Privacy Policy

This policy covers the JovarisCRM service and its sales, HR, payroll, inventory, recruitment and vendor features. The information processed depends on the modules your organization enables and the information it supplies.

Your organization administers its workspace and determines the purposes for which employee, customer and other business records are processed. JovarisCRM processes those records to provide the service. Contact your organization about its own employment, customer and recordkeeping policies; these may apply in addition to this policy.

• Account and organization information: names, work email addresses, account identifiers, password hashes, roles, permissions, branch assignments and workspace details.
• Business records: lead and customer contact details, communications entered into the CRM, tasks, deals, quotations, invoices, payment references, vendor details and inventory transactions.
• Workforce records, where enabled: employment details, attendance, work sessions, leave, salary, payroll, bank and tax information, candidate profiles and recruitment records.
• Files and photos that authorized users upload, including business attachments, employee identity documents and payroll documents.
• Connected social account identifiers, profile details, granted permissions, access tokens, and data imported through enabled integrations, as described below.
• Operational information such as IP addresses, browser or user-agent details, request identifiers, timestamps, errors and audit records of actions in the service.

Information is used to authenticate users, apply permissions, operate your workspace, process business workflows, synchronize authorized integrations, respond to support requests, investigate errors, prevent abuse and maintain audit records.

Your organization is responsible for having an appropriate legal basis for information it adds to the service, including required notices and consent. Where applicable, processing may be necessary to provide a contracted service, meet legal obligations, protect legitimate business and security interests, or carry out a feature you have authorized. You may withdraw optional social authorization.

A workspace administrator chooses whether to connect a social account. Authorization occurs on the provider’s own website. JovarisCRM receives authorization tokens and permitted account data; it does not receive the password entered on that website.

• Facebook and Instagram: Page and linked professional-account identifiers and names, approved permissions, Facebook Lead Ads responses, and supported comments, including author identifiers or names, text, timestamps, post identifiers and links. Provider event payloads may also be retained for processing and troubleshooting.
• WhatsApp Business: authorized business-account identifiers and names and available business phone-number details used to identify the connection. Connecting an account does not by itself enable a messaging inbox or import personal chats.
• LinkedIn: the authorized member identifier, name and profile or email information returned by the approved sign-in permissions.
• Pinterest: the authorized account identity and username returned by the approved account-read permission.

Social data is used for the connected workspace’s requested functions. Connection status does not mean every provider feature is supported. Disconnecting stops future use of the stored connection and removes its stored tokens; previously imported CRM records remain until separately deleted. See data deletion instructions. Providers also process information under their own privacy policies.

Authorized workspace members can access records according to their roles and assigned scope. Workspace administrators manage access. Service providers supporting hosting, databases, file storage and payment processing may process information needed to perform those services. Connected platforms receive requests necessary for features you authorize.

Information may also be disclosed when required by law, to respond to valid legal requests, or to investigate abuse and protect users and the service. If the service changes ownership, personal information may be transferred as part of that transaction subject to applicable law and notice requirements.

JovarisCRM uses access controls, workspace scoping, password hashing, encrypted stored social tokens and restricted file access to protect information. No system can guarantee absolute security. Keep your credentials private and report suspected unauthorized access promptly.

Information is processed on the infrastructure used for your deployment. Hosting and connected service providers may process it in countries different from your own. Applicable contracts and legal safeguards govern those transfers where required; contact us for details about your deployment.

Retention depends on the record’s purpose, your organization’s instructions, applicable employment, tax and accounting obligations, and security or dispute-resolution needs. Business records are not automatically deleted when a user signs out, loses access or disconnects a social account.

Deletion requests are reviewed to identify the records involved and any required retention. Some accounting, employment, security or legal records may need to be retained; backup copies may remain until their normal replacement cycle. Ask the contact below for the retention period and deletion status applicable to your request. See how to request account and data deletion.

The web service uses session cookies to keep you signed in and browser storage for interface preferences such as theme and navigation. Blocking necessary cookies may prevent sign-in from working. Signing out clears this browser’s authentication cookies.

Files are supplied through upload actions. This policy does not describe background access to a device’s personal contacts, photos, microphone or location. Any additional device feature must be explained and request the relevant permission when introduced.

Depending on your location and applicable law, you may request access, correction, deletion, restriction, portability or objection to processing, withdraw consent where processing relies on it, or complain to your local data protection authority.

For records managed by your employer or another organization, contact that organization first so it can identify the correct workspace. You may also contact us below. We may need to verify your identity and authority over the requested records before taking action. Do not send passwords or complete identity or bank documents in an initial request.

JovarisCRM is a business service and is not directed to children. If you believe a child’s information was supplied without appropriate authority, contact us to request review.

We may update this policy when the service or its data practices change. The date above identifies the latest version. Material changes will be communicated as required by applicable law.