PetalCRM Privacy Policy

Last updated: 30 October 2026

This policy explains what personal data PetalCRM collects, why, who helps us handle it, how long we keep it, and the choices you have.

1. Who we are

PetalCRM is a sales CRM run by PetalCRM, HaPodim 20 St., Ramat Gan, Israel ("PetalCRM", "we"). You can reach us at privacy@petalcrm.ai.

2. Our role

We use your personal data only as much as we need to run PetalCRM for you, keep it secure and improve it: your account, how you sign in, how you use PetalCRM, and our service records. For that data we are the controller.

Everything a business puts into its PetalCRM workspace, including the email it captures, belongs to that business, which is the controller. We handle it only on that business's instructions, under our agreement with it. If you are a contact of one of our customers, their privacy notice applies to you.

3. What we collect

• Account data: your name, email address, role and sign-in details. It comes from you, or from the colleague who invited you.
• Usage data: technical information such as IP address, browser and service logs, and which features you use and when (for example, that a deal was created), and what an AI agent connected to your workspace sends us as a request or rating, linked to your user and workspace. We record what was done, not what you entered. If you signed up from a link that named a campaign or source, and agreed to share it, we keep that with your workspace.
• Workspace content: the information your team adds to PetalCRM. Your organisation controls it (section 2).
• Connected email: if your team connects a mailbox or forwards email to PetalCRM, the business email exchanged with people and organisations already in your CRM: its sender, recipients, subject and date, and its text if your workspace stores email. We do not keep other email or attachments.
• Billing data: if your workspace has a paid plan, its plan and subscription details. We never receive card details.

4. Why we use it

• To give you and your team PetalCRM under our agreement: setting up your account, signing you in, and providing the features of your plan.
• To keep PetalCRM secure and reliable, to understand how it is used and to make it better, in our legitimate interest in offering a safe, dependable product that keeps improving.
• To learn where sign-ups come from, with your consent, which you can withdraw.
• To handle your workspace's content for your organisation, as section 2 describes.
• To meet our legal obligations.

We need your email address to create your account; anything else you share is up to you.

5. Who helps us

We do not sell personal data. We share it with service providers that work for us under contract and on our instructions, only to run PetalCRM: hosting and database, AI model, email delivery, network and analytics providers, in the EU, the United States and elsewhere. Each is named at petalcrm.ai/sub-processors.

Paid plans are sold by our payment reseller, which takes payment on its own checkout page under its own privacy policy. It receives nothing from your workspace.

6. International transfers

Some of our providers process data outside the EU and the UK, including in the United States. We protect those transfers with the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or the EU-U.S. Data Privacy Framework. You can ask us for a copy.

7. How long we keep it

We keep personal data in line with applicable law, for as long as we need it for the purposes in section 4, and then delete it:

• Account, workspace and billing data: while the account and workspace exist. When a customer's agreement ends, we keep its data for 60 days so it can be safely exported, then delete it, unless the law requires us to keep something. If you delete your account while you are your workspace's only owner, we keep your account and the workspace closed until the workspace's erasure date, so you can restore them by signing in, and then erase both; anyone else's account is erased when they delete it.
• Email text: for 12 months, or another period your workspace's administrator chooses, or until storage is turned off. Email that reaches your workspace's PetalCRM email address before storage is on may be held unread for up to 14 days while an administrator decides.
• Usage data: service logs for a short period; records of which features were used, and daily sign-in records, for as long as we need them to run and improve PetalCRM, which includes comparing a period with the same period a year earlier, and then we delete them. Longer only where a record is needed for legal or security purposes. They are deleted with your workspace.
• Agent requests and ratings: requests until they are closed, then 90 days (and at most 12 months if still open); ratings 90 days. Counts per tool, which name no one, may be kept longer.

We keep backups only to recover from a failure, and deleted data leaves them when they expire.

8. AI features

PetalCRM uses AI models where they help, to give you a better sales CRM with the smart features you expect from today's software tools.

We do not train or fine-tune any AI model on your data, and we choose only AI providers that do not train or fine-tune on it either.

Improving PetalCRM. To make PetalCRM better, we use workspace data only in anonymised or aggregated form, which identifies no one. We may also keep chat-assistant conversations, with anything taken from your email removed first, and read and analyse them to improve the assistant and PetalCRM, fix faults, answer feedback and keep it secure. We keep them only as long as we need them for this, and then delete them. We do this for our own purposes, so for these conversations we, not your organisation, are responsible for your data. You can say no at any time, or your workspace owner can switch it off, by writing to privacy@petalcrm.ai; we then delete the conversations we kept. The assistant works the same either way.

Feature requests. If you choose to send a feature request from the assistant, we keep your words, your user ID and your workspace, read them to decide what to build, and tell you in the app when it is available. We do this for our own purposes, so for these requests we, not your organisation, are responsible for your data. We delete the text after the request is closed, and you can delete it yourself at any time under My feature requests.

Requests and ratings from AI agents. If your organisation connects an AI agent to PetalCRM, that agent can send us two things on your behalf: a feature request, when it cannot do what you asked with the tools it has, and a rating of how well a recent tool call worked (useful, not useful or wrong, with an optional short reason). We keep the agent's words, the name the agent gives itself, your user ID, your workspace and the time. The agent is told not to include anything from your records or any email address, and PetalCRM rejects what it can recognise as such. We read these to decide what to build and to see which tools need fixing, and we do not use them for anything else. We do this for our own purposes, so for these we, not your organisation, are responsible for your data. Your workspace's administrators can see everything the agents sent, and can stop the agents sending it, in the app. You can see and delete what was sent in your name under My feature requests.

9. Your rights

Depending on where you live, you can ask to see, correct, delete, restrict or move your data, and withdraw any consent you gave.

You can also object at any time to our use of your data based on our legitimate interests (section 4).

Write to privacy@petalcrm.ai from your account's address, and we will reply as soon as we can, within the time the law sets. Workspace owners and administrators can export the workspace's data from the app.

If a business that uses PetalCRM holds your data, that business decides what happens to it, and we help it answer your request. To find out whether a business using PetalCRM holds data about you, ask on this page: enter your email address and we send the answer to that address. It names each business (workspace) that holds data under it, and we pass your request on to that business, which answers the rest.

If you have a concern, please tell us first and we will do our best to put it right quickly. You also have the right to complain to the data protection authority where you live.

10. Connected accounts

When you sign in with an identity provider, such as Google or Microsoft, we receive your account identifier and email address. When you connect a mailbox, we get read-only access to your mail and capture only the business email described in section 3; we cannot send, change or delete your email. We use data from connected accounts only to provide these features in PetalCRM. We share it only with the service providers in section 5, to run those features, and never for advertising, sale to data brokers or credit decisions.

PetalCRM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes, including Gmail, will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use data from Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine-learning models.

Disconnecting. Disconnecting a mailbox in PetalCRM stops capture at once, and our access ends once no other PetalCRM connection uses it. You can also remove PetalCRM's access in your provider's account settings. Email already captured stays with your team's workspace until its storage period ends or it is deleted. To have it deleted, ask your workspace owner.

11. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, use, change, disclosure or loss.

12. Cookies

We use cookies only in the PetalCRM app, and only the ones it needs to keep you signed in and to connect your mailbox securely. The longest lasts 7 days.

To make PetalCRM better for you, we also like to learn which screens and features people use, so we can see what helps and fix what gets in the way. On our website, this uses no cookies and stores nothing on your device except the choice you made. In the app, it keeps an identifier in your browser's storage, not in a cookie. We never record what you type, your emails or your contacts. Where the law requires your consent, analytics stays off until you say yes. You can say no, or change your mind at any time: under Usage analytics in the app's Settings, or Analytics at the bottom of our website.

13. Changes

When what we do with data changes, we update this page. Before we start using data we already hold in a new way, we tell you in the product or by email, and ask for your consent where the law or a connected provider's terms require it.

The workspace owner can delete the workspace from its settings.