Privacy Policy

Who operates the service

M7 CRM operates M7 CRM. Privacy and data requests can be sent to info@m7tech.info.

Information we process

• Account and workspace data: names, email addresses, authentication data, roles, tenant name, plan, and security settings.
• CRM data: companies, contacts, leads, tasks, notes, assignments, pipeline activity, imports, and other information users choose to enter.
• Meta integration data: connected Page identifiers and names, encrypted access credentials, lead-form submissions, Page-scoped participant identifiers, Messenger text messages, public Facebook comments and replies, delivery status, and webhook audit information.
• Technical data: sessions, timestamps, operational logs, queue and service health, and security events needed to run and protect the service.
• Support requests: the name, email, company, topic, plan interest, and message a visitor chooses to submit through the contact form.
• Business-card scans: the default scanner processes card photos and raw recognized text in the user's browser. Only fields the user reviews are submitted. The optional server scanner temporarily stores a private image and deletes it after saving or after 24 hours if abandoned.

How we use information

We use information to provide and secure the CRM, authenticate users, route leads and messages to the selected customer account, send authorized replies and reminders, enforce plan limits, diagnose failures, prevent duplicate webhook processing, and respond to support or deletion requests. We do not sell CRM or Meta Platform data.

Meta and other service providers

When a workspace administrator connects Meta, the service communicates with Meta's APIs at that administrator's direction. Meta separately processes information under its own terms and privacy policy. We may use hosting, database, email-delivery, monitoring, and security providers that process information only as needed to operate the service.

Storage, security, and tenant separation

Each customer workspace is logically separated. The server derives workspace ownership rather than accepting it from browser input. Integration credentials and access tokens are encrypted at rest. Access is limited by authenticated roles, and external webhook deliveries are verified and processed idempotently. No internet service can guarantee absolute security.

Retention and deletion

Workspace and CRM records are retained while needed to provide the service and meet legitimate security, audit, or legal obligations. Deleting a Meta connection removes its stored credentials, webhook history, and linked conversation records from the active database through database relationships. Removing access in Meta stops future access but does not by itself delete information already received by the CRM.

To request access, correction, export, or deletion, follow the data deletion instructions. We may need to verify identity and workspace authority before acting.

Children

M7 CRM is a business service and is not directed to children.

Policy changes

We may update this policy when the product or legal requirements change. The effective date at the top identifies the current version.