Privacy

Clientry xRM is made and run by Ai1 Workspaces. This page says what personal information it holds, where it is kept, who handles it on the way, and how to ask about yours. It covers this website, and the xRM at hq.clientryxrm.com together with the client, vendor, crew and lead portals it sends links to.

1. Whose information

   Three groups of people:

   • Visitors to this website, including anyone who registers interest or sends a privacy request.
   • Businesses with a Clientry xRM account, and the people who sign in to them.
   • The people those businesses work with: their clients and leads, performers and crew, venues and suppliers.

   A business keeps the details of the people it works with in its own account, and decides what goes in and why. We hold that information for the business and use it only to run the xRM for it. If you're one of those people, the business you dealt with is the first place to ask, and we'll help it answer.

2. On this website

   • Your name and email when you register interest, and a receipt sent to that email.
   • Your name, email and request when you use the form on this page, and a receipt sent to that email.
   • No cookies, no analytics and no advertising tags. The pages load their typeface from Google Fonts, which sees your connection's address (IP) when it does.

   To stop the forms being used to flood anyone, they count recent tries from each connection and each email, keeping only a scrambled (hashed) form of both.

3. In an account

   • The sign-in email, and the business's profile and settings: its name, contact details, the bank details its invoices show, and how it sets the xRM up.
   • A record of each sign-in: when, the device and browser, and the connection's address (IP).
   • A copy of the account's information in the browser the xRM is used in, so it opens quickly and keeps working on a weak connection.

4. About the people a business works with

   What a business keeps depends on what it records. It can include:

   • Clients and leads: names, email addresses, phone numbers, company, and event details: type, date, times, guest numbers, and the venue and its address, which can be a private home. What they asked for, and their quotes, invoices and payments.
   • Performers and crew: names, contact details, rates and availability. For paying them, an ABN or tax file number, bank and super details. A driver's licence and car registration, insurance documents, emergency substitutes, and any dietary needs or allergies they choose to share so an event can cater for them.
   • Venues and suppliers: addresses, and the contact details of the people there.
   • What passes through the xRM: the emails a business sends from it, in full, its notification texts, portal messages, form answers, and documents uploaded or sent.
   • Acceptances: when a client accepts a quote or the terms in their portal, the xRM records their name, email, the time and the connection's address (IP), and for the terms the device and browser as well. That record is printed on the booking agreement.
   • Email opens: most emails the xRM sends carry a tiny image that tells the business when the email was first opened, and on what kind of device and browser. It records no connection address.

5. How it is used

   To run the xRM for the business that holds the account: its calendar, bookings, quotes, invoices, emails and portals, and the notifications it sends to its own phone and browser. Our part is keeping that working: storing it, sending what the business asks to send, and answering requests like the ones on this page.

   We never sell it or use it for advertising. Apart from what a business shares itself, it goes only to the services below, each for its own part of the work.

6. Where it is kept, and who handles it

   • The database, sign-ins and stored files are in Sydney, Australia.
   • The servers that answer the xRM's requests run in the United States (Virginia), so information passes through them on its way to and from the database. Their logs can include an email address or phone number when a send fails, and are kept for a short time set by the host.
   • Website registrations and privacy requests are kept by the website's host, outside Australia.
   • Email goes out through an email delivery service in the United States, which also reports back when an email bounces or is marked as spam.
   • PDFs are printed by a document-printing service, which may keep a document for up to a day so the same document asked for again comes back faster.
   • Addresses typed into the xRM's address fields and its public forms are looked up with Google's address service, and a booking's venue map is Google's.
   • Notifications to an account's own phone and browser go through Apple's and the browser maker's push services, and carry what the alert says: a name, and sometimes an event date, a venue or an amount.
   • Text messages are off. A business that connects its own text-message account sends its notification texts through it.
   • Backups go only where a business points them: its own Dropbox or Google Drive.

   So personal information is disclosed outside Australia, mainly in the United States, to services that handle it for their part of the work only.

7. Shared calendars and feeds

   A business can make links that let a calendar app read one of its calendars. A link shows each event's type, venue and times, and whether it's confirmed or pencilled. A client's name is on it only where the business has switched names on for that link. It never shows a fee, a contact or a note. Anyone holding a link can read it, and the business can turn it off at any time.

   A business can also give a service it uses a key to read its next 35 days of events: date, type, venue and times, with no client names, fees, contacts or notes.

8. Google Drive and Dropbox

   A business can connect its own Dropbox or Google Drive for automatic backups. The xRM then writes a backup of the whole account to it, weekly and after heavy activity, and reads its own backups back when the business checks or restores one. It keeps every backup from the last 30 days, then the newest of each month. A backup file is not encrypted, so it is as private as the storage it's kept in.

   With Google Drive the xRM asks only to work with the files it creates itself, and for the connected account's email address, to show which Drive is connected. It cannot see any other file. With Dropbox it works only in its own app folder, Apps > Clientry xRM. The connection's sign-in is encrypted before it's stored, and disconnecting in Settings revokes it. The backup files stay in the business's storage until it deletes them.

   Clientry xRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information from a connected Drive is used only to keep, check and restore the business's own backups. It is not sold, not used for advertising, and nobody at Ai1 Workspaces reads it unless the business asks for help with a backup.

9. Keeping it safe

   • Every connection is encrypted, and the database stores everything encrypted.
   • Each account is sealed off from every other by the database's own access rules, and no browser can reach the tables that hold sign-ins, tokens or logs.
   • Client and vendor portals open only with a code emailed to the address on record.
   • Stored files open through links that expire within hours.

10. How long it is kept

    • An account's information is kept while the account is open. A business can clear its records from Settings at any time, and cleared records are removed for good after 90 days. To close an account and have everything deleted, its stored files included, ask with the form below.
    • Sign-in records, email-open records and bounce reports are kept while the account is open.
    • Connection addresses counted to stop abuse are cleared within three days.
    • A registration of interest is kept until you ask for it to be removed. A privacy request is kept as the record of what was asked and how it was answered.

11. Your rights

    You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted, with the form below. We'll answer within 30 days at the email address you give, and may first ask you to confirm the request is yours. If your details are held by a business in its own account, we'll pass your request to it and help it answer.

    If you're not satisfied with the answer, you can complain to the Office of the Australian Information Commissioner.

12. Changes

    When this policy changes, the date at the top changes with it, and the new version applies from that date.