Privacy Policy

The data controller for personal data collected through the VODOO CRM platform is ALTIORAT LLC, reachable at contact@vodoocrm.com.

This policy applies to all data collected during your use of www.vodoocrm.com and the VODOO CRM platform, as well as to the waitlist form on the presentation page try.vodoocrm.com.

2.1 Data you provide to us

• Account data: first name, last name, email address, password (encrypted), organization name
• Billing data: billing details (processed directly by Stripe — VODOO CRM does not store card data)
• Profile data: profile picture, phone number, time zone
• User content: imported contacts, sent messages, pipelines, funnels, products, notes

2.2 Automatically collected data

• Navigation data: IP address, browser type, pages visited, session duration
• Usage data: features used, actions performed in the interface
• Technical data: connection logs, session identifiers
• Email performance data: opens and clicks on emails sent via the platform (Resend tracking)

2.3 Data of your clients' contacts

When you import or create contacts in VODOO CRM (your own customers or prospects), you act as the data controller of that data. VODOO CRM is your data processor within the meaning of the GDPR. You are responsible for the legality of collecting this data and for informing your own contacts.

2.4 Waitlist

If you join the waitlist from try.vodoocrm.com, we collect only your email address, the site display language, and your IP address and browser — the latter two solely to limit abusive automated signups. The legal basis is your consent, given by submitting the form. Every email carries a one-click unsubscribe link that takes effect immediately, with no reason required. This data is never sold and never passed to third parties for commercial purposes.

• Active account data: for the duration of the contractual relationship
• Data after termination: 30 days (export option), then permanent deletion
• Billing data: 10 years (legal accounting obligation)
• Security logs: 12 months
• Analytics cookies: maximum 13 months
• Waitlist: until the public launch of VODOO CRM or until you unsubscribe, whichever comes first. An unsubscribed signup is kept in an « unsubscribed » state for the sole purpose of guaranteeing we will not write to you again; permanent deletion can be requested at any time.

Your data is processed by rigorously selected sub-processors, bound to VODOO CRM by data processing agreements (DPA) compliant with the GDPR:

• Supabase (database and authentication) — EU hosting possible
• Vercel (application hosting) — US, SOC 2 certified
• Stripe (payment and billing) — PCI-DSS Level 1 certified
• Resend (transactional email sending)
• Twilio (SMS sending)
• Meta / WhatsApp Business API (WhatsApp, Instagram, Messenger messaging)
• Inngest (background workflow orchestration)

Your data is never sold to third parties for commercial purposes.

Some sub-processors are established outside the European Union (particularly in the United States). These transfers are governed by appropriate legal mechanisms: Standard Contractual Clauses (SCCs) from the European Commission and/or adherence to the EU-US Data Privacy Framework.

VODOO CRM implements appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure or destruction:

• Encryption of data in transit (TLS 1.3) and at rest
• Secure authentication with JWT session management
• Tenant-level access control (Supabase Row Level Security)
• Access to production data limited to authorized employees

In accordance with the GDPR (if applicable) and data protection laws, you have the following rights regarding your personal data:

• Right of access: obtain a copy of data concerning you
• Right of rectification: correct inaccurate data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to portability: receive your data in a structured, readable format
• Right to object: object to certain processing (e.g. marketing)
• Right to restriction: request restriction of processing in certain cases
• Right to withdraw consent: at any time for consent-based processing

To exercise these rights, contact us at contact@vodoocrm.com specifying your request. We will respond within one month.

VODOO CRM uses cookies and similar technologies. To learn more, please see our Cookie Policy.

For any questions regarding the protection of your data: contact@vodoocrm.com

If you believe that the processing of your data does not comply with applicable regulations, you have the right to lodge a complaint with the competent supervisory authority (in France: the CNIL, www.cnil.fr).