Mitra CRM Privacy Policy
Version 1.2.0
This policy explains how Automaid handles personal information in Mitra CRM. Automaid is the brand under which Mitra CRM is offered. It is written to align with Canada's *Personal Information Protection and Electronic Documents Act* (PIPEDA) and Alberta's *Personal Information Protection Act* (PIPA).
1. Two different relationships
There are two kinds of personal information in Mitra CRM, and our role differs for each.
Your staff's account information. Names, email addresses and sign-in activity for the people who use your workspace. We are accountable for this directly.
Your customers' information. The lead, job and quote records your staff enter about the households you serve. You are accountable for this — we hold and process it on your behalf and on your instructions, as your service provider.
If one of your customers asks about their information, that request goes to you. We will help you answer it.
2. What we collect
- Account information — name, email, and the business details you enter at signup.
- Service content — the customer, job, quote and message records you create.
- Assistant questions and support requests — what your staff type into the in-app Assistant, which is processed to answer it, and the support requests they choose to send us from inside Mitra CRM.
- Technical information — logs, device and connection data needed to run and secure the service and to investigate problems, and page-view and performance measurements from your browser that tell us how the application is performing.
We do not collect payment card numbers. Mitra CRM does not process payments today. If paid plans are introduced, card details will be handled directly by a payment provider and will not reach our systems.
3. Why we use it
To provide and support the service, to secure the platform and investigate misuse, to bill you, and to meet legal obligations.
We also produce aggregated, anonymized statistics from data in the service — for example typical pricing, job duration and property characteristics by region — which we may publish or license as market reports.
These statistics do not identify you, your business, your staff, or any individual household or property. We commit to keeping them in anonymized form, not attempting to re-identify anyone from them, and requiring the same of anyone we share or license them to. Your business can opt out of contributing to them going forward — see Terms section 5.6.
4. Who we share it with
We share personal information only with the service providers that help us run Mitra CRM — hosting and the database, page-view and performance analytics, email delivery, address lookup, bot protection on sign-in, error monitoring, the AI service behind the in-app Assistant, the AI service behind optional email-sorting suggestions (which your team always confirms), our support help desk, and the engineering tools we use to maintain the service — and only as needed for them to do that work. The current list is published at https://app.mitracrm.com/legal/subprocessors and is kept up to date as providers change.
We may also disclose information where the law requires it, or to protect our rights or someone's safety.
We do not sell personal information.
5. Where it is stored
Mitra CRM is hosted in North America. The systems that hold and run the service — our application database, authentication and application hosting — operate in Canada or the United States, and the information they hold may be accessible to courts and authorities in those countries under their laws.
Some of the third-party services we use may process information outside Canada and the United States. In particular, when your staff use address autocomplete, the address text is sent to Google, which may process it internationally. The subprocessor list linked in section 4 names each provider and what it does.
6. How long we keep it
We keep Customer Data for as long as your workspace is active. After termination we keep it for 30 days so you can export it, then delete it. We keep account and billing records longer where we need them for tax, accounting or legal purposes. Aggregated anonymized statistics are not personal information and are not deleted.
7. How we protect it
Tenant isolation enforced in the application and by database row-level security; encryption in transit and at rest; encryption of stored third-party mail credentials; least-privilege database roles; auditing of record access, exports and administrative actions; secret scanning and key rotation.
No system is perfectly secure, but these controls are proportionate to the sensitivity of the information we hold.
8. Your choices and rights
You can access and correct your account information in the application, export individual customer records from the application, ask us for a copy of your workspace data, and close your account.
Individuals whose information is held by one of our customers should contact that business directly — see section 1.
Depending on where you live you may have additional rights over your personal information. Ask us and we will tell you what applies.
9. Contact and complaints
privacy@automaid.app
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.
10. Changes
We may update this policy. If a change is significant we will tell you before it takes effect.