Privacy Policy

Effective Date: September 29, 2026

Profit Max CRM LLC ("we", "us", or "our") operates Profit Max CRM, a cloud-based customer relationship management platform for small service businesses. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, mobile applications, lead forms, and related services. Read this alongside our Terms and Conditions, which govern your use of the service.

1. Information We Collect

Account Information

When you create or use a Profit Max CRM workspace, we collect:

• Name, email address, phone number, and job title of authorized users
• Business name, address, EIN or tax identifier, and other identifying details
• Billing address and payment-method information (tokenized and stored by Stripe; we do not store full card numbers)
• Authentication credentials: passwords are hashed using bcrypt; API keys and integration tokens are encrypted at rest

Business Data You Store

Through your workspace, you may store information about your own customers, leads, employees, and operations, including:

• Contacts, leads, and customer records (names, addresses, phone numbers, emails, custom fields, tags)
• Quotes, work orders, invoices, payments, and refunds
• Communication history: SMS messages, emails, voice calls, voicemails, and call recordings/transcriptions
• Notes, tasks, files, and photos attached to records
• Fleet, equipment, parts, and maintenance plans
• Service addresses, route plans, and GPS-derived locations
• Employee information for users you invite to the workspace

You are the controller of this Business Data. See Section 10 below.

Communications Data

When you use SMS, email, voice calling, or AI features, we collect and process:

• Phone numbers and email addresses of recipients
• Message content, email content, and call audio
• Voicemail audio and automated transcriptions
• AI-generated transcripts, summaries, and sentiment analysis of calls and messages
• Opt-in records, consent timestamps, and opt-out keywords (STOP, HELP)

Carrier Registration Data (A2P 10DLC)

To enable SMS messaging in the United States, we collect and submit on your behalf to The Campaign Registry (TCR) and Twilio: your legal business name, EIN or tax identifier, business address, website, business type, industry, and authorized representative contact details. See Section 7 for details.

Usage and Device Data

We automatically collect when you use the platform:

• Browser type and version, operating system, and device identifiers
• IP address and approximate geographic location derived from it
• Pages visited, features used, timestamps, and error reports
• Push notification tokens (mobile app)

Mobile App Data

When you use the Profit Max CRM mobile app for iOS or Android, the app may access, with your permission, your device's camera (for capturing photos on work orders and documentation), GPS location (for route planning and arrival tracking), and notification permission. You may revoke these permissions at any time in your device settings. Photos and files uploaded through the mobile app are stored on DigitalOcean Spaces.

2. How We Collect Information

• Direct input through the platform UI and forms
• OAuth authorizations you grant to connect third-party services
• Automated logging when you access the platform
• Inbound calls, SMS, and emails delivered to your registered numbers and addresses
• Lead forms hosted by Profit Max CRM and embedded on your website

3. How We Use Information

• Operate, maintain, and improve the Profit Max CRM platform and mobile app
• Process subscription payments through Stripe
• Process payments from your customers via Stripe Connect (you remain the merchant of record; Profit Max CRM LLC does not hold customer funds)
• Deliver SMS and route voice calls through Twilio
• Deliver email through SendGrid
• Generate transcripts and AI analysis of calls and messages using Anthropic
• Submit carrier registration data to TCR and Twilio on your behalf to enable compliant US SMS
• Geocode addresses and plan routes using Google APIs
• Sync calendar, accounting, payroll, and marketing data with integrations you connect
• Send platform notifications (billing, account, security) to authorized users
• Analyze usage to improve features and platform performance
• Provide customer support and respond to inquiries
• Comply with legal obligations and enforce our Terms

4. Data Storage and Security

• Database: MongoDB Atlas with encryption at rest
• File Storage: DigitalOcean Spaces (CDN-fronted) for uploaded files and photos
• Hosting: DigitalOcean cloud infrastructure
• Data in Transit: All traffic encrypted via SSL/TLS
• Sensitive Fields: Passwords hashed (bcrypt); API keys, OAuth tokens, and integration credentials encrypted at rest
• Backups: Encrypted backups maintained in Backblaze B2 with object-lock retention
• Access Controls: Multi-tenant workspace isolation enforced at the database query layer; role-based access within each workspace

5. Third-Party Services (Subprocessors)

Profit Max CRM integrates with third-party services to operate. Each is governed by its own privacy policy.

Infrastructure

• MongoDB Atlas - Primary cloud database
• DigitalOcean - Application hosting and file storage (Spaces)
• Cloudflare - CDN, DNS, and bot/security protection
• Backblaze B2 - Encrypted backup storage

Communications

• Twilio - SMS, voice calls, voicemail, and A2P 10DLC carrier registration. We act as Twilio's ISV (Independent Software Vendor) for customer registrations.
• The Campaign Registry (TCR) - Receives carrier registration data for A2P 10DLC brand and campaign approval, submitted via Twilio
• SendGrid - Transactional and marketing email delivery, open and click tracking

AI

• Anthropic - Large language model processing for call transcription, sentiment analysis, and AI-assisted features

Payments

• Stripe - Subscription billing
• Stripe Connect - Payments accepted from your customers; Stripe holds and settles funds directly to you. Profit Max CRM LLC does not hold customer funds.

Customer-Connected Integrations

You may authorize Profit Max CRM to access these services using your own accounts:

• Google Calendar - Calendar event sync
• Gmail - Reads email correspondence with your existing CRM contacts to log it on the contact's Communications timeline
• Google Business Profile - Reads your business listings and their customer reviews to show review counts, ratings, and review text inside Profit Max CRM
• Google Ads, Google Local Services Ads, Meta Ads - Ad performance, conversion tracking, ROI reporting
• Google Maps APIs - Geocoding, address autocomplete, route planning
• QuickBooks - Accounting and financial data sync
• Gusto - Payroll integration
• Zapier - Automated connections to and from other services

Google User Data and Limited Use

Profit Max CRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Gmail (read-only access): When you connect a Gmail account, Profit Max CRM reads email messages solely to log correspondence with people who are already contacts in your workspace, so that history appears on the contact's Communications timeline. We do not access messages exchanged with anyone who is not an existing contact.
• Google Business Profile (business.manage scope): When you connect a Google Business Profile account, Profit Max CRM lists the business locations that account manages and reads each location's public customer reviews (reviewer name, star rating, review text, and any reply you have posted) so they can be reported on inside your workspace, and posts or updates the owner reply on a review only when a user in your workspace writes that reply in the app. We store review data in your workspace only, never post, edit, or delete customer reviews or listing details, and do not access any other Business Profile data.
• We use Google user data only to provide and improve the features you enabled; we do not use it for advertising, and we do not sell it.
• We do not transfer Google user data to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition.
• We do not allow humans to read your Google user data unless you give explicit consent to view specific messages, it is necessary for security purposes such as investigating abuse, or it is required by law.
• You can disconnect a connected Google account at any time from Settings > Apps, which stops all further access and revokes the token.

6. AI Features

Profit Max CRM uses third-party large language models (currently Anthropic) to power AI features such as call transcription, sentiment analysis, and AI-assisted suggestions:

• AI outputs are provided for convenience and may contain inaccuracies; you are responsible for reviewing AI-generated content before acting on it
• Profit Max CRM LLC does not knowingly authorize the use of your data to train third-party AI models
• Call audio and message content are sent to the AI provider only as needed to generate the requested output
• AI processing is governed by the data-handling terms of the AI provider in effect at the time of use

7. SMS / Text Messaging and Carrier Registration

Profit Max CRM enables businesses to send SMS to their customers. When SMS features are used:

• Phone numbers are collected to deliver text messages; they are not sold, rented, or shared with third parties for those parties' marketing purposes
• Phone numbers and message content are shared with Twilio solely to deliver messages on your behalf
• Recipients may opt out at any time by replying STOP and may request help by replying HELP
• Message frequency varies based on the recipient's activity and the message types they opt into
• Message and data rates may apply depending on the recipient's carrier and plan
• Inbound replies are stored in the conversation thread within your workspace

To register your business for compliant US SMS messaging under A2P 10DLC, Profit Max CRM LLC submits your legal business name, EIN, business address, website, industry, and authorized representative details to The Campaign Registry (TCR) via Twilio. You may be required to complete an identity verification step (such as confirming an email link or replying to an SMS one-time password) to finalize registration.

8. Voice Calls and Recordings

If your workspace has voice features enabled, calls may be recorded and transcribed automatically. You are responsible for complying with applicable call-recording laws in the jurisdictions where you and your callers are located. Some states require all parties to consent to recording. Recordings and transcripts are stored within your workspace and accessible only to authorized users.

9. Sharing Your Information

We do not sell your personal information. We share information only:

• With the third-party subprocessors listed above, solely to operate the platform on your behalf
• With third parties you authorize through integrations
• When required by law, regulation, or legal process
• With your explicit consent
• In connection with a merger, acquisition, or sale of all or substantially all of our assets, where the receiving party is bound by terms at least as protective as these

10. Data Protection Roles

Under data protection laws such as the California Consumer Privacy Act (CCPA), the EU General Data Protection Regulation (GDPR), and similar regulations:

• You (the workspace Owner) are the controller of the Business Data and Communications Data stored in Profit Max CRM, including data about your customers, leads, and employees
• Profit Max CRM LLC acts as a processor of that data and processes it only on your documented instructions as expressed through your use of the platform
• Profit Max CRM LLC acts as a controller of Account Information about workspace owners and authorized users (used to operate and bill the service)
• You are responsible for establishing a lawful basis for collecting and processing personal data about your customers, for honoring privacy rights requests made by those individuals, and for any privacy notices and consents required by law in your jurisdiction

11. Cookies and Tracking

We use essential cookies for authentication and session management, functional cookies for user preferences, and analytics for understanding platform usage. We do not use advertising or retargeting cookies. See our Cookie Policy for full details.

12. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Update or correct your information through your account settings
• Delete your data or request account deletion
• Export your data in standard formats
• Opt out of marketing communications
• Opt out of SMS messages by replying STOP
• Object to certain processing, or request restriction of processing
• Lodge a complaint with a supervisory authority (if you are in the EU/UK)
• (California residents) Exercise CCPA rights, including the right to know what categories of personal information are collected and to request deletion

To exercise any of these rights, contact us at [email protected]. If your request concerns data your business stored about its own customers, the request should go to the workspace Owner, and we will assist them in fulfilling it.

13. Data Retention

• Active accounts: Data is retained for as long as your account remains active
• After cancellation: Data is available for export for 30 days after account closure, then permanently deleted within 90 days unless retention is required by law
• Backups: Encrypted backups are retained on a rolling schedule; deleted data may persist in backups for up to 30 days before being purged
• Logs and audit records: Operational logs and audit records may be retained longer than user data where required for security or legal compliance

14. International Data Transfers

Profit Max CRM is operated from the United States and your data is stored on U.S.-based infrastructure. If you access the platform from outside the United States, your data will be transferred to and processed in the U.S. By using the platform, you consent to this transfer.

15. Children's Privacy

Profit Max CRM is a business management platform and is not directed at children under 13. We do not knowingly collect personal information from children. If we become aware that we have, we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page with an updated effective date and, for material changes, notify you through the platform or by email.

17. Contact Us