Privacy Policy

1. Who we are

OpenCRMApp ("we", "us", "our") is an independent mobile application for Vtiger CRM Community Edition. OpenCRMApp is not affiliated with, endorsed by, or an official product of Vtiger. Our website is located at https://opencrmapp.com/vtigermobile/.

OpenCRMApp gives sales, support, and field teams mobile access to their self-hosted Vtiger CRM installation, with proactive push notifications and personalized reminder workflows.

For data protection inquiries, you can reach us at privacy@opencrmapps.com.

2. Data we collect

2.1 Marketing website & contact forms

When you submit a demo request, trial request, or contact form on this website, we may collect:

• Contact information: name, work email address, company name.
• CRM details: Vtiger version, number of users, and a description of the workflow or notification you need — provided voluntarily by you.
• Preferred contact method: email, WhatsApp, or other channel you specify.

We use this information solely to respond to your inquiry and to evaluate compatibility with your Vtiger installation. We do not use it for unsolicited marketing.

2.2 Community platform accounts

If you register for a community account, we may collect:

• Account information: username, display name, email address, and password (stored as a secure bcrypt hash — never plain text).
• Community content: posts, replies, and articles you publish on the platform.

2.3 Automatically collected data

When you visit our website, our servers automatically record:

• IP address (anonymized after 24 hours)
• Browser user-agent string
• Date and time of request
• Pages and resources requested

This data is used solely for security, abuse prevention, and aggregate traffic analysis. It is not linked to individual user profiles and is not shared with advertisers.

3. OpenCRMApp mobile app & your CRM data

Specifically:

• Your Vtiger credentials (server URL, username, and access key) are stored only on your device using secure local storage. They are never sent to our servers.
• All API requests are made directly from the OpenCRMApp on your device to your Vtiger CRM server's IP address or domain — no OpenCRMApp proxy server is involved.
• Offline data cached by the app is stored locally in a SQLite database on your device. It is not transmitted to us.
• Notification workflow rules you define in OpenCRMApp are stored locally on your device and evaluated against data retrieved directly from your CRM server.

4. Push notifications

OpenCRMApp delivers push notifications to your device. The delivery mechanism depends on your platform:

• Android: Push notifications are delivered through Google Firebase Cloud Messaging (FCM). Google processes the notification payload (which may include CRM record identifiers or short reminder text) in order to deliver the notification to your device. Google's privacy policy applies: policies.google.com/privacy.
• iOS: Push notifications are delivered through Apple Push Notification service (APNs). Apple processes the notification payload to deliver it to your device. Apple's privacy policy applies: apple.com/legal/privacy.

We minimize the data included in notification payloads. Notification content is generated from the rules you define and the CRM data retrieved from your own server.

You can disable push notifications at any time from your device's system settings. This will not affect your access to the app or CRM records.

5. Cookies & tracking

We use the following types of cookies on this website:

• Essential cookies: A session cookie (oca_session) is required to keep you logged in to the community platform. This cookie is HttpOnly, SameSite=Lax, and is never used for advertising.
• Preference cookies: We store your cookie consent choice in localStorage so we do not show the consent banner on every visit.

We do not use advertising cookies, third-party trackers, Google Analytics, Facebook Pixel, or any similar behavioral tracking technologies on this website.

OpenCRMApp mobile apps do not use advertising SDKs or cross-app trackers. Any analytics collected within the app (such as crash reports) is disclosed separately in the relevant app store listing.

You can clear cookies and localStorage at any time through your browser settings.

6. How we use your data

We use the data we collect to:

• Respond to demo requests, trial requests, and custom workflow inquiries you submit through this website.
• Provide and maintain the community platform (account login, post authorship).
• Send transactional emails (password reset, account confirmation, response to inquiries) — no unsolicited marketing emails without explicit consent.
• Monitor and improve site security and performance using anonymized aggregate data.
• Comply with legal obligations.

We never use your data for advertising profiling, automated decision-making with legal effect, or any purpose not listed above.

7. Data sharing & third parties

We do not sell, rent, or trade your personal data. We may share data only in these limited circumstances:

• Hosting provider: Our website is hosted on a server whose provider has access to server logs. They are bound by a data processing agreement.
• Email delivery: Transactional emails are sent via a third-party SMTP provider, who processes the recipient email address.
• Google & Apple (push notifications): Notification delivery requires routing through FCM (Android) or APNs (iOS) as described in Section 4.
• Law enforcement: We will disclose data only if required by applicable law, court order, or governmental authority.

All third-party processors are selected for GDPR compliance and have signed appropriate data processing agreements (DPAs) where required.

8. Data retention

• Demo / contact form submissions are retained for 90 days after the inquiry is resolved, then deleted.
• Community account data is retained for as long as your account is active, plus 90 days after deletion to allow for account recovery.
• Community posts may remain on the platform after account deletion in anonymized form unless you specifically request full removal.
• Server logs are retained for 30 days for security purposes, then automatically deleted.
• Session cookies expire after 30 days of inactivity.

9. Your rights (GDPR / CCPA)

Depending on your location, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your account and personal data.
• Right to data portability: Receive your data in a machine-readable format (JSON).
• Right to object: Object to processing of your data for specific purposes.
• Right to restrict processing: Request that we limit how we use your data pending resolution of a concern.
• Right to withdraw consent: Withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@opencrmapps.com. We will respond within 30 days. California residents may also have additional rights under CCPA — please include "CCPA Request" in your subject line.

10. Security

We implement appropriate technical and organizational measures to protect your data:

• Passwords are hashed with bcrypt (cost factor 12) — they are never stored in plain text.
• CSRF tokens protect all forms against cross-site request forgery.
• HTTPS (TLS 1.2+) encrypts all data in transit between your browser and this website.
• HTTP security headers (X-Content-Type-Options, X-Frame-Options, HSTS) are enforced.
• Database access is restricted to least-privilege credentials.
• The OpenCRMApp mobile app communicates with your CRM server over HTTPS. We strongly recommend that your Vtiger CRM installation is accessible via HTTPS only.

Despite our best efforts, no system is perfectly secure. In the event of a data breach affecting your personal data, we will notify you within 72 hours as required by GDPR.

11. Children's privacy

OpenCRMApp is a business productivity tool intended for use by adults in a professional context. It is not directed to persons under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, provide more prominent notice. Your continued use of OpenCRMApp or this website after changes are posted constitutes your acceptance of the revised policy.

We recommend reviewing this page periodically. The version history is available on request.

13. Contact us