Privacy Policy
Last updated: September 26, 2026
AuraCRM, provided and operated by יפרח שי - העצמה הגשמה תוצאות בע״מ (the "Company," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, mobile applications, and related services (collectively, the "Service").
By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Information You Provide
| Data Type | Purpose |
|---|
| Name, email, phone | Account creation and profile management |
| Password | Authentication (stored as a secure hash — we never store plaintext passwords) |
| Profile photo / avatar | User identification within your Organization |
| Organization details (name, logo, address, industry) | Workspace setup and branding |
| Lead and contact data (names, emails, phones, companies, notes) | CRM functionality — managed by you |
| Tasks, transactions | Business workflow management |
| Comments, activity notes | Team collaboration and audit trail |
| Custom fields | Organization-specific data you define |
| Channel OAuth tokens (access and refresh) | Maintaining authenticated channel connections — stored encrypted, never in plaintext |
| Conversation messages (inbound and outbound) | CRM inbox and messaging history — managed by you |
| Passkey / WebAuthn credentials | Passwordless authentication — only your public key is stored; your private key never leaves your device |
1.2 Information Collected Automatically
| Data Type | Purpose |
|---|
| Device information (model, OS version, app version) | Push notification delivery and compatibility |
| Device fingerprint (hashed) | Account security and trusted-device verification |
| Push notification tokens (FCM/APNs) | Delivering push notifications to your devices |
| Usage patterns (features accessed, timestamps) | Service improvement and troubleshooting |
1.3 Information We Do NOT Collect
- We do not collect payment card or bank account information — no payment processing occurs through the Service.
- We do not track your precise geolocation.
- We do not sell or rent your personal information to third parties.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service.
- Authenticate your identity and secure your Account.
- Send transactional communications (verification codes, security alerts, account notifications).
- Deliver push notifications, email notifications, and in-app alerts based on your preferences.
- Process webhook deliveries to third-party URLs you configure.
- Enable team collaboration within your Organization.
- Maintain an audit trail of activities for accountability and compliance.
- Improve, personalize, and optimize the Service.
- Respond to your requests, comments, or questions.
- Comply with legal obligations.
3. How We Share Your Information
We do not sell your personal information. We may share information in the following limited circumstances:
- Within your Organization: Team members with appropriate roles and permissions can view Organization data (leads, tasks, contacts, etc.) as configured by Organization administrators.
- Webhooks: When you configure webhooks, event data is transmitted to the third-party URLs you specify. You are responsible for the security and privacy practices of those endpoints.
- Service Providers: We use trusted third-party services to operate the Service:
- Firebase Cloud Messaging (Google) — push notification delivery
- SMTP email providers — transactional email delivery
- Cloud hosting and database providers — infrastructure and data storage
These providers process data on our behalf and are bound by contractual obligations to protect your information.
- Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of AuraCRM, our users, or the public.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.
4. Data Security
We implement industry-standard security measures to protect your information:
- Passwords are hashed using bcrypt — we never store or have access to your plaintext password.
- OTP verification codes are hashed and time-limited.
- API keys and webhook secrets are treated as sensitive credentials.
- Device fingerprints are stored as irreversible SHA-256 hashes.
- All data transmission is encrypted via TLS/HTTPS.
- Access to production systems is restricted to authorized personnel.
While we take reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
5. Data Retention
- We retain your Account data for as long as your Account is active or as needed to provide the Service.
- When you delete your Account, we will delete or anonymize your personal data within a reasonable timeframe, except where we are required to retain it by law.
- Audit trail and activity logs may be retained for compliance purposes even after Account deletion.
- Organization data (leads, tasks, etc.) is retained as long as the Organization exists. Organization owners are responsible for managing this data.
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete personal data.
- Deletion: Request deletion of your personal data, subject to legal retention requirements.
- Portability: Request a machine-readable copy of your data.
- Objection: Object to certain processing of your personal data.
- Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at support@aura-crm.net. We will respond within 30 days.
7. Notification Preferences
You can control your notification preferences directly within the Service:
- Push notifications: Toggle individual event types on or off, or disable push notifications entirely.
- Email notifications: Control which events trigger email alerts, and opt in or out of digest emails and weekly reports.
- Quiet hours: Set time windows during which non-urgent notifications are suppressed.
Security-related communications (e.g., login alerts, password resets) cannot be disabled.
8. Children's Privacy
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will promptly delete it.
9. International Data Transfers
Your information may be processed and stored on servers located outside your country of residence. By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your own. We take appropriate safeguards to ensure your data remains protected.
10. Third-Party Links
The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the Service or by email. The "Last updated" date at the top indicates when the policy was last revised. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Channel Integrations and Third-Party Platforms
When you connect social or messaging channels (WhatsApp, Facebook, Instagram, TikTok) to your Organization:
- OAuth Tokens: We store OAuth access and refresh tokens issued by Meta and TikTok, encrypted at rest, to maintain your channel connections. We do not store these in plaintext. You can revoke access at any time from your Organization settings.
- Message Content: Inbound and outbound messages, conversation threads, and associated metadata are stored within AuraCRM so you can view and manage communications. This data is tied to your Organization and the leads or contacts involved.
- Third-Party Data Processing: When you send or receive messages through connected channels, those communications are also processed by Meta (for WhatsApp, Facebook, Instagram) or TikTok under their own privacy policies. We encourage you to review those policies to understand their data practices.
- Webhook Logs: Incoming channel events (e.g., new messages, delivery status updates) are logged for audit and troubleshooting.
- Deleting Meta data: instructions for deleting data received from WhatsApp, Facebook and Instagram are on our User Data Deletion page.
TikTok data
When you connect TikTok, we receive your TikTok account's open ID, display name and avatar. If you choose to import your TikTok Direct Messages (TikTok Data Portability API), we receive a copy of your own chat history: the date, the sender and the text of each message. We request it only after you start the import, and again once a day only while "Keep TikTok messages in sync" is on.
- Purpose: this data is used only to show your TikTok conversations in your Organization's inbox and link them to your leads. It is never sold, shared with third parties, used for advertising, or used to train AI models.
- Stopping: turning off sync, disconnecting TikTok in Settings > Integrations, or removing AuraCRM from your TikTok account settings stops all future requests immediately.
- Deleting your TikTok data: you can delete the imported TikTok messages from Settings > Integrations > TikTok, or request deletion of all TikTok data we hold for you by emailing support@aura-crm.net with the subject "Delete my TikTok data". We delete it within 30 days and confirm by email. Deleting your Account or Organization also deletes this data.
13. AI-Powered Features and Automated Processing
AuraCRM uses automated processing and AI assistance to help manage leads, conversations, and workflows:
- Automations: Automation rules process lead data, task data, and channel message data to trigger configured actions. This processing occurs entirely within AuraCRM's infrastructure.
- AI Agent: The AI agent analyzes conversation content and lead data to suggest or take actions on your behalf based on the safety mode you configure. All AI agent decisions are logged in an audit trail for review and accountability.
- Search Indexing: Lead, contact, and organizational data may be indexed via a search service (Elasticsearch) to provide fast full-text search within the Service. Indexed data is stored within our infrastructure and is not shared with third parties.
- No Training on Your Data: We do not use your Customer Data (lead records, messages, contact details) to train AI models for general use or to benefit other customers.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: