Privacy policy

1. Who we are

LiquifyCRM is a customer relationship tool. Businesses use it to collect their sales enquiries and to follow them up. In this policy "we" means LiquifyCRM, and "the business" means the company whose website, lead form, Facebook Page or Instagram account you contacted.

Questions about this policy go to support@luminocrm.online.

2. Whose information we hold

• People who make an enquiry. You filled in a form on a business's website, filled in one of its lead forms on Facebook or Instagram, sent a message to its Facebook Page, or sent a direct message to its Instagram account.
• People who connect Facebook. You signed in with Facebook to connect your Pages to LiquifyCRM.
• Team members. You have a LiquifyCRM account and sign in to work.

3. What we collect

When you make an enquiry

• From a website form: what you typed (usually your name, email address, phone number and message), the page you were on, and the campaign tags in the link you followed. The website may also send your IP address and browser type; those stay only in a temporary record that is deleted within 30 days, not with your enquiry.
• From a Facebook or Instagram lead form: the answers you gave in the form, and the names of the Page, the form, the ad and the campaign it came from.
• From Messenger: the messages you send to the business's Page and the replies you get, your name and profile picture if Facebook shares them, and the ID Facebook gives you for that Page. We do not download attachments; we keep only the reference Facebook sends with the message.
• From an Instagram direct message: the messages you send to the business's Instagram account and the replies you get, your name, Instagram username and profile picture if Instagram shares them, the ID Instagram gives you for that account and, if you wrote after tapping an ad, the name of that ad. As with Messenger, we do not download photos, videos or shared posts; we keep only the reference Instagram sends with the message. If you delete a message, we remove its words too.
• What the team adds while working on your enquiry: notes, follow-up tasks, its status and, if you buy, the amount and date of each sale.
• If you become a client: the files of your order that the team keeps for you (such as a contract, an invoice or the material you send), and any text you share with them for the work, such as a login to a service of yours.

When you connect Facebook

• Your Facebook name and user ID.
• The names and IDs of the Pages you manage, and the username and ID of the Instagram account linked to each.
• Access tokens that let LiquifyCRM receive the leads and messages of those Pages and their Instagram accounts, and send replies. They are stored encrypted.

We ask Facebook only for the permissions this needs. LiquifyCRM does not post on your Page, your Instagram account or your profile, and it never sees your Facebook or Instagram password.

When you have a LiquifyCRM account

• Your name and email address, and your phone number and job title if you add them.
• Your password, stored as a one-way hash that nobody can read, and the key of your authenticator app, stored encrypted.
• When, and from which IP address, you last signed in.
• A record of what you do in LiquifyCRM, such as changing the status of an enquiry, with the time, your IP address and your browser type.
• If you turn on desktop alerts: for each browser where you did, the address its push service gave it and the keys that encrypt alerts for it (stored encrypted).

Cookies

LiquifyCRM uses only the cookies it needs to work: one for your session, one that protects forms against forgery, one that keeps you signed in if you tick "Keep me signed in", and one that remembers light or dark mode. There are no advertising or analytics cookies. For team members, the browser also keeps a few choices of that computer (light or dark mode, the notification sound, desktop alerts) and a copy of the "You are offline" page; these stay on the computer and are not sent to us.

4. What we use it for

• To show each enquiry to the team of the business it was sent to, so they can answer it, follow it up and record the result.
• To send the replies the team writes in Messenger or Instagram and, if the business has switched it on, an email saying your website enquiry arrived.
• To tell team members about new and assigned enquiries, in the app, on their computer's screen and by email.
• To show the business its own reports: how many enquiries arrived, from where, and how many became sales.
• To keep accounts safe and to keep a record of who did what.

We do not sell personal information and we do not use it for advertising. Information received from Facebook and Instagram is used only to provide this service to the business that connected its Page.

5. Who can see it

• The business you contacted: its team members, each limited by their role. An enquiry sent to one business is never shown to another.
• The administrators who run LiquifyCRM.
• Companies that work for us: the hosting company whose servers store the data (Hostinger), and the email service each business uses to send its emails.
• Meta, when a reply is sent in Messenger or Instagram: it travels through Facebook or Instagram, as every message there does.
• The push service of a team member's browser (Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari), when that team member has turned on desktop alerts: it carries each alert, such as the name of a new enquiry, to their computer. The alert is encrypted on our server, so that service cannot read it.
• Nobody at the exchange rate service: when a sale is made in another currency, LiquifyCRM reads that day's rate of the European Central Bank from the free Frankfurter service. Only the two currencies and the date are sent, nothing about you.
• Authorities, when the law requires it.

6. How long we keep it

• Enquiries, their notes, Messenger and Instagram chats and sales, and a client's files and shared text: for as long as the business uses LiquifyCRM, or until you or the business ask for them to be deleted.
• An enquiry the business deletes: it waits 30 days in a bin, where the business can still bring it back, and is then deleted for good with its notes, follow-ups, chat and history. The record of a sale stays with the client.
• The raw copy of an incoming form, Facebook or Instagram event: 14 days after it has been handled, and never longer than 30 days.
• Activity records: between 7 and 90 days in the live system, then in archive files for up to one year. The history shown on an enquiry stays with that enquiry.
• Facebook access tokens: until Facebook is disconnected in LiquifyCRM; they are removed at that moment.
• A browser's address for desktop alerts: until desktop alerts are turned off there, the person signs out there, or the browser stops taking them; an alert the browser has not received within four hours is dropped by its push service.
• Backups: made daily and removed automatically as they age. The oldest backup we keep can be up to two years old.

7. How we protect it

• The connection to LiquifyCRM is encrypted (https).
• Passwords are stored as one-way hashes; Facebook tokens, authenticator keys and email passwords are stored encrypted.
• Text a client shares for their work, such as a login, is stored encrypted, and a client's files are kept in private storage that only the team members working for that client can open.
• Administrators must sign in with a second step from an authenticator app.
• Each team member sees only what their role allows, and each business's data is kept apart from the others.
• Actions are recorded, so it can be checked who did what.

8. Your choices

You can ask us for a copy of the information we hold about you, to correct it, to stop using it or to delete it. Write to support@luminocrm.online; we answer within 30 days. The steps for deletion are on Delete your data.

If your enquiry went to a particular business, you can also ask that business directly: it decides how your enquiry is used, and we act on its instructions. Depending on where you live, you may also have the right to complain to your data protection authority.

9. Children

LiquifyCRM is made for businesses. It is not meant for children, and we do not knowingly collect information from anyone under 16.

10. Changes to this policy

When this policy changes, the date at the top of this page changes with it.

11. Contact

LiquifyCRM, support@luminocrm.online.