Privacy Policy

1. Who we are

Spine CRM (“Spine”, “we”, “us”) is a customer relationship management service built and operated by Hexbolt Technologies, India. This policy explains what information we collect when you use Spine CRM at spine-crm.hexbolttechnologies.in, how we use it, and the choices you have. For any privacy question, contact us at hello@hexbolttechnologies.in.

2. Information we collect

• Account information — your name, email address and a password (stored only as a salted hash), plus the organisation and workspaces you belong to and your role in them.
• Workspace data — the records you and your team enter: leads, clients, contacts, notes, tasks, appointments, events, invoices and payments. This often includes personal information about your own customers.
• Business card photos — images you capture or upload in the Cards feature, and the details extracted from them.
• Integration data — when you connect Google Calendar or Zoom, the access tokens needed to act on your behalf and the minimum account details needed to show the connection (such as the account’s email address).
• Usage and security data — an audit log of changes made in a workspace (who changed what and when), and standard server logs such as IP address, browser type and request times.

3. Google user data

Connecting Google Calendar is optional. If a user connects it from Settings, Spine requests the following permissions and uses them only as described:

• See, edit, create and delete events on your calendars (calendar.events) — to create a calendar event when an appointment is booked in Spine, update it when the appointment is rescheduled, and delete it when the appointment is cancelled. Where you choose Google Meet, the event carries the Meet link.
• See your calendars (calendar.readonly) — to read free/busy information so that appointments made in Spine do not overlap with existing commitments. Spine does not store the titles, descriptions or attendees of events it did not create.
• See your primary email address (userinfo.email) — to show which Google account is connected.

Access and refresh tokens are encrypted at rest. Google user data is used only to provide and improve these user-facing calendar features. We do not sell it, do not use it for advertising, do not use it to develop, improve or train generalised AI or machine-learning models, and do not allow humans to read it except with your explicit consent, when required for security purposes or to comply with the law.

Spine CRM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Calendar at any time from Settings in Spine, which revokes the grant with Google and deletes the stored tokens. You can also remove access from your Google Account permissions page.

4. How we use information

• to provide the service: store your records, show them to the people in your workspace allowed to see them, and run the reminders and automations you configure;
• to perform the integrations you turn on, such as calendar sync, meeting links and WhatsApp messages;
• to secure the service, prevent abuse and investigate problems;
• to communicate with you about your account and the service;
• to comply with legal obligations.

We do not sell personal information and we do not show advertising.

5. Service providers

We share information with the following categories of providers only as needed to run the features you use:

• Hosting and storage — servers we operate, and S3-compatible object storage for uploaded images.
• Google Gemini — business card photos are sent to Google’s Gemini API to extract contact details.
• WhatsApp (Meta) — messages you send to your customers from Spine are delivered through the WhatsApp Business Platform.
• Zoom and Google Calendar — only when a user connects them, as described above.

We may also disclose information if required by law, or as part of a merger or acquisition, in which case this policy continues to apply to it.

6. Your workspace’s customers

A business that uses Spine decides what information about its own customers goes into its workspace, and is responsible for having a lawful basis to hold it and to contact those customers. We process that information on the business’s behalf. If you are a customer of a business using Spine, please contact that business first; we will help them respond to your request.

7. Cookies and browser storage

Spine stores your sign-in session and interface preferences (such as light or dark theme) in your browser, and caches the app so it can open offline. We do not use advertising or third-party tracking cookies.

8. Retention and deletion

We keep workspace data for as long as the workspace is active. When an account or workspace is closed, we delete its data within 90 days, except where we must keep it longer to meet legal obligations. Deleting a card or record also deletes its stored photos. To request access to, correction of, export of or deletion of your information, email hello@hexbolttechnologies.in.

9. Security

Traffic is encrypted with TLS, passwords are hashed, integration tokens are encrypted at rest, and access inside a workspace is limited by roles and permissions. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law.

10. Children

Spine CRM is a business tool and is not directed to children under 18.

11. Changes to this policy

We may update this policy. If a change is material, we will notify account owners by email or in the app before it takes effect. The effective date above shows when it last changed.

12. Contact

Hexbolt Technologies · hello@hexbolttechnologies.in. See also our Terms of Service.