Legal
Privacy policy
How the Clientra CRM mobile app, and the Clientra CRM software that organisations run on their own servers, handle personal data.
The short version
- The app talks only to your organisation’s own CRM installation. Clientra has no central database of your organisation’s data.
- Your organisation decides what is stored on its server and for how long, and is responsible for that data.
- No advertising, no analytics, no tracking. We never sell personal data.
- Face ID and Touch ID are checked by your phone. The app never sees your face or fingerprint data.
- Notifications pass through Apple (on iPhone) or Google (on Android) only to reach your phone. Clientra does not route, read or keep them.
- To see, correct or delete your data, contact your organisation’s administrator.
01Who is responsible for your data
“Clientra”, “we” and “us” mean the provider of the Clientra CRM software and of the Clientra CRM app (“the app”). Your “organisation” is the company that runs the Clientra CRM you sign in to and that gave you your account, usually your employer.
- Your organisation is responsible for the data in its CRM (the controller, in data-protection terms). It installs and runs the CRM on a server of its choice, creates the user accounts, sets what each person may see, and decides what is recorded about its staff and its clients and for how long. Its own privacy notice applies to that data.
- Clientra provides the software and a few services that help it work: licence and update checks, and technical support (section 11). When we handle personal data for these services, we do so on behalf of your organisation and only for that purpose.
- If Clientra hosts your organisation’s CRM (some organisations ask us to), we run that server for your organisation as its service provider. Your organisation still decides what is kept and who can see it.
- If you are a client of an organisation that uses Clientra (for example, you enquired about a property), your details are in that organisation’s CRM. Please contact that organisation.
02Information the app handles
- Signing in
- The address of your organisation’s CRM, your username and your password. The password is sent over an encrypted connection to your organisation’s server to sign you in, and the app never stores it. The server returns a sign-in token, which the app keeps in the iPhone Keychain (on Android, encrypted with a key held in the Android Keystore).
- This device
- A random device identifier created by the app, the phone’s model name (for example “iPhone 16 Pro”), its platform and the app version. Your organisation’s server uses them to list the devices signed in to your account, so that you can sign them out. The app does not use the advertising identifier.
- Your work in the CRM
- What you view, create or change: leads, contacts, owners, properties, units, projects, deals, tasks, appointments, notes and call logs; WhatsApp, email and team chat messages; documents and photos you attach; and your profile (name, email, phone, photo). It can include details your organisation records about its clients, such as nationality, date of birth or identity-document numbers.
- Notifications
- If you allow notifications, a push token from Apple (from Google on Android), so that your organisation’s server can send notifications to this phone.
- Camera and photos
- Used only when you choose to take a photo or attach a picture or file. The app does not browse your photo library by itself.
- Face ID, Touch ID, passcode
- If you turn on the app lock, your phone checks it is you and tells the app only whether the check succeeded. Biometric data never leaves your device, and the app never has access to it.
The app does not collect your location, does not read your phone’s contacts, does not record audio, and does not track you across other companies’ apps or websites.
03Where the app sends information
Your organisation’s CRM server, and nowhere else
Everything in section 2 goes only to the CRM server you connected to (or, in an app built for one organisation, that organisation’s server), over HTTPS. As part of its normal operation, your organisation’s CRM records sign-ins, devices, when you were last active, and a history of the changes made.
Notifications
On iPhone, your organisation’s CRM server sends each notification (a title, a short text and a reference to the record) directly to the Apple Push Notification service, which delivers it to your phone. Clientra does not route, read or keep notifications. Your organisation’s server keeps the device token it needs to reach your phone until you sign out or the device is removed.
On Android, notifications are delivered through Google’s Firebase Cloud Messaging where it is available. Otherwise the app checks your organisation’s server itself.
Things you choose to open
When you call, text, email or WhatsApp someone, open a map, or open a web link stored in a record, the phone hands that action to the app or website concerned, which handles it under its own terms and privacy policy. Pictures and files in your organisation’s records may load from wherever your organisation stores them.
Nothing else
The app contains no analytics, advertising or tracking software. We do not sell personal data, and we do not share it for advertising.
Your organisation can connect its own CRM to other services (for example a WhatsApp Business account, an email provider, advertising platforms or property portals). Those connections run from your organisation’s server under its own decisions and its own privacy notice, not from the app.
04What the app keeps on your phone
- Sign-in token
- One for each server, in the Keychain. It is tied to this device and is never restored onto another phone from a backup. It is removed when you sign out. If you delete and reinstall the app, any old token left in the Keychain is deleted at the first launch.
- Device identifier
- The random identifier from section 2, in the Keychain. It survives a reinstall, so that a reinstalled app counts as the same device.
- Offline copy
- Lists and records you opened recently, and your recent searches, stored in the app’s private storage so that they can be read with a weak signal. Wiped when you sign out or change server. Entries not refreshed for 30 days are deleted. You can clear it at any time in App Settings → Clear offline data.
- Images
- A temporary cache of pictures you have viewed, which iOS can clear at any time.
- Preferences
- The server address and its name, logo and colours; your language and appearance; whether the app lock is on.
- Changes waiting to be sent
- A few kinds of work recorded while offline (for example cold-call results) wait on the phone and are sent when you are back online. When you sign out, the app tries to send them first, then deletes them.
Deleting the app removes its data from the phone, except for items iOS keeps in the Keychain, as described above.
05The demo
“Explore the Demo” runs entirely on your phone with fictional sample data. Nothing you do in the demo is sent to any server, and the sample data is discarded when you leave the demo.
06How long information is kept
- On your organisation’s server: as long as your organisation decides. Sign-in tokens expire after 90 days without use. A token ends at once when you sign out, when you sign that device out from Signed-in Devices, or when your administrator deactivates your account.
- On your phone: as described in section 4.
07Security
- The app connects to CRM servers over HTTPS. The only exception is a server running on the device itself, which is used during development.
- The phone keeps a sign-in token, never your password. The server stores only a fingerprint (hash) of each token.
- An optional app lock with Face ID, Touch ID or your passcode is asked at launch and after five minutes away.
- In Signed-in Devices you can sign out a lost phone. Your administrator can deactivate an account, which ends all its sign-ins.
- No system is perfectly secure. Your organisation is responsible for securing the server it runs.
08Your rights and choices
- Access, correction, deletion, a copy of your data, or objection: your organisation controls the data, so please contact your organisation’s administrator. Depending on where you are, data-protection laws (such as the UAE Personal Data Protection Law or the GDPR) may give you these rights, and your organisation answers such requests. If you write to us, we will pass your request to the organisation concerned and help it respond.
- Deleting your account: accounts are created and deleted by your organisation’s administrator, in the CRM or in the app. Ask them to delete yours.
- In the app you can change your photo, email address and password (My Profile); choose which notifications you receive (Notification preferences) or turn them off in your phone’s settings; sign out; sign out your other devices; clear the offline copy; or delete the app.
09Children
The app is a business tool for the staff of organisations. It is not intended for children, and we do not knowingly collect personal data from children.
10International transfers
Your organisation chooses where its CRM server is located: on its own hosting or, if it asks, on hosting run by Clientra. Apple and Google run their notification services worldwide. Clientra’s licensing and update services run on servers that we operate or rent. Any of these may be in a different country from you. Where the law requires it, the transfer is protected as that law requires.
11Clientra’s own services
- Licence and update checks: the CRM server periodically sends Clientra its licence key, web address, software version and PHP version (licence check), and its web address and software version (update check). These identify the installation, not its users or its clients.
- Technical support: Clientra staff may sign in to an organisation’s CRM to provide support, maintenance or updates for that organisation. Every such sign-in is recorded in an audit log. We use what we see only to provide that support.
- Notifications: Apple Push Notification service (iPhone) and Google Firebase Cloud Messaging (Android), as described in section 3.
12Changes to this policy
We will publish any change on this page and update the effective date at the top. For significant changes we will also make reasonable efforts to inform the organisations that use Clientra.
13Contact
Questions about this policy: sales@clientracrm.com. For data held in your organisation’s CRM, please contact your organisation first, because it controls that data.
Back to top ↑