Privacy Policy

1. Information we collect

• Account information — your name, email address, and password (stored hashed, never in plain text), plus any profile info you add.
• Customer Data — the CRM records you and your team create: leads, contacts, accounts, opportunities, notes, tasks, and similar business data you choose to store in Colurian. This data belongs to you; we process it on your behalf to run the Service.
• Usage and log data — basic technical logs (e.g. request timestamps, error logs, IP address at the time of a request) generated by using the Service, used for security, debugging, and abuse prevention.

We don't currently use analytics or advertising trackers, and we don't sell your data to anyone.

2. How we use it

• To provide, maintain, and secure the Service;
• To communicate with you about your account (e.g. email verification, password reset, teammate invites, security alerts);
• To power optional AI features you or your team choose to use (see below); and
• To diagnose and fix problems, and to improve the Service.

3. AI processing

You can connect your own AI app, such as Claude or ChatGPT, to Colurian as a connector. When you do, that app can read and change the records you're permitted to access — and only those — when you ask it to. Record data it retrieves is sent to that AI provider and handled under your own agreement with them, not this Policy; that provider is your choice, not one of our sub-processors. You decide what to connect, a workspace owner can turn connectors off for members, and you can disconnect an app at any time in My Settings (owners in Setup → AI Apps).

Some workspaces may also have built-in AI features that we run with Anthropic, our AI model provider. They send only the fields you're permitted to see, and any change to a record still requires your approval.

4. Who we share data with

We don't sell your data. We share it only with the service providers ("sub-processors") that help us run Colurian, each bound to only use it to provide their service to us:

• Appwrite — database, authentication, and file storage;
• Vercel — application hosting;
• Twilio SendGrid — delivery of transactional emails (verification, invites, password resets, alerts);
• Cloudflare — DNS and email routing for the colurian.com domain, and, where enabled, Turnstile bot checks on public Web-to-Lead forms (which see the submitter's IP address);
• Stripe — payment processing and billing for paid plans (we never see or store full card numbers);
• Anthropic — AI model processing for built-in AI features, where they're enabled.

Some features connect Colurian to a provider only when you or your team choose to turn them on:

• Google (Gmail) and Microsoft (Outlook) — if you connect your mailbox, Colurian sends email through it and syncs messages with your records, using the access you grant when connecting;
• Twilio — if your workspace connects its own Twilio account, calls and call details go through that account.
• Meta (WhatsApp Business Platform) — if your workspace connects a WhatsApp Business number, we receive the messages exchanged between that number and its contacts (text, media and delivery status), each contact's WhatsApp profile name and phone number or WhatsApp user ID, and, if you choose to share it when connecting, up to 180 days of earlier chats. We store them as Customer Data in your workspace, show them only to the users your workspace's permissions allow, and use them only to provide the Service. Disconnecting stops new messages; Meta processes messages under its own terms and the WhatsApp Business Messaging Policy;
• Your own AI app (for example Claude by Anthropic, or ChatGPT by OpenAI) — if you connect one, it receives the records it retrieves on your behalf, under your own account with that provider.

We may also disclose information if required by law, or to protect the rights, property, or safety of Colurian, our users, or others.

5. Cookies

Colurian uses a small number of first-party cookies required for the Service to function: one to keep you signed in, one to remember your active workspace, one for your light/dark theme preference, and one for a sidebar layout preference. None of these are used for advertising or cross-site tracking, and we don't use any third-party tracking cookies.

6. Data retention and deletion

We retain your account and Customer Data for as long as your account is active. If you close your account or your organization's subscription ends, we'll retain your data for a reasonable period to allow for export or reactivation, then delete it, except where we're required to keep it longer by law. You can request deletion or an export of your data at any time by emailing hello@colurian.com.

A few kinds of data are deleted automatically on a fixed schedule, whether or not your account is active:

• Recycle Bin — deleted records can be restored for 30 days, then are permanently deleted.
• Backups — backups your workspace schedules to run automatically are kept for 30 days (and no more than 30 at a time); backups made by hand are kept for 90 days.
• Security log — the record of security-relevant actions in your workspace (such as exports, backup downloads, and permission changes) is kept for one year.

When you ask us to delete your account or your organization's workspace, we verify the request and then permanently delete the workspace's records, files, backups, and security log, along with the user accounts that belong to no other workspace. We aim to complete this within 30 days of confirming the request.

7. Security

We use industry-standard measures to protect your data, including encryption in transit, hashed passwords, and role- and field-level permission controls within the Service itself so teammates only see what they're allowed to see. No system is perfectly secure, and we can't guarantee absolute security.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise any of these rights, email hello@colurian.com. For Customer Data about third parties (like your own contacts) that your organization controls, we'll generally direct that request to your organization, since they control that data.

Colurian is operated from California. If you're a California resident, the rights above are consistent with the California Consumer Privacy Act (CCPA) — we honor requests from any user regardless of residency or whether Colurian meets the CCPA's applicability thresholds. We don't sell or share personal information for cross-context behavioral advertising, so there's nothing to opt out of on that front.

9. Children

Colurian is not directed at, and we don't knowingly collect information from, anyone under 18.

10. International transfers

Our service providers may process data in countries other than your own. Where required, we rely on appropriate safeguards (such as those service providers' own standard contractual terms) to protect data transferred this way.

11. Changes to this Policy

We may update this Policy as the Service evolves. If we make a material change, we'll post the updated Policy here with a new "Last updated" date and, where practical, notify you directly.

12. Contact

Questions about this Policy or your data? Email hello@colurian.com.