Privacy Policy

1. Who We Are

Legal Entity Name: Sellframe Ltd. (trading as "Add to CRM")

Registered Office Address: 14 Avonside Grove, Hamilton, UK, ML3 7DL

Jurisdiction: Scotland (UK)

Contact Email: phil@addtocrm.com

We do not currently have a Data Protection Officer (DPO) or EU/EEA Representative appointed.

2. Personal Data We Collect

2.1 Information You Provide Directly

• Account Information: When you sign up for an account, we may collect your name, email address, and login credentials.
• CRM Setup Details: If you integrate a CRM system (e.g., Pipedrive, Agile CRM, etc.) via our Services, we collect and store your CRM connection credentials (API keys and/or OAuth tokens), CRM user ID, domain, and other necessary configuration details. These credentials are encrypted using AES-256-GCM authenticated encryption and stored on our servers to maintain your CRM connection.
• Payment Information: If you purchase a subscription, our payment processor (Stripe) will collect your payment details. We do not store your credit or debit card numbers directly, but may receive minimal billing information (e.g., subscription status, partial billing address).
• Support or Communication: When you contact us (e.g., via email or contact forms), we collect the information you provide (e.g., your name, contact details, and the content of your message).
• Connection Lists You Upload: You may upload the Connections.csv file from your own LinkedIn® data export. That file describes other people: for each of your connections it can include their name, public profile link, employer, job title, the date you connected, and an email address where LinkedIn® included one. We store it against your account for one purpose — to show you which of those people already exist in your connected CRM, and which do not. We do not contact anyone in it, we do not add it to any shared, resold or public dataset, and it is deleted when you delete your account (see Section 8).

2.2 Information Collected Through Our Extensions

• Profile Data from Web Pages: When you use our extension on LinkedIn®, Gmail, or Outlook, we collect publicly visible profile information from the page you are viewing, such as the person's name, job title, company name, location, and profile URL. This information is sent to our servers and to third-party data enrichment providers to retrieve additional contact details (such as email addresses, phone numbers, and company information) at your request.
• Email Data: When used on Gmail or Outlook, we collect the sender's email address and name from the message you are viewing.
• Usage Data: Our Chrome extensions capture certain usage data, such as when you click to fetch contact information and which contacts you choose to add to your CRM, in order to facilitate synchronization and improve the service.

2.3 Automatically Collected Data

• Analytics: We use Fathom Analytics for website and product analytics. Fathom Analytics does not use cookies by default (it's a privacy-friendly solution).
• Cookies: We use our own cookies primarily for authentication and session management. For more details, see Section 7: Cookies & Tracking.
• Sign-in, Purchase and Session Records: When you sign up or sign in, when you start or complete a purchase or a change to your subscription (a checkout, extra seats, a credit pack, a change of billing interval, or reactivating a subscription), and while you stay signed in (at most once a day for each kind of client and each network address you use, and never more than 20 such records for one account on one day), we record what happened and when, the IP address the request came from, the approximate country that address belongs to, your browser's user-agent string (the browser and operating system it reports), whether the request came from our website, our Chrome extension, our API or something else, and, for a purchase, the identifier of the Stripe subscription, checkout or invoice concerned (and its billing interval, where there is one). We take the IP address and country from Cloudflare, which sits in front of our website and API (see Section 5); for a request that does not pass through Cloudflare, we record the address the connection itself came from. We use these records to keep accounts secure, to detect and prevent fraud and misuse, and to answer a payment dispute raised with a card issuer (see Sections 3 and 4). Section 8 says how long they are kept.
• Browser Fingerprint at Signup: When you create an account, our website calculates a browser fingerprint (an identifier derived from characteristics your browser and device report, using the open-source FingerprintJS library) and sends it to us with your signup. We store it with your account and use it to limit how many accounts can be created from one device, which helps us prevent fraud and abuse. If we refuse a signup (for example because the email address is from a disposable-email domain, or because the device already has several accounts), we keep a record of the attempt in our fraud-prevention records: the fingerprint, the email address and name entered, and the time. Section 8 says how long.
• How You Found Us: The first time you visit our website, your browser keeps a short note in its own storage (localStorage, not a cookie): the page you landed on (the address path only, never anything after a ? or #), the website that sent you (its host name only, such as www.google.com, and nothing for a visit that began on our own pages) and any campaign tags in the link you used (utm_source, utm_medium, utm_campaign, utm_term, utm_content and via). A note older than 90 days is replaced by your next visit. If you then create an account, your browser sends the note to us with your signup, and we store it with your account (and, if you later start a subscription, with your customer record in Stripe) so we can tell which pages and sources bring in people who go on to use the service. If you never sign up, we never receive it. You can remove it at any time by clearing your browser's site data.
• Error Reports: When something fails in our website or our Chrome extension (a page crashes, or an action you took ends in an error), it sends us an error report so we can find and fix the fault. A report holds the error message and its technical stack trace, the page it happened on (the address path only, never anything after a ? or #, where sign-in and reset codes can appear), the version of the website or extension, the part of the product involved, any error code or the message our server gave back, and the account it came from. A report from the extension can also name the CRM you use, the panel you had open, and the LinkedIn® profile address or email address of the person whose panel was open when it failed. We remove access tokens, sign-in codes and similar secrets from a report before it is stored, and we limit how many reports a single visit to a page can send. We use reports only to find and fix faults and keep the service reliable (see Sections 3 and 4), and Section 8 says how long they are kept.

2.4 Data from a Connected LinkedIn® Account (Sales Navigator)

• LinkedIn® Connection: If you choose to connect your LinkedIn® account to use Sales Navigator features (an optional feature on eligible paid plans), our connection provider (Unipile) establishes and maintains an authenticated LinkedIn® session on your behalf. You enter your LinkedIn® credentials directly into the provider's secure interface — we never receive or store your LinkedIn® password. On our servers we store only a non-secret reference to the connected account and its connection status.
• Profile Resolution: When you view a Sales Navigator profile, we use the connected session, at your request, to resolve the profile identifier into the corresponding public LinkedIn® profile (such as the public profile URL and name). That information is then processed through our standard data-enrichment process described above. The connection is used for read access on your behalf only; we do not send messages or take any other action as you.
• Conversation Sync (optional): If you separately enable LinkedIn® conversation sync, the connected session is also used, at your direction, to read your own LinkedIn® messages with contacts you choose so they can be saved to your CRM. Message content is transmitted to your CRM and is not used for any other purpose. You can pause or disable conversation sync at any time, independently of the connection itself.
• Connection List Sync (optional): If you use the Network feature, the connected session is also used, and only when you click to start it, to read the list of your own LinkedIn® connections — each person's name, public profile link, headline, and the date you connected. We store that list against your account so we can show you which of those people are already in your connected CRM without reading LinkedIn® again each time you open the page. The read is paced over several minutes and never runs on a schedule or in the background; afterwards, new connections are added only as they are notified to our connection provider. As with every other use of the connection, this is read access on your behalf: we never send invitations or messages, and take no other action as you. The stored list is deleted when you delete your account (see Section 8).

2.5 Data from Your Connected CRM

• Records You Ask Us to Create or Update: When you add a contact or company to your CRM, or update one, through our Services, we process the record's details as needed to perform that action, including reading the existing record back from your CRM to apply your changes correctly.
• CRM Record Index: Where your plan includes browsing or refreshing the records already in your CRM, we read contact, lead, and company records from your connected CRM through its API and keep a synchronized index of them on our servers. This index holds professional record details such as names, email addresses, job titles, employer links, company details, and which of your CRM's fields hold a value. We deliberately do not copy phone numbers from your CRM into this index — we record only whether a record has one. The index exists so you can filter your own records by what they are missing and refresh them in bulk; each complete re-scan reconciles it against your CRM, including removing records you have deleted there. See Section 8 for how long the index is retained.

2.6 AI Assistants You Connect

You can connect an AI assistant, such as ChatGPT or Claude, to your Add to CRM account so that you can look up contact details, search your CRM and add people to it by asking. This section describes what we collect and what we pass on when you do. Connecting an assistant is optional. If you do not, nothing in this section applies to you.

• Your Approval: When an assistant asks to connect, we show you its name and web address, whether we recognise it, and what it will be able to do, and you choose Allow access or Cancel. If you allow it, we store a record of the connection: which assistant it is (the web address it identified itself by, and the name it gave itself), the permissions you approved, when you connected it and when it last used the connection. We store the sign-in tokens we give the assistant only as one-way hashes, so we cannot read them back. You can see every connected assistant, and disconnect any or all of them, under Connections, AI apps in your dashboard; disconnecting ends its access immediately.
• What the Assistant Can Ask Us For: Once connected, the assistant can ask us, on your behalf, to do what you approved: to look up a person or company; to search for people or companies; to check whether someone is in your CRM; to read, add or update people, companies, notes, calls, meetings and tasks in your CRM; and to read your lists and save people to them. We do each of these exactly as we would if you did it yourself in the extension or the dashboard, with the same data providers, the same credits, and the same field mapping and default tags.
• What We Send Back to the Assistant: The assistant receives the result of what it asked for, and that result can contain: a person's name, job title, professional headline, seniority, department, work email address, personal email address where we have one, phone and mobile numbers where you asked for them, current employer and recent employment history, location, the address of their public professional profile, and the result of checking whether an email address can receive mail; a company's name, website, domain, industry, size, location, founding year, description, main phone line, revenue and funding where known, technologies and the address of its public professional page; for records in your CRM that it reads, each record's name, job title, company, email addresses, tags, profile link and the link to the record, and the person or company details the CRM holds for it; your list names and how many people each holds; and your account's name and email address, your credit balance and the name of your connected CRM.
• Where That Data Goes Next: The assistant is run by another company (for example OpenAI or Anthropic). What it does with a result after we send it is governed by that company's terms and privacy policy and by the settings you have chosen there, not by this policy. In particular, a result shown in an assistant can be used by that company to train its models unless you have turned that off in your account there; for ChatGPT, Codex and Claude we say so on the approval screen and link to how to turn it off.
• A Record of What Was Asked: We keep a log of each request an assistant makes through the connection: which account and connection made it, the name of the tool it used, when, how long it took, whether it succeeded, and how many credits it used. We do not log what the assistant asked for (the person's name or the search it ran) or what we sent back. We also keep a log of each step of connecting and disconnecting an assistant (a connection approved, a token issued or refreshed, a connection revoked), which holds no token or code.
• Limits: To protect you and our data providers we cap how much the assistants connected to your account can do in a day (lookups, searches, additions), and we refuse a request that would exceed your credits.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

• Account Creation & Management: To register and maintain your user account, authenticate logins, and provide customer support.
• Providing Our Services: To enable the functionality of our Chrome extensions and website, including CRM integration and data enrichment via third-party data providers.
• Data Enrichment: When you request contact information, we send identifiers (such as a LinkedIn® profile URL, an email address, or a person's name and company) to third-party data enrichment providers. These providers search their databases and return additional professional information such as verified email addresses, phone numbers, job titles, and company details. This data comes from the enrichment providers' databases, not from LinkedIn®.
• Payment Processing: To facilitate subscription billing through Stripe (though your payment details are handled by Stripe directly).
• Marketing & Communication: To send you marketing emails, product updates, or special offers where we rely on our legitimate interests or as permitted by law (with an option to unsubscribe at any time).
• Analytics & Improvements: To analyze usage of our website and extensions, debug issues, and develop new features.
• Security, Fraud Prevention & Payment Disputes: To keep accounts secure, to detect and prevent fraud and misuse (including limiting how many accounts can be created from one device), and to establish, exercise or defend our position if a payment is disputed or charged back. The sign-in, purchase and session records described in Section 2.3 are used for these purposes and for no other.
• Legal & Regulatory Compliance: To comply with our legal obligations, protect our rights and interests, and address disputes or claims.

4. Legal Bases for Processing (EEA/UK Users)

Under the UK GDPR/GDPR, we process personal data based on the following legal grounds:

• Performance of a Contract: Most data processing is necessary to provide our Services and fulfill our contractual obligations (e.g., creating your account).
• Legitimate Interests: We rely on legitimate interests for certain marketing communications to existing users, for usage analytics, for finding and fixing faults (the error reports described in Section 2.3), for preventing fraud or misuse, and for establishing, exercising or defending legal claims (including payment disputes, for which we use the sign-in, purchase and session records described in Section 2.3). We ensure these interests do not override your privacy rights. You can object to this processing (see Section 12). If you do, we will stop unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend a legal claim: that is why the sign-in, purchase and session records described in Section 2.3 are kept for the period in Section 8 even after you object or delete your account.
• Consent (where required): We may rely on consent for optional cookies or certain email marketing in specific jurisdictions. If you wish to withdraw consent, you can do so at any time by contacting us.
• AI Assistants You Connect: Performance of our contract with you (to do what you ask through the assistant) and your consent (the approval you give on the connection screen, which you can withdraw at any time by disconnecting).
• Processing of Enriched Contact Data: When our users request information about other individuals (e.g., looking up a contact's email address), we process that data on the basis of our users' legitimate interests in business-to-business sales and marketing. We have conducted a balancing assessment and determined that this processing does not override the privacy rights of the data subjects, as the data processed is limited to professional contact information.

5. Disclosure of Your Information

We do not sell or rent your personal data. However, we may share information in the following circumstances:

Service Providers & Sub-Processors:

• Data Enrichment: Apollo.io, SalesQL, Prospeo, Findymail, ContactOut.
• Email Verification: Bouncer, BounceBan.
• Analytics: Fathom (cookieless), PostHog (EU-hosted at eu.i.posthog.com).
• Email/Marketing: MailerLite, MailerSend.
• Payment Processing: Stripe.
• Hosting: DigitalOcean (New York, USA).
• Network Security & Delivery: Cloudflare — a network proxy in front of our website and API, with servers in many countries including the United States. Requests to our website and API pass through Cloudflare, so it can see that traffic, including your IP address, your browser's details and the content of requests and responses, in order to protect the services from attacks and deliver them quickly. It also tells us the IP address and approximate country each request came from.
• Content Management: self-hosted on our own infrastructure (DigitalOcean, New York, USA).
• Authentication: Google (OAuth sign-in).
• LinkedIn® Account Connection (Sales Navigator): Unipile (EU-based) — maintains the authenticated LinkedIn® session on your behalf when you connect your account.
• Affiliate Tracking: Rewardful.
• Code Repository: GitHub (we do not store personal data here except potentially in issue tickets if you submit them).

These providers process data on our behalf under contractual obligations consistent with this Privacy Policy.

AI Assistants You Connect:

The company that runs an assistant you connect (for example OpenAI for ChatGPT or Anthropic for Claude) receives the results described in Section 2.6, because you asked the assistant to look them up. They act as an independent controller of what they receive and are not our sub-processors. Our data-enrichment, email-verification and hosting providers (above) handle a lookup an assistant requests in the same way they handle one you request yourself.

Compliance & Protection: If required by law or in response to valid requests by public authorities (e.g., court orders), or to protect our rights, users, or the public. This includes answering a payment dispute raised with your card issuer: the evidence we submit through Stripe to the card networks and the issuing bank can include the payment and its attempts, the card's brand and last four digits and the checks Stripe recorded when it was saved, the paying account's email address and creation date, counts by day of what the account did in our service (never who it looked up), the emails our system attempted to send about the trial or billing, any cancellation record, the terms as published, and the sign-in, purchase and session records described in Section 2.3 for the account that made the payment.

Business Transfers: If we are involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice if your data becomes subject to a different Privacy Policy.

6. International Data Transfers

We currently store and process data on servers located in the United States (New York) via DigitalOcean. For users located in the UK, EEA, or other regions with data transfer restrictions, this may constitute a cross-border transfer. We rely on Standard Contractual Clauses (SCCs) with our US-based service providers to ensure adequate protection for international data transfers. For providers certified under the EU-US Data Privacy Framework, we rely on that framework as an additional safeguard.

If you would prefer we store your data in the EU or the UK, please contact us to discuss available options. If necessary and feasible, we may migrate our hosting to an EU-based server to further ensure GDPR compliance.

When we answer a payment dispute, the evidence goes through Stripe to the card network and the cardholder's bank, which can be outside the UK and the EEA. We make that transfer because it is necessary to establish, exercise or defend a legal claim (Article 49(1)(e) of the UK GDPR and of the GDPR).

7. Cookies & Tracking

7.1 Cookies We Use

Authentication Cookies: We place cookies to keep you logged in as you navigate our website or Services.

Analytics Cookies/Tools:

Fathom: Typically does not use cookies; it collects aggregated data in a privacy-friendly manner.

Browser Storage (not cookies): Our website also keeps a few small notes in your browser's localStorage: the first-visit note described in Section 2.3; the campaign tag of the page you first read on the site; the click identifier (gclid) if you arrive from a Google advertisement; and PostHog's anonymous session identifier. You can clear all of them through your browser's site-data settings.

7.2 Do Not Track (DNT)

We currently do not respond to "Do Not Track" (DNT) signals. You can still control cookies and trackers via your browser settings or third-party extensions.

8. Data Retention

We retain user account data for as long as the account is active, plus six (6) months. After that period, we will securely delete or anonymize personal data, unless a longer retention is required by law (e.g., for tax or regulatory purposes). Usage logs and backups may persist in our archives for a limited period.

Enrichment data (contact information retrieved from data providers) is cached for up to 30 days to improve performance and reduce redundant lookups. Data provider API response caches are retained for up to 30 days. Operation logs are retained for up to 12 months for debugging and service improvement purposes.

Sign-in, purchase and session records (see Section 2.3) are kept for up to 12 months from the day each one is recorded and are then deleted automatically. They are the exception to the account-data rule above: because they are the evidence we would need to answer a payment dispute raised after an account has gone, they are not deleted when you delete your account, and a request to erase your data does not remove them before that 12 months ends. We keep them on the basis of our legitimate interest in establishing, exercising or defending legal claims, and use them only for the purposes in Section 3.

Error reports (see Section 2.3) are kept for 90 days from the day each one is received and are then deleted automatically.

Records of refused signup attempts (see Section 2.3) are not currently deleted on a schedule: we keep them for as long as they help us recognise repeat abuse, and you can ask us to review the record of your own attempt (see Section 12).

CRM connection credentials are retained for as long as your account is active and your CRM connection is configured. Credentials are permanently deleted when you disconnect your CRM or delete your account.

The record of a connected AI assistant (see Section 2.6) is kept while the connection exists and for 30 days after you disconnect it, then deleted. Sign-in tokens expire after 1 hour (access) and 60 days (refresh; each use issues a new one, so a connection used within two months stays connected), and expired or revoked ones are deleted seven days later. Logs of requests an assistant made (tool names, times, outcomes, credits) are kept for up to 12 months with our other operation logs. Deleting your account revokes and deletes every connection and token.

The CRM record index (see Section 2.5) is retained while the corresponding CRM connection exists on your account, so that reconnecting does not require re-reading your entire CRM. It is deleted when you remove that CRM connection from your account, switch to a different CRM, or delete your account, and it is replaced with a freshly read copy if you reconnect the same CRM under different credentials.

Your LinkedIn® connection list (see Sections 2.1 and 2.4) — whether you uploaded it from your own data export or we read it from your connected LinkedIn® account — is retained while your account is active and is deleted when you delete your account. Disconnecting your LinkedIn® account stops any further reading but does not by itself delete the list already stored, so that reconnecting does not mean reading your connections again; contact us if you would like it removed sooner.

9. Security Measures

We do not hold any formal certifications such as ISO 27001 or SOC 2. However, we take reasonable technical and organizational measures to protect your data, including:

• Using reputable hosting providers (DigitalOcean).
• Restricting access to personal data to authorized personnel.
• Employing safeguards such as SSL/TLS encryption for data in transit.
• CRM credentials (API keys, OAuth tokens) are encrypted using AES-256-GCM authenticated encryption at rest. This provides both confidentiality and integrity protection, meaning credentials cannot be read or tampered with without the encryption key.
• Database connections use SSL/TLS encryption.
• CRM credential access is logged for security auditing purposes.
• OAuth tokens are automatically refreshed server-side to maintain your connection.

While we strive to protect your personal data, no method of electronic storage or transmission is 100% secure. If you suspect any unauthorized access or data breach, please contact us immediately at phil@addtocrm.com.

10. Data Breach Notification

In the event of a data breach that impacts personal data, we will notify the relevant supervisory authority (e.g., the UK Information Commissioner's Office) within 72 hours of becoming aware, where required by applicable law. We will also notify affected individuals if there is a high risk to their rights and freedoms.

11. Children's Privacy

Our Services are not directed at children under 16. You must be at least 18 years of age to use our Services (see our Terms and Conditions). We do not knowingly collect personal information from anyone under 16. If you believe we have unintentionally processed a minor's data, please contact us so we can delete it.

12. Region-Specific Disclosures

12.1 For Users in the EEA and UK

Rights under the GDPR/UK GDPR:

You have the right to request access to, rectification of, or erasure of your personal data. You may also have the right to restrict or object to certain processing, as well as the right to data portability.

To exercise these rights, email phil@addtocrm.com. We will respond within one month (or as required by law).

Complaint: If you have concerns about our data practices, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or another relevant supervisory authority.

12.2 For California Residents (CCPA/CPRA)

No Sale of Personal Information: We do not sell or share personal information for monetary or other valuable consideration.

Your Rights:

• Right to Know: You can request details about the categories and specific pieces of personal data we have collected about you.
• Right to Delete: You can request we delete personal data we have about you, subject to certain exceptions.
• Right to Correct: You can request corrections of inaccurate personal data we hold.
• Right to Non-Discrimination: We will not discriminate against you for exercising these rights.

To exercise any of these rights, please email phil@addtocrm.com. If you believe we are "selling" your data despite our statement, contact us so we can address your concerns.

12.3 For Canadian Residents (PIPEDA)

We strive to comply with the principles of PIPEDA. Canadian users have the right to:

• Access and Correction: Request access to personal data we hold about you, and request corrections if inaccurate.
• Withdraw Consent: Where we rely on consent, you can withdraw it at any time.
• Inquiries or Complaints: Please contact us at phil@addtocrm.com. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada if you believe we have violated PIPEDA.

13. LinkedIn® Usage & User Responsibilities

Our Chrome extensions provide functionality that operates on third-party platforms including LinkedIn®, Gmail, and Outlook. We are not affiliated with, endorsed by, or sponsored by any of these platforms. Your use of our extensions on these platforms is at your own discretion and risk. You are responsible for understanding and complying with the terms of service of any platform you use in conjunction with our Services. We do not assume liability for any account restrictions, suspensions, or other actions taken by these platforms as a result of your use of our Services.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time by posting a new version on our website. Unless otherwise stated, any modifications take effect as soon as they are posted. We encourage you to review this page periodically to stay informed about how we protect your information.

15. Contact Us

If you have questions or comments about this Privacy Policy, or wish to exercise any data subject rights, please reach out to:

Sellframe Ltd. (trading as "Add to CRM")

14 Avonside Grove, Hamilton, UK, ML3 7DL

Email: phil@addtocrm.com