Privacy Policy
This policy explains what Anthony Thompson, doing business as Ruthless AI CRM ("we", "us"), collects, why, and what you can do about it. It covers the website at ruthlessaicrm.net and the service at app.ruthlessacrm.net.
Two kinds of data
Account data is what we collect about the people who use the service: your name, your email address, your organization, your sign-in, your plan, and how you use the service. For account data we are the business that decides how it is used.
Customer content is what you put into the service: your accounts, contacts, notes, history, connected mailbox content, and the drafts the service writes for you. Customer content belongs to you. We process it only on your instructions to run the service, as your service provider under California law. If you are a person whose details sit in a customer's account, the customer decides how that data is used; write to them, and we will help them respond.
What we collect
When you open an account: your name, email address, organization name, and a password hash. We never store the password itself.
When you buy a plan: your plan, seat count, and billing status. Payment is taken by our payment provider. We do not receive or store your card number.
When you connect a mailbox: a token that lets the service send email through that mailbox. For Google accounts the service requests only the permission to send; it does not request permission to read your mailbox. For Microsoft accounts the service requests only the permission to send and to sign you in. For your own mail server, your server address and credentials, stored encrypted.
When you use the service: the actions you take, when, and from what device and address, kept in logs for security and support. Replies to email the service sent for you, so the service can stop a sequence when a person answers.
When you visit the website: the page you asked for and the standard information a browser sends. The website sets no advertising or analytics cookies.
We do not collect data from children under 16 and the service is not for them.
What we do with it
We use account data to run the service, to bill you, to secure the service, to answer your support requests, and to tell you about changes to the service or these terms. We do not sell it, share it for advertising, or use it to build profiles for anyone else.
We use customer content only to do what you ask the service to do: store your records, research accounts, draft email, send it through your mailbox, and show you what happened. We do not use customer content, mailbox data, or drafts to train or improve any model, ours or a third party's. We do not combine one customer's data with another's.
Google and Microsoft
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data is not used to develop, improve, or train AI or machine learning models.
We do not use data received from Microsoft accounts, or data derived from it, to target or serve advertising. When you close your account, data received from Microsoft is deleted with the rest of your content.
You can revoke our access at any time from the service, from your Google account permissions page (myaccount.google.com/permissions), or from your Microsoft account (account.live.com/consent/Manage or myapps.microsoft.com).
Who sees it
We share data only with the companies that help us run the service, each under a contract that limits them to that purpose and forbids them from using it for anything else. They fall into six categories: hosting, database, payment, email delivery for the service's own notices, contact and email verification, and AI research and drafting. We do not publish or provide a list of them by name, and we do not answer requests for one. Each is under contract to use your data only to run the service, and none of them may train on it.
We share data when the law requires it, to respond to a valid legal request, or to protect the service and its users from fraud or abuse. If the business is sold, data goes with it to the buyer under this policy.
We never sell personal data and we never share it for cross-context behavioral advertising. Sending your content to a service provider so it can perform a service for you, including AI research and drafting, is a disclosure to a service provider under California law, not a sale and not a share; each provider is bound by contract to use it only for that service and for nothing else.
How long we keep it
Your records stay as long as your account is active. Your administrator can set a retention period for them in Settings (6, 12, 24, or 60 months); records older than that period are deleted by a daily job. Without a setting, records are kept until the account ends.
When the account ends, for any reason, you have 30 days to export your content, and then we delete it from the live service. Backup copies age out on the schedule below.
The audit log of actions taken in the service (who did what, when) is kept after the account ends, as a security and dispute record. It holds the acting user's identity and the action, not the content of your records.
Backups are kept for 35 days for point-in-time restore, and long-term copies for up to five years. Backups exist to restore the service after a failure; we do not read them to recover content a customer has deleted.
Web server request logs are kept for 3 days. Database access audit logs are kept for 90 days. Billing records are kept as long as the law requires.
Security
Customer content is encrypted in transit and at rest. Sign-in and mailbox credentials are stored encrypted or hashed. Access is limited to what running the service requires and is logged. Each customer's data is kept separate from every other customer's. If we confirm a breach affecting your data, we will tell the account owner without undue delay and within 72 hours of confirming it.
Where it lives
The service runs on infrastructure in the United States and is offered to organizations in the United States. If you visit the website from elsewhere, the standard information your browser sends is received in the United States.
Your rights
Wherever you are, you can ask us what account data we hold about you, ask us to correct it, ask us to delete it, or ask for a copy of it. Write to info@ruthlessaicrm.net. We will answer within 45 days. We will not treat you differently for asking.
If you are in California, the CCPA and CPRA give you those rights by law, and the right to opt out of sale or sharing. We do not sell or share personal data, so there is nothing to opt out of; the statement above is our "Do Not Sell or Share My Personal Information" notice. You may use an authorized agent to make a request; we will ask the agent to show your permission.
If your details sit in a customer's account as customer content, direct your request to that customer. We will help them meet it.
California categories
In the last 12 months we collected these categories of personal information, for the purposes above, and disclosed them only to the service providers described above:
| Category | Examples | Collected | |---|---|---| | Identifiers | name, email address, account ID, IP address | Yes | | Commercial information | plan, seats, billing status | Yes | | Internet activity | actions in the service, pages visited, device and browser | Yes | | Professional information | organization, role | Yes | | Inferences | none | No | | Sensitive personal information | sign-in credentials (stored hashed); mailbox credentials (stored encrypted) | Yes, only to run the service | | Geolocation, biometric, health, financial account numbers, protected classifications | none | No |
We do not sell or share any category. We do not use sensitive personal information to infer characteristics about you.
Cookies
The website sets no cookies. The service stores a sign-in token in your browser so you stay signed in, and nothing else. There is no advertising or analytics tracking on either.
Changes
We may update this policy. For a material change we will email the account owner at least 30 days before it takes effect and post the new version here with its date.
Contact
Anthony Thompson, doing business as Ruthless AI CRM 3001 Bechelli Lane, Redding, CA 96002 info@ruthlessaicrm.net