Privacy policy
CRM Health, by [legal entity]. Effective [effective date].
This policy explains what the app reads from HighLevel, what it keeps, for how long, and who to ask about it. It is written to match what the app does. If the two ever differ, tell us at [privacy email] and we will fix whichever is wrong.
Who we are, and who decides
CRM Health is an app inside HighLevel (also called GoHighLevel). It reads an agency's HighLevel account and scores how tidy its CRM data is: stale deals, unowned contacts, duplicates, tag variants and unused fields. It only reads. It never changes anything in HighLevel.
- For the contact data in an agency's HighLevel account, the agency decides why and how it is used. In privacy law terms, the agency is the controller and we are its processor (under the CCPA, its service provider). We process that data only to give the agency its scores, under our data processing agreement.
- For our own security records, such as the audit trail and rate-limit counters, we decide, and we are the controller.
The provider of the app is [legal entity], [legal address].
What we read from HighLevel
The agency chooses to install the app. HighLevel then lets us read, with read-only permissions:
- Contacts: name, owner, tags, and email addresses and phone numbers (to find duplicates).
- Opportunities: name, pipeline, stage, owner, status and when the stage last changed.
- Pipelines and their stages.
- Users of the sub-account: id and name, so owners can be named.
- The sub-account: its name.
- Tags and custom field definitions (the field names, not the values people entered).
We do not ask for, and cannot read, conversations, messages, payments, calendars or anything else.
When someone opens the app inside HighLevel, HighLevel tells us who they are. We use only their HighLevel user id, their agency and sub-account ids, their role and which HighLevel region served them. HighLevel also sends their name and email; we do not read or keep those.
What we keep, and for how long
| What | Personal data in it | Kept | Removed by |
|---|---|---|---|
| HighLevel access tokens, encrypted | None, but they give access to the agency's data | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Install records, HighLevel region and white-label domain | None | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Settings and branding, and who last changed them | HighLevel user ids | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Contacts and tag variants marked as intentional | Contact ids, and the user id of who added each one | Until an admin removes it, a complete scan no longer finds the contact, or uninstall | Admin, scan, or uninstall |
| Sign-in sessions | HighLevel user id, role and sub-account list | 30 minutes, then removed by the next daily clean-up | Daily clean-up |
| Rate-limit counters | A keyed hash of the network address, never the address itself | 1 hour, then removed by the next daily clean-up | Daily clean-up |
| Install check cookie, in the browser | None | 10 minutes, during install only | The browser |
| The latest scan's minimised copy, encrypted | Contact and user names, contact and user ids, tags, masked email addresses and phone numbers, keyed hashes of them, opportunity names and stages, pipeline and custom field names, and the sub-account name | Until the next scan, or 7 days, then removed by the next daily clean-up | The next scan, the daily clean-up, or uninstall |
| The agency's hashing key, encrypted | None | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, which makes every leftover hash meaningless |
| Scan records | The HighLevel user id of who asked for the scan | 30 days, then removed by the next daily clean-up | Daily clean-up, or uninstall |
| Score history | The sub-account name; everything else is numbers | 90 days, then removed by the next daily clean-up | Daily clean-up, or uninstall |
| Audit trail | HighLevel user ids, and contact ids for exclusions | 12 months from each event, then removed by the next daily clean-up | Daily clean-up, or a deletion request |
| HighLevel notification ids | None (event type and sub-account id) | 30 days, then removed by the next daily clean-up | Daily clean-up |
| Server logs, at our host | None by design: no names, emails, phone numbers or tokens are logged | The host's log retention for our plan | The host |
| Database backups, at our database provider | Whatever the database held at the time | The provider's backup window | The provider |
Never kept, in any form: full email addresses and phone numbers, contact notes, messages, conversations, payments or custom field values, and the HighLevel user's name and email from the sign-in. Email addresses and phone numbers are turned into a keyed fingerprint, so duplicates still match, and a masked form for display such as j•••@example.com. Each agency has its own key, and uninstalling deletes it, which makes every leftover fingerprint meaningless.
Expired data is hidden from the app as soon as its time is up, even before the daily clean-up deletes it.
What we never do
- Sell or share personal data, or use it for advertising.
- Write to, change or delete anything in HighLevel.
- Send data to AI model providers, or use it to train any model.
- Combine an agency's data with any other agency's data, or with data from anywhere else.
Who can see what
- Inside an agency, HighLevel's own permissions decide. People HighLevel limits to their own contacts see scores and counts only, with no names.
- Other agencies can never see an agency's data. The database itself keeps each agency apart.
- Our staff have no way into an agency's data through the app. Only the few people who run the service can reach the database, where tokens and scan copies stay encrypted. Every deletion we carry out on request is recorded in that agency's audit trail.
Where it is kept
In the United States, whatever HighLevel region an agency uses. Our hosting is Vercel, our database is [database provider] in [database region], and our encryption keys are held in Amazon Web Services' key service (AWS KMS). The full list is on our subprocessors page.
For agencies in the European Economic Area, the United Kingdom or Switzerland, transfers to the United States are covered by the Standard Contractual Clauses in our data processing agreement.
How it is protected
- Connections use HTTPS only.
- HighLevel access tokens and scan copies are encrypted, with keys held in AWS KMS.
- Each agency's data is kept apart by the database, not only by the app.
- Logs never contain names, email addresses, phone numbers or tokens.
- The app sets no tracking cookies and loads nothing from other websites.
Cookies
One cookie, only while an agency installs the app, for up to 10 minutes. It protects the install from being hijacked. There are no analytics, advertising or tracking cookies.
Deletion
- Uninstalling deletes. Uninstalling the app from a sub-account deletes that sub-account's data straight away. Uninstalling it from the agency deletes everything for the agency, except the audit trail, which holds no names, email addresses or phone numbers and is deleted 12 months after each event.
- Broken connections. If an agency's HighLevel connection stays broken for 90 days, we delete its data as if it had uninstalled.
- On request. An agency can ask us to delete its data, including the audit trail, at [privacy email]. We confirm the request comes from the agency, then complete it within 30 days, and usually within 7.
- Backups. Deleted data can remain in our database provider's encrypted backups for up to [backup window], and is then gone.
Your rights
If you are a contact in an agency's CRM, the agency decides about your data. Please ask the agency. If you ask us, we will pass your request to the agency within 5 working days and help it respond. Once the agency deletes you in HighLevel and runs a new scan, nothing about you is left with us.
If you are a HighLevel user at an agency, we hold your HighLevel user id and, in the latest scan copy for 7 days at most, your name as an owner of contacts or deals. Ask your agency, or us at [privacy email]; with the agency's confirmation, we replace your id with "erased" everywhere we hold it and delete the agency's scan copies.
Depending on where you live, you may have rights under laws such as the GDPR, the UK GDPR or the California Consumer Privacy Act (CCPA), including rights to access, correct and delete your data and to complain to a regulator. We will not treat you differently for using them.
Children
The app is for businesses. It is not meant for children, and we do not knowingly process children's data for ourselves.
Changes
If we change this policy, we will update the date at the top. Changes that matter are posted here at least 30 days before they take effect.
Contact
Privacy questions and requests: [privacy email]. Security reports: [security email]. Support: [support email].