you should contact them directly. If you contact us instead, we will pass your request to them and support them in answering it.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

We use essential cookies to keep you signed in and to operate the platform. We do not use advertising cookies, and we do not run third-party tracking or advertising scripts on colabr8.tech. You can manage cookies in your browser settings, though disabling essential cookies will prevent sign-in from working.

We may update this policy as the product changes. Where a change materially affects how we handle your data — including any change to the third-party scopes we request — we will notify you by email or in the platform before it takes effect.