Csmart CRM – Privacy Policy - Csmart CRM

Last updated: 3 November 2026

This Privacy Policy explains how Csmart CRM – the customer relationship management application available at https://app.csmart.pl and as Csmart mobile apps for Android and iOS (the „App”) – collects, uses, stores, shares, protects, retains and deletes personal data, including data received from Google APIs when a user connects a Google account.

1. Who we are

The App is developed and operated by Csmart Sp. z o.o., ul. Dzikiej Gęsi 6/28, 86-031 Osielsko, Poland („Csmart”, „we”, „us”). Contact for all privacy matters: info@csmart.pl.

2. Data we collect

Account data: name, email address, phone number, company name, role, password (stored only as a hash), login history and settings.
CRM data entered by users: clients, contacts, sales opportunities, tasks, notes, documents, files, products and offers. For this data the business customer using the App is the data controller and Csmart processes it only on the customer’s instructions.
Technical data: IP address, device and browser type, server logs – used only for security and to operate the service.
Billing data: company details and payment history for the subscription.
Google user data – only if the user connects a Google account, see section 3.

3. Google user data

A user can connect their own Google account in the App (Settings → Integrations → Google) by signing in with Google and granting consent on Google’s consent screen.

3.1 What Google user data we access

Basic profile (scopes userinfo.email, userinfo.profile): email address and name, to identify which Google account is connected to which App user.
Gmail (scope https://mail.google.com/, accessed via IMAP/SMTP with OAuth 2.0): email messages in the user’s mailbox – headers (sender, recipients, subject, date), message body, attachments, folders/labels and status (read, starred) – and the ability to send, move and delete messages on the user’s behalf.
Google Calendar (scopes calendar, calendar.events): the user’s calendar list and events – title, description, date and time, location, attendees and Google Meet link.

3.2 How we use Google user data

Google user data is used only to provide user-facing features of the App that the user chose to use:

displaying, searching, reading, replying to, forwarding, sending, moving, labelling and deleting the user’s own email inside the App;
sending emails, offers and documents from the user’s own address and showing replies in the client history;
linking emails and calendar events to the user’s clients, contacts and sales opportunities in the CRM, and suggesting such links;
two-way synchronization of meetings and tasks between the App and the calendars the user selected;
AI features started by the user (e.g. summarizing an email or drafting a reply) – the content is processed only to return the result to that user.

We do not use Google user data for any other purpose.

3.3 How we share Google user data

We share Google user data only with service providers that are necessary to provide the features above, and only to the extent needed:

DataSpace P.S.A. (Warsaw, Poland) – data centre hosting our servers; data is stored in the European Union;
AI model providers – only when the user runs an AI feature, and only the content needed to generate the answer: Groq Inc.; and, if the customer enables these integrations, Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) and Perplexity. We use only paid APIs whose terms prohibit using submitted data for model training;
public authorities – only when required by applicable law.

We do not sell Google user data, do not use or transfer it for serving ads (including targeted, personalized, retargeted or interest-based advertising), do not transfer it to data brokers or information resellers, do not use it to determine creditworthiness or for lending purposes, and do not create databases from it for any purpose other than providing the App’s features to that user.

3.4 AI and machine learning

Csmart CRM does not use Google Workspace API data (Gmail, Google Calendar) to develop, improve or train generalized or non-personalized AI and/or ML models, and does not transfer this data to third parties for that purpose.

3.5 Human access

Our staff do not read Google user data, except: (a) with the user’s explicit consent for specific messages (e.g. a support request), (b) when necessary for security purposes such as investigating abuse, or (c) to comply with applicable law.

3.6 How we protect Google user data

all data is transmitted only over encrypted connections (TLS/HTTPS, IMAPS);
OAuth access and refresh tokens are stored only on the server side, encrypted, and are never exposed to the browser or mobile app;
each customer’s data is stored in a separate database and is available only to that customer’s users according to their roles and permissions;
servers are located in the European Union, regularly updated and backed up, and administrative access is limited to authorized personnel;
user passwords are stored only as salted hashes.

3.7 Retention and deletion of Google user data

Email messages and calendar events retrieved from Google are kept in the customer’s App database only while the customer’s account is active and the Google account remains connected, because they form the client communication history in the CRM.
The user can disconnect the Google account at any time in Settings → Integrations. Disconnecting deletes the OAuth tokens immediately and stops any further access to Google data.
Access can also be revoked at any time at https://myaccount.google.com/permissions.
The user can request deletion of all Google user data stored by the App by emailing info@csmart.pl; we delete it within 30 days. When a customer account is closed, all its data, including Google user data, is deleted within 90 days.

3.8 Limited Use

Csmart CRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use other data

We process account, CRM, technical and billing data only to provide the App to the customer: storing and displaying data, performing functions chosen by the user, technical support, billing and security. Legal basis: performance of the contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c)) and our legitimate interest in security (Art. 6(1)(f)).

5. Recipients and international transfers

Besides the providers listed in section 3.3, data may be shared when necessary to perform the contract or legal obligations: IT and hosting providers (under data processing agreements), payment operators, accounting and legal advisers, email and SMS delivery providers used by the App, and public authorities. Data is stored in the EU; if a feature chosen by the customer involves a transfer outside the EEA, it is based on the European Commission’s standard contractual clauses or an adequacy decision.

6. Retention

Account and customer data – for the duration of the contract and up to 90 days after it ends; billing data – for the period required by tax law; server logs – up to 12 months.

7. Your rights

You have the right to access, rectify, delete, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. Send requests to info@csmart.pl. You can also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

8. Changes

We will notify App users before any change in how the App uses Google user data takes effect. The current version of this policy is always available at https://csmart.pl/csmart-crm-privacy-policy/. The general privacy policy of csmart.pl (in Polish) is available at https://csmart.pl/privacy-policy/.

Csmart CRM – Privacy Policy