Our commitment
CRMRestore takes data protection seriously. We are committed to handling your personal data and your CRM data in line with the EU General Data Protection Regulation (GDPR) and equivalent privacy laws worldwide.
What data we hold
- Your account details (name, email, subscription tier)
- Your ActiveCampaign API URL and API key, encrypted at rest
- Backup snapshots of the ActiveCampaign data you choose to back up (contacts, deals, automations, etc.)
- Standard service logs (timestamps, request metadata) used to operate and secure the service
How your data is protected
- Encryption at rest: All ActiveCampaign API credentials are encrypted using AES-256-GCM
- Encryption in transit: All connections use TLS 1.2 or higher
- Authentication: Login is handled by Clerk with a mandatory second-factor PIN
- Access controls: Only authorised CRMRestore systems can access backup data, scoped per user
- Audit logging: Every access to your encrypted credentials is logged with the reason and the calling system
Where your data is stored
CRMRestore runs on Google Cloud infrastructure. By default, our production database and backup storage are located in the United States. Google Cloud operates under Standard Contractual Clauses (SCCs) approved by the European Commission, which provide a lawful basis for transferring personal data of EU residents outside the EU.
If your organisation requires data residency within the European Union, contact us at the email below. We can provide a dedicated EU-hosted deployment for enterprise customers on request.
Your rights under GDPR
If you are a resident of the EU, the UK, or other jurisdictions with similar laws, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Export your backup data at any time
- Object to or restrict certain types of processing
- Lodge a complaint with your local supervisory authority
To exercise any of these rights, contact us using the link below. We will respond within 30 days.
Sub-processors
We rely on the following sub-processors to deliver CRMRestore. Each operates under their own GDPR-compliant terms:
- Google Cloud - hosting, database, storage
- Clerk - authentication
- Stripe - payment processing
- Resend - transactional email
- ActiveCampaign - the CRM you connect to (your data is fetched from here, not stored by them on our behalf)
Data Processing Agreement
Business and Enterprise customers can request a signed Data Processing Agreement (DPA) for their records. Contact us using the link below.
Contact
For privacy questions, data requests, or to request a DPA, please contact us here.