Data usage summary
CRM Health, by [legal entity]. A one-page summary of what the app does with an agency's data. The full details are in our privacy policy and data processing agreement.
What it reads
With six read-only HighLevel permissions: contacts, opportunities and pipelines, users, the sub-account, tags and custom field definitions. It cannot read conversations, messages, payments or calendars, and it never writes to HighLevel.
Why
To score how tidy the CRM data is (stale deals, unowned contacts, duplicates, tag variants and unused fields) and suggest what to clean up. Nothing else.
What it keeps, and for how long
| What | Personal data in it | Kept | Removed by |
|---|---|---|---|
| HighLevel access tokens, encrypted | None, but they give access to the agency's data | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Install records, HighLevel region and white-label domain | None | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Settings and branding, and who last changed them | HighLevel user ids | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Contacts and tag variants marked as intentional | Contact ids, and the user id of who added each one | Until an admin removes it, a complete scan no longer finds the contact, or uninstall | Admin, scan, or uninstall |
| Sign-in sessions | HighLevel user id, role and sub-account list | 30 minutes, then removed by the next daily clean-up | Daily clean-up |
| Rate-limit counters | A keyed hash of the network address, never the address itself | 1 hour, then removed by the next daily clean-up | Daily clean-up |
| Install check cookie, in the browser | None | 10 minutes, during install only | The browser |
| The latest scan's minimised copy, encrypted | Contact and user names, contact and user ids, tags, masked email addresses and phone numbers, keyed hashes of them, opportunity names and stages, pipeline and custom field names, and the sub-account name | Until the next scan, or 7 days, then removed by the next daily clean-up | The next scan, the daily clean-up, or uninstall |
| The agency's hashing key, encrypted | None | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, which makes every leftover hash meaningless |
| Scan records | The HighLevel user id of who asked for the scan | 30 days, then removed by the next daily clean-up | Daily clean-up, or uninstall |
| Score history | The sub-account name; everything else is numbers | 90 days, then removed by the next daily clean-up | Daily clean-up, or uninstall |
| Audit trail | HighLevel user ids, and contact ids for exclusions | 12 months from each event, then removed by the next daily clean-up | Daily clean-up, or a deletion request |
| HighLevel notification ids | None (event type and sub-account id) | 30 days, then removed by the next daily clean-up | Daily clean-up |
| Server logs, at our host | None by design: no names, emails, phone numbers or tokens are logged | The host's log retention for our plan | The host |
| Database backups, at our database provider | Whatever the database held at the time | The provider's backup window | The provider |
What it never keeps
- Full email addresses and phone numbers. Duplicates are found with a keyed fingerprint, and a masked form such as
j•••@example.comis shown. - Contact notes, messages, conversations, payments or custom field values.
- The HighLevel user's name and email from the sign-in.
Where
In the United States, with Vercel for hosting, [database provider] for the database and AWS KMS for encryption keys. No email, analytics, error-tracking or AI providers.
Who can see what
- HighLevel's own roles and permissions decide who in the agency can open the app.
- Users HighLevel limits to their own contacts see scores and counts only, with no names.
- Agency admins can change settings and exclusions.
- No agency can see another agency's data.
What uninstalling deletes
Uninstalling the app from a sub-account deletes that sub-account's tokens, settings, exclusions, sessions, scans and history straight away. Uninstalling it from the agency deletes everything for the agency except the audit trail, which holds ids and counts only and is deleted 12 months after each event. A connection broken for 90 days is treated as an uninstall. Billing, if any, is separate.
Contact
Support: [support email]. Privacy: [privacy email]. Security: [security email].