Privacy Policy

This Privacy Policy describes how Global Leaf Group ("we", "us", "our") collects, uses, stores, and protects information when you use the Global Leaf Group CRM web application at globalleafcrm.com (the "Service"). This page is maintained by Global Leaf Group and describes the practices of the Service; it is not an independent audit or certification.

1. Who we are

Global Leaf Group operates a CRM for biotech, pharma, and regulated cannabis teams. If you have questions about this policy or your data, contact us at privacy@globalleafcrm.com.

2. Information we collect

Account information

Name, email address, password hash, role, and organization you belong to.

CRM content you create

Contacts, companies, deals, projects, tasks, meetings, notes, files, and invoices you add to the Service.

Connected accounts (Google, Microsoft)

When you connect Gmail, Google Calendar, Outlook Mail, or Outlook Calendar, we store the OAuth refresh and access tokens required to call those APIs on your behalf, along with the email address of the connected mailbox.

Technical data

IP address, browser type, and basic request logs for security and diagnostics.

3. Google user data — Limited Use disclosure

Global Leaf Group CRM's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google account, the Service may access:

• Gmail messages, metadata, and the ability to send email on your behalf — so you can read, reply, and send email from inside the CRM and attach emails to contacts and deals.
• Google Calendar events — so meetings created in the CRM sync to your calendar and calendar events appear in the CRM.
• Your Google profile (name, email) — to identify the connected account.

We use Google user data only to provide the CRM features listed above. We do not:

• Sell Google user data.
• Transfer Google user data to third parties except as required to provide the Service, comply with law, or as part of a merger, acquisition, or sale of assets with notice to you.
• Use Google user data for serving advertisements.
• Allow humans to read Google user data, except (a) with your explicit consent, (b) for security reasons such as investigating abuse, (c) to comply with law, or (d) where the data has been aggregated and anonymized.
• Use Google user data to train generalized or non-personalized AI or machine-learning models.

You can revoke the Service's access at any time from myaccount.google.com/permissions or from the Connections page inside the app.

4. How we use information

• Provide, maintain, and improve the Service.
• Authenticate you and secure your account.
• Sync email and calendar data between the CRM and connected providers.
• Send transactional email (password resets, notifications you opt into).
• Detect, investigate, and prevent fraud, abuse, and security incidents.

5. Storage and security

Data is stored in managed PostgreSQL and object storage on infrastructure provided by Supabase and Cloudflare. Data is encrypted in transit (TLS 1.2+) and at rest. Access to your data inside the app is enforced by row-level security policies scoped to your user account and organization. OAuth tokens are stored server-side and never exposed to the browser.

6. Subprocessors

• Supabase — database, authentication, storage.
• Cloudflare — hosting and edge delivery.
• Google LLC — when you connect Gmail or Google Calendar.
• Microsoft Corporation — when you connect Outlook Mail or Outlook Calendar.
• Lovable — application hosting platform.

7. Data retention and deletion

We retain your data for as long as your account is active. You can delete CRM records at any time from within the app. You can disconnect a Google or Microsoft account from the Connections page, which immediately removes the stored OAuth tokens. To delete your account and all associated data, email privacy@globalleafcrm.com and we will complete the deletion within 30 days.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact privacy@globalleafcrm.com to exercise these rights.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date at the top always reflects the current version.

11. Contact

Global Leaf Group — privacy@globalleafcrm.com