Privacy Policy | 2crm.kz

1. Who we are

The 2crm.kz service (a CRM for small and medium businesses) and the 2CRM mobile app (the "Service") are provided by ИП Рамазанов А.Х. ("we"). This policy explains what data the Service processes, why, and how you can manage it. By using the Service you agree to this policy.

2. What data we process

Employee (account) data: name, email address, phone number (if provided), password hash (we never store the password itself), interface language, role and permissions in the company, two-factor authentication settings.
Sign in with Apple, Google or Telegram: the account identifier at that service and the email address it shared (Apple may share a private relay address). For Sign in with Apple we also store an encrypted Apple token, only to revoke it when the account is deleted.
CRM data that companies enter: customer contacts (names, phone numbers, email addresses), organizations, leads, deals, tasks, comments, documents and files. This data belongs to the company using the Service: the company decides what to enter and how long to keep it, and we process it on its behalf and only to operate the Service.
Device identifier for push notifications: the push service token, the device name and the platform (iOS or Android). It is needed to send notifications about new leads and tasks.
Technical logs: IP address, time and address of the request, browser or app type, error messages. They are needed for security and troubleshooting.

3. Why we use the data

We do not sell data, do not use it for advertising and do not build advertising profiles from it.

to provide the Service: sign-in, working with leads, deals, tasks and contacts;
to send notifications — in the app, by email and by push;
to protect accounts and prevent abuse: rate limiting, blocking password guessing;
to answer support requests and fix errors.

4. Who the data may be shared with

Data is not shared with third parties except for providers without which the Service cannot work, and only to the extent needed for their function: the hosting provider (servers), the email delivery service, and the push notification delivery services (Expo, Apple, Google — they receive the device token and the notification text), and the OpenAI artificial intelligence service (USA) — only when the user has allowed it in the app or uses the AI assistant, voice task parsing or automatic replies to clients: it receives the request text and the CRM data needed for the answer. Data may also be disclosed at the request of authorized state bodies of the Republic of Kazakhstan in cases provided by law.

5. Where data is stored and how it is protected

Data is stored on servers located in the Republic of Kazakhstan. The connection of the website and the app to the server is encrypted (HTTPS); passwords are stored only as hashes; the sign-in token in the app is kept in the device secure storage; access to data is separated by company, direction and role.

Emails are delivered by an external email service, so the recipient address and the message text pass through its infrastructure, which may be located outside Kazakhstan.

6. How long we keep data

Company and employee data — for as long as the company account is active.
The device token for push notifications — until you sign out of the app on that device, the session is revoked or it expires; tokens that stop working are deleted.
Technical logs — 14 days.
Database backups — 14 days.
After an account is deleted, or at your request, data is removed from the working database within 30 days and from backups when their retention period ends.

7. Your rights and data deletion

You can request access to your data, its correction or deletion, and withdraw your consent to processing. To do so, write to support: support@2crm.kz. Please use the email address of your account so that we can confirm the request comes from its owner.

Data about a company's customers (contacts in the CRM) is corrected and deleted by the company itself. If you are a customer of a company and want your data deleted, contact that company or us — we will pass the request on.

8. Children

The Service is intended for organizations and is not intended for people under 18.

9. Changes to this policy

We may update this policy. The current version is always available at this address; its date is shown at the top of the page.

10. Contact

Operator: ИП Рамазанов А.Х.. For personal data and deletion questions: support@2crm.kz.