Privacy Policy

1. Overview

This Privacy Policy explains how Favourez CRM("we", "us", or "our") collects, uses, stores, and deletes information when you use our CRM at crm.favourez.com and tenant workspaces on *.favourez.com. The product includes WhatsApp, email, leads, meeting scheduling, and social integrations (Facebook, Instagram, LinkedIn, TikTok, and YouTube).

2. Information we collect

Depending on the features you use, we may collect:

• Workspace account data: name, email, role, and login credentials (handled by our auth provider)
• CRM records you create: contacts, leads, pipelines, notes, templates, automations, and campaign content
• WhatsApp and email messages, templates, and delivery metadata needed to run inbox, broadcasts, and flows
• Meeting and booking information, including attendee email, scheduled time, duration, purpose, location, Google Calendar event identifier, and Google Meet link
• Social identifiers (Facebook Page ID, Instagram account ID, LinkedIn person/organization URN, TikTok Open ID, and YouTube channel ID)
• Profile metadata (name, username, profile picture URL)
• OAuth access tokens and refresh tokens (encrypted at rest)
• Content you manage through the CRM: posts, captions, media references, comments, mentions, likes summaries, and direct messages (Facebook Messenger / Instagram)

3. How we use this information

We use this data solely to operate Favourez CRM for your workspace:

• Provide inbox, contacts, pipelines, leads, and reporting
• Send WhatsApp and email messages you compose or automate
• Create and reschedule user-requested booking events and Google Meet links
• Publish and schedule social posts on your behalf
• Display comments, mentions, likes, and DMs in Streams / Conversations
• Reply to comments and messages from the CRM
• Keep connections active (token refresh / verification)

We do not sell your data. We do not use social or messaging data for advertising audiences unrelated to your CRM workspace.

4. Meta (Facebook and Instagram)

When you connect Facebook or Instagram, Meta may share Page and Instagram account IDs, names, profile pictures, Page access tokens, posts you publish through the CRM, comments and engagement on those posts, and (when messaging is enabled) Messenger / Instagram direct messages. We use this only to:

• List Pages and Instagram accounts you admin and save the ones you connect
• Publish photos, videos, Reels, and captions you submit
• Show comments in the CRM inbox and post replies you write
• Receive and reply to DMs when Messenger / Instagram messaging is enabled
• Delete a post on the platform when you delete it in the CRM

You can disconnect in Social → Accounts, or remove the app in Facebook Settings → Apps and Websites. Meta can also call our data deletion callback; check status at /data-deletion-status.

5. LinkedIn

When you connect LinkedIn, LinkedIn may share your member profile (name, email if granted), organization Pages you administer, OAuth tokens, posts you publish, and comments/engagement we sync for those posts. We use this only to:

• Connect your personal profile and Company Pages you admin
• Publish posts you compose in Social → Posts
• Show comments in the CRM inbox where the API allows
• Delete a LinkedIn post when you delete it in the CRM

Disconnect in Social → Accounts, or revoke the app in your LinkedIn settings.

6. Google / YouTube user data

When you connect YouTube, Google may share: YouTube channel ID, channel name, custom URL, thumbnail, country, OAuth access and refresh tokens, video metadata for content you publish through the CRM, comment threads you sync into the inbox, and aggregate view/like/comment counts. We use this data only to:

• Identify and save the channel you authorized
• Upload videos you submit in Social → Posts (title, description, tags, privacy)
• Show comments in the CRM inbox and post replies you write
• Delete a YouTube video when you delete the published post in the CRM
• Refresh tokens so the connection stays working

We do not sell Google user data. We do not use it for advertising or retargeting. We do not use it to train or improve foundation or generalized AI/ML models. Humans do not read your YouTube data except as needed to operate the features you use, to investigate abuse or bugs, or as required by law.

Favourez CRM's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Google Gmail user data

When you choose to connect a personal Gmail account, Google may provide us with your Google email address, OAuth access and refresh tokens, and Gmail data needed for the My Gmail feature. This Gmail data can include message and thread identifiers, sender and recipient addresses, sender names, subjects, message bodies, snippets, dates, labels, read status, and attachment names, types, sizes, and content.

We use Gmail data only to provide features you request:

• Initially import and display Primary Inbox and Sent conversations from the previous 30 days
• Synchronize new, changed, or deleted Gmail messages after the initial import
• Let you search, filter, open, and reply to your Gmail conversations inside the CRM
• Send emails, replies, styled email content, and attachments only when you initiate those actions
• Match email addresses with contacts already stored in your CRM workspace
• Retrieve attachment content from Gmail when you request a download

A connected Gmail mailbox is private to the CRM user who connected it. Other workspace users, including administrators, managers, and agents, cannot view another user's connected Gmail mailbox through the My Gmail feature. Gmail OAuth tokens are encrypted at the application layer before storage. Synced message copies and attachment metadata are stored only as needed to provide the feature.

We do not sell Gmail data, use it for advertising or retargeting, or use it to train or improve generalized or foundation AI/ML models. We do not transfer Gmail data to third parties except to service providers acting on our behalf to host, secure, and operate the CRM, or when required by law. Humans do not read Gmail data except when necessary to provide user-requested support, investigate security or abuse, maintain the service, or comply with law.

You can disconnect Gmail from My Gmail at any time. We attempt to revoke Google access immediately, stop future synchronization, and schedule copied Gmail messages and related metadata for deletion within 30 days, subject to legal retention obligations. You may also revoke access directly from Google Account permissions. Disconnecting the integration does not delete messages from your Gmail account.

Favourez CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Google Calendar user data

When an authorized workspace administrator connects Google Calendar for the Meets feature, Google provides the connected account's email address, OAuth access and refresh credentials, and permission to manage events on the selected calendar. We store the connected email address, calendar identifier, and connection credentials needed to perform the requested Calendar operations.

We use Google Calendar access only to:

• Create a calendar event when a customer booking is confirmed
• Add the meeting title, purpose or description, scheduled start and end time, timezone, attendee email, and location supplied by the booking workflow
• Request a Google Meet conference link for online meetings
• Update the event time when an authorized user reschedules the booking
• Store the resulting Google event identifier and Meet link in the corresponding CRM booking record

The Meets integration does not import, display, or analyze the connected account's unrelated Calendar events. Calendar actions are performed only for booking records created or updated through the CRM. The integration currently creates events without asking Google Calendar to send attendee notification emails; booking details are delivered through the CRM's configured communication workflow.

We do not sell Google Calendar data, use it for advertising or retargeting, or use it to train or improve generalized or foundation AI/ML models. We do not transfer Calendar data except to service providers acting on our behalf to host, secure, and operate the CRM, or when required by law.

You can revoke Calendar access at any time from Google Account permissions. Revocation stops future Calendar API operations but does not delete events already created in Google Calendar. You can request deletion of the stored Calendar connection and related CRM data by contacting us as described below.

Favourez CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. TikTok user data

When you connect TikTok, TikTok may provide your TikTok Open ID, display name, avatar, OAuth access and refresh tokens, granted permissions, creator posting settings, and information about videos available through the permissions you approve. We use this data only to:

• Identify and display the TikTok account you authorize
• Upload or directly publish videos and captions that you choose to submit through Social → Posts
• Apply the audience, interaction, and commercial-content options you select before publishing
• List your TikTok videos and display available video metadata and aggregate engagement counts in the CRM
• Refresh and verify tokens so the connection stays working

We do not sell TikTok user data, use it for unrelated advertising, or publish content without a user-initiated or user-scheduled action. TikTok does not provide this integration with comment text, direct messages, or an API for deleting published TikTok videos.

You can disconnect TikTok in Social → Accounts at any time. This stops future TikTok API use and removes the stored OAuth tokens from the CRM. Disconnecting does not delete videos already published to TikTok; you remain responsible for deleting those in the TikTok app. You can also revoke access in TikTok under Settings and privacy → Security & permissions → Apps and services permissions.

10. Third-party services

Social and messaging features rely on APIs from Meta (Facebook/Instagram/WhatsApp), LinkedIn, TikTok, and Google (Gmail, Calendar, and YouTube). Hosting and database services are provided by our infrastructure providers (including Supabase). Each provider processes data under their own terms and privacy policies.

11. Data retention

Workspace CRM data is retained while your account is active. Social tokens and synced inbox data are retained while the account remains connected. When you disconnect a social account, we mark it inactive, stop syncing, and delete the stored OAuth tokens. When you request deletion (see below), we delete associated platform tokens and related social records we store.

For a disconnected personal Gmail mailbox, Google access is revoked and stored Gmail message copies, threads, and attachment metadata are scheduled for deletion within 30 days. Attachment content fetched for download is not retained as a permanent file by the Gmail integration.

Google Calendar connection credentials and identifiers are retained while the integration is connected and needed to create or update CRM booking events. Revoking access in Google stops future Calendar operations. When you submit a deletion request, we remove the stored Calendar connection credentials and associated CRM Calendar data, subject to legal retention obligations. Events already created in your Google Calendar remain under your control and can be deleted from Google Calendar.

12. How to request data deletion

You can request deletion of social or CRM data by:

• Disconnecting your personal Gmail mailbox from My Gmail, which revokes access and schedules copied Gmail data for deletion within 30 days, or
• Disconnecting the social account from Social → Accounts (this removes stored tokens immediately), or
• Emailing favourezdev@gmail.com with the subject "Data deletion request" and your CRM workspace email / account details, or
• For Gmail, Google Calendar, or YouTube: revoke Favourez CRM at Google Account permissions
• For LinkedIn: remove the app in LinkedIn Settings → Data privacy → Permitted services
• For TikTok: TikTok Settings and privacy → Security & permissions → Apps and services permissions → select Favourez CRM → Remove access
• For Meta (Facebook/Instagram): Facebook Settings → Apps and Websites → remove the app. Meta will call our data deletion callback. Status: data deletion status

We will confirm receipt and complete deletion of associated connection data from our systems, subject to any legal retention obligations.

13. Security

Gmail OAuth tokens and supported social-integration credentials are encrypted at the application layer before storage. Google Calendar credentials are stored in access-controlled application infrastructure, and stored data is protected by our hosting and database providers' encryption-at-rest controls. Access to shared integrations is limited to authorized CRM workspace users. Transport uses HTTPS in production.

Personal Gmail mailbox data is isolated by the connected CRM user and is not made available to other users or administrators in the workspace through the My Gmail feature.

14. Contact

Questions about this policy or your data: favourezdev@gmail.com