1. Overview and two roles we play
This Privacy Policy explains how Softmatica, Inc. ("Softmatica," "we," "us") handles information in connection with our customer relationship management platform (the "Service"). Because the Service is a CRM, we handle two categories of information that are treated very differently, and it is important you understand the distinction. First, we collect account and billing information directly from you, the person or organization using Softmatica, and here we act as a data controller. Second, our customers store records about their own contacts, leads, and business customers inside their Softmatica workspace ("CRM Data"), and here we act only as a data processor, acting on our customer's instructions and never as the owner of that data.
2. Account and billing data we collect directly (as controller)
When you sign up for or use Softmatica, we collect information such as your name, work email address, company name, password (stored as a salted hash), billing address, and payment details (processed by our payment processor, not stored on our servers in raw form). We also collect technical information such as IP address, browser type, device information, and usage logs generated as you interact with our website and application. We act as the data controller for this account and billing information, and this section 2 describes our controller-role collection and use.
3. CRM Data our customers store (as processor)
Our customers use Softmatica to store contact records, company records, deal and pipeline notes, email correspondence, and similar data about their own leads and customers. This CRM Data belongs to our customer, not to Softmatica. We process CRM Data solely to provide the Service, under the instructions of the customer who controls that workspace, and subject to the data processing terms in our customer agreement and, for Enterprise customers, a separate Data Processing Addendum. If you are an individual whose information appears in a Softmatica customer's CRM Data and you have questions about that data, please contact that customer directly, as they control how their CRM records are used; we will assist our customers in responding to such requests as required by applicable law.
4. Cookies and analytics
We use cookies and similar technologies on our marketing website and within the Service for authentication, session management, remembering preferences (such as light or dark theme), and product analytics that help us understand how the Service is used and where to improve it. We use a mix of first-party cookies and privacy-conscious analytics tooling. You can control cookies through your browser settings, though disabling essential cookies may affect the Service's functionality.
5. Third-party integrations and OAuth scopes
Softmatica integrates with third-party tools including GitHub, Linear, Jira, Slack, Zapier, Google Workspace, Microsoft Outlook, Stripe, Segment, and Intercom. When you connect one of these tools, you authorize Softmatica, typically through an OAuth flow, to access a limited, specific set of data from that provider, such as issue titles and statuses from GitHub or Linear, channel messages from Slack, or calendar and contact data from Google Workspace or Outlook, strictly to power the corresponding feature inside Softmatica. We request only the OAuth scopes necessary for the features you enable, display those scopes to you before you approve the connection, and you may revoke access at any time from your workspace's integrations settings, which also stops any further data collection from that provider.
6. How we use information
We use account and billing information to operate, maintain, and improve the Service, process payments, communicate with you about your account, provide customer support, detect and prevent fraud or abuse, and comply with legal obligations. We use CRM Data only as instructed by the customer who controls it, to provide the Service, including features like search, automation, and reporting within that customer's own workspace. We do not sell CRM Data, and we do not use one customer's CRM Data to build products or insights for another customer.
7. Data retention
We retain account and billing information for as long as your account is active and as needed to comply with legal, tax, and accounting requirements after closure. CRM Data is retained for the duration of the customer's subscription and for 30 days following cancellation or termination to allow for export or reactivation, after which it is deleted from production systems and purged from backups on a rolling schedule. Customers may request earlier deletion of their workspace data by contacting support.
8. Security measures
We use encryption in transit and at rest, role-based access controls, network segmentation, continuous monitoring, and regular independent audits to protect information in the Service. Full details of our security program, including our SOC 2 Type II report and infrastructure practices, are available on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep our practices current with industry standards.
9. Sub-processors
We use a limited number of third-party sub-processors to help deliver the Service, such as cloud infrastructure providers, email delivery services, and payment processors. Each sub-processor is bound by a written agreement requiring them to protect data to a standard consistent with this Policy and, where applicable, our Data Processing Addendum. A current list of sub-processors is available on request at privacy@softmatica.net, and we will provide advance notice of material changes to Enterprise customers under a signed DPA.
10. Your rights under GDPR, CCPA, and similar laws
Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to opt out of the sale or sharing of personal information (Softmatica does not sell personal information). Residents of the European Economic Area, United Kingdom, and California, among other jurisdictions, can exercise these rights by contacting us at privacy@softmatica.net. If your personal information appears in a Softmatica customer's CRM Data, we will forward your request to that customer or assist them in fulfilling it, since they control that data as instructed above.
11. International data transfers
Softmatica is headquartered in the United States, and information we collect may be processed and stored in the United States and other countries where we or our sub-processors operate. Where required, we rely on appropriate safeguards for international transfers, such as Standard Contractual Clauses, to ensure information receives an adequate level of protection regardless of where it is processed.
12. Children's privacy
Softmatica is a business-to-business product intended for use by working professionals. The Service is not directed to, and we do not knowingly collect personal information from, anyone under the age of 16. If we learn that we have inadvertently collected personal information from a child under 16, we will take steps to delete it promptly.
13. Data Processing Addendum for Enterprise customers
Customers on our Enterprise plan, or any customer who requires one to meet their own compliance obligations, can request a Data Processing Addendum ("DPA") governing our processing of CRM Data as a processor, including Standard Contractual Clauses where applicable. To request a DPA, contact your account team or privacy@softmatica.net.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will provide notice by email or through the Service before the changes take effect, and the revised policy will be posted on this page.
15. Contact us
Questions or requests regarding this Privacy Policy or our data practices can be sent to privacy@softmatica.net. For general inquiries, reach us at hello@softmatica.net.