Privacy Policy

The data controller for personal data collected through the VODOO CRM platform is ALTIORAT LLC, reachable at contact@vodoocrm.com.

This policy applies to all data collected during your use of www.vodoocrm.com and the VODOO CRM platform, as well as to the waitlist form on the presentation page try.vodoocrm.com.

2.1 Data you provide to us

• Account data: first name, last name, email address, password (encrypted), organization name
• Billing data: billing details (processed directly by Stripe — VODOO CRM does not store card data)
• Profile data: profile picture, phone number, time zone
• User content: imported contacts, sent and received messages (email and SMS), campaigns, workflows, pipelines, funnels, products, notes
• Credentials for your third-party services: for example your own Twilio account credentials, stored encrypted and used only to send and receive your text messages

2.2 Automatically collected data

• Navigation data: IP address, browser type, pages visited, session duration
• Usage data: features used, actions performed in the interface
• Technical data: connection logs, session identifiers
• Email performance data: opens and clicks on emails sent via the platform (Resend tracking)

2.3 Data of your clients' contacts

When you import or create contacts in VODOO CRM (your own customers or prospects), you act as the data controller of that data. VODOO CRM is your data processor within the meaning of the GDPR. You are responsible for the legality of collecting this data and for informing your own contacts.

In that capacity, VODOO CRM processes on your behalf: the emails and text messages you send to your contacts (one-to-one messages, campaigns, workflows); the replies they send you — email replies received on your organization's reply address and texts received on your number — stored in your inbox and, if you enable it, forwarded as a copy to the address of your choice; and each contact's consent status (email or SMS unsubscribe, with its date and origin), so that an unsubscribed contact no longer receives your messages.

2.4 Waitlist

If you join the waitlist from try.vodoocrm.com, we collect only your email address, the site display language, and your IP address and browser — the latter two solely to limit abusive automated signups. The legal basis is your consent, given by submitting the form. Every email carries a one-click unsubscribe link that takes effect immediately, with no reason required. This data is never sold and never passed to third parties for commercial purposes.

• Active account data: for the duration of the contractual relationship, including your contacts' conversations and messages
• Your contacts' unsubscribes: kept as long as the contact exists in your workspace, to guarantee they receive no further messages
• Data after termination: 30 days (export option), then permanent deletion
• Billing data: 10 years (legal accounting obligation)
• Security logs: 12 months
• Analytics cookies: maximum 13 months
• Waitlist: until the public launch of VODOO CRM or until you unsubscribe, whichever comes first. An unsubscribed signup is kept in an « unsubscribed » state for the sole purpose of guaranteeing we will not write to you again; permanent deletion can be requested at any time.

Your data is processed by rigorously selected sub-processors, bound to VODOO CRM by data processing agreements (DPA) compliant with the GDPR:

• Supabase (database and authentication) — hosted in the European Union (Ireland)
• Vercel (application hosting) — US company, running in Europe (Paris), SOC 2 certified
• Stripe (payment and billing) — PCI-DSS Level 1 certified
• Resend (sending platform emails and your emails, open and click tracking, receiving your contacts' replies — reception is hosted in the European Union)
• Inngest (background orchestration of workflows and campaigns)
• Sentry (technical error monitoring) — hosted in the European Union
• Upstash (request rate limiting, abuse protection)
• Cloudflare (DNS and Turnstile CAPTCHA on sign-in and sign-up forms)
• Zoho Mail (receiving emails sent to contact@vodoocrm.com)

Text messages: your texts are sent and received through your own Twilio account, under your own contract with Twilio. VODOO CRM only uses the credentials you entrust to it, stored encrypted.

WhatsApp, Instagram and Messenger: their official integration through Meta's APIs is in progress and these channels are not offered yet. Once they are, Meta Platforms will be involved only for messages exchanged on a Meta channel you have connected; this policy will be updated at that time.

Your data is never sold to third parties for commercial purposes.

Some sub-processors are established outside the European Union (particularly in the United States). These transfers are governed by appropriate legal mechanisms: Standard Contractual Clauses (SCCs) from the European Commission and/or adherence to the EU-US Data Privacy Framework.

VODOO CRM implements appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure or destruction:

• Encryption of data in transit (TLS 1.3) and at rest
• Secure authentication with JWT session management
• Tenant-level access control (Supabase Row Level Security)
• Credentials for your third-party services (Twilio, integrations) encrypted at rest (AES-256-GCM), never sent back to the browser
• Access to production data limited to authorized employees

In accordance with the GDPR (if applicable) and data protection laws, you have the following rights regarding your personal data:

• Right of access: obtain a copy of data concerning you
• Right of rectification: correct inaccurate data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to portability: receive your data in a structured, readable format
• Right to object: object to certain processing (e.g. marketing)
• Right to restriction: request restriction of processing in certain cases
• Right to withdraw consent: at any time for consent-based processing

To exercise these rights, contact us at contact@vodoocrm.com specifying your request. We will respond within one month.

VODOO CRM uses cookies and similar technologies. To learn more, please see our Cookie Policy.

For any questions regarding the protection of your data: contact@vodoocrm.com

If you believe that the processing of your data does not comply with applicable regulations, you have the right to lodge a complaint with the competent supervisory authority (in France: the CNIL, www.cnil.fr).