Privacy Policy

White Cat Black Dog, LLC ("Company," "we," "us," or "our") operates Jindo CRM, a customer relationship management platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information in connection with your access to and use of the Service, our website (jindocrm.com), and related communications.

Please read this Privacy Policy carefully. It describes our current practices and your choices. Using the Service does not by itself constitute consent to optional tracking or other processing that requires your consent under applicable law.

This Privacy Policy is incorporated into and made a part of our Terms of Service, available at jindocrm.com/terms.

1. Information We Collect

We collect personal information in several ways:

1.1 Information You Provide Directly

• Account Registration: When you register with email and password, we collect your name, email address, password, and workspace name. Passwords are stored as hashes, not as readable passwords. If you sign in with Google, we receive account information such as your name, email address, profile image, and authentication identifiers and tokens. We also store workspace memberships, roles, and your default workspace selection.
• Early Access Requests: If you submit an early access form on our website, we store your email address, the form location, submission dates, and the number of submissions so we can manage your request.
• Subscription and Payment Information: Stripe collects payment and billing details through its hosted checkout and billing portal. We store subscription and plan information and Stripe customer, subscription, and price identifiers, and retrieve billing history from Stripe when you view it. We do not directly collect or store full credit card numbers.
• Client Data: You may upload, store, or transmit business data through the Service, including customer names, contact information, communication history, deal data, and related business records. This data is collected at your direction and stored as part of your account.
• Communications and Invitations: When you contact us by email, we receive the content and any personal information you include. When a workspace administrator invites someone to the Service, we store the recipient's email address, workspace, assigned role, and invitation status and expiry, and use that information to create and manage an invitation link that the administrator shares manually.
• Feedback: Any suggestions, bug reports, ideas, or comments you submit about the Service.

1.2 Information Collected Automatically

• Page-View Data: When Vercel Web Analytics is enabled, it collects information about pages visited, referring websites, visit times, and device and browser characteristics to provide traffic statistics. Page URLs may include workspace names or record identifiers. See Section 6.3 for details.
• Device and Browser Information: Technical information such as device type, operating system, browser type and version, and IP address may be processed by our hosting and monitoring providers when serving requests and diagnosing problems. We do not use advertising identifiers to track you across websites.
• Log and Diagnostic Data: Server logs and, when enabled, Sentry error and performance reports may include request URLs, timestamps, error messages, stack traces, navigation or interaction breadcrumbs, and request timing information. These records may contain information included in URLs, requests, or error messages.
• Cookies: We use cookies to maintain your login session, protect sign-in requests, remember the return destination during sign-in, temporarily preserve contact form or invitation information across redirects, and remember your privacy choices. We do not use analytics or advertising cookies in the current app. See Section 6 for purposes and durations.

1.3 Information from Third Parties

We may receive personal information about you from third-party sources, such as:

• Payment processors who provide transaction and billing data;
• Authentication providers who verify your identity;
• Service providers who assist us in operating the Service;
• Business partners with whom you integrate third-party applications.

2. How We Use Information

We use the personal information we collect for the following purposes:

2.1 Service Delivery and Operations

• Providing, maintaining, and improving the Service;
• Processing account creation, registration, and subscription management;
• Delivering customer support and responding to your inquiries;
• Troubleshooting and diagnosing technical issues;
• Enforcing our Terms of Service and other agreements;
• Protecting against fraud, unauthorized access, and other illegal activity.

2.2 Communications

• Sending workspace invitation emails and communications about your account or billing;
• Sending service-related announcements and product updates;
• Responding to your requests and customer support inquiries;
• Managing early access requests and related communications; sending promotional emails only if you have opted in. You may ask us to stop promotional messages at any time.

2.3 Analytics and Improvement

• Analyzing usage trends to improve the Service's features and performance;
• Diagnosing errors and measuring request and page performance when monitoring is enabled;
• Reviewing aggregate website traffic statistics. We do not use advertising pixels, Google Analytics, or tracking for personalized advertising in the current app.

2.4 Legal and Compliance

• Complying with applicable laws, regulations, and government requests;
• Establishing, exercising, or defending legal claims;
• Protecting the rights, property, and safety of the Company, Users, and the public.

3. Legal Basis for Processing (GDPR)

For users subject to the General Data Protection Regulation (GDPR), we process personal information based on the following legal grounds:

• Contract: To provide the Service and fulfill your subscription agreement (Section 2.1);
• Legitimate Interests: To improve the Service, prevent fraud, and operate our business efficiently (Sections 2.2, 2.3);
• Consent: To send marketing communications and analytics tracking (where required by local law);
• Legal Obligation: To comply with law enforcement requests, tax laws, and other legal requirements (Section 2.4).

You have the right to object to processing based on legitimate interests. Please contact us at the address in Section 16 if you wish to exercise this right.

4. Client Data and Data Controller/Processor Relationship

4.1 Data Controller and Processor

When you use the Service to store and process business data (Client Data), the relationship between you and the Company is:

• You are the "Data Controller" — you determine what Client Data is collected, stored, and how it is used;
• We are the "Data Processor" — we process Client Data only according to your instructions and our Service agreement.

4.2 Client Data Processing

The Company will process Client Data in accordance with your instructions as documented in the Terms of Service and this Privacy Policy. We will:

• Store Client Data securely on our servers and backups;
• Use Client Data only to provide and maintain the Service;
• Not share Client Data with third parties except as necessary to provide the Service or as required by law;
• Delete Client Data after 30 days following account termination (subject to legal retention requirements).

4.3 Your Responsibilities

As the Data Controller, you are responsible for:

• Obtaining all necessary consents and authorizations before uploading personal data to the Service;
• Ensuring that Client Data does not violate applicable laws or third-party rights;
• Complying with all data protection laws applicable to your collection and use of Client Data;
• Providing privacy notices to any individuals whose data you upload (e.g., your customers and contacts).

5. Data Sharing and Disclosure

5.1 Service Providers

We engage third-party service providers to help us operate the Service, including:

• Hosting and Database Providers: Vercel for application hosting and our configured cloud PostgreSQL provider for storing account and Client Data;
• Payment Processing: Stripe for hosted checkout, subscription management, and billing;
• Analytics: Vercel Web Analytics for website traffic statistics when enabled;
• Error and Performance Monitoring: Sentry for technical diagnostics when enabled;

• Authentication: Google if you choose Google sign-in;
• Background Processing: Inngest for CSV import jobs and retryable webhook delivery.

These service providers are contractually bound to use your information only as necessary to provide services to us and not to disclose it to other parties.

5.2 Authorized Users and Account Administrators

If you authorize multiple Users on your account, each User may have access to Client Data according to their permissions. Account Administrators may access and manage Client Data and User settings.

5.3 Legal Requirements and Compelled Disclosure

We may disclose personal information if required by law, court order, government request, or if we believe in good faith that disclosure is necessary to:

• Comply with applicable legal obligations;
• Enforce our Terms of Service and other agreements;
• Protect the security or integrity of the Service;
• Protect the rights, privacy, safety, or property of the Company, Users, or the public;
• Prevent or investigate possible wrongdoing.

Where legally permissible, we will provide you with notice of any compelled disclosure so that you may seek a protective order.

5.4 Business Transfers

If the Company is involved in a merger, acquisition, bankruptcy, dissolution, restructuring, or similar transaction or proceeding, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

5.5 De-identified and Aggregated Data

We may collect, use, and share de-identified and aggregated data (data that cannot reasonably identify you) without restriction. This includes anonymized usage statistics, feature adoption rates, and general trend analysis.

6. Cookies, Analytics, and Monitoring

6.1 Login and Security Cookies

We use first-party cookies through NextAuth to keep you signed in and protect the sign-in process:

• Login Session: The next-auth.session-token cookie stores an encrypted authentication token. Its expiry is set to 30 days and may be refreshed during use. Signing out clears the session cookie.
• Sign-In Security and Return Destination: The next-auth.csrf-token cookie helps protect against forged sign-in requests, and next-auth.callback-url remembers where to return you after sign-in. These are browser-session cookies.
• Google Sign-In: If you choose Google sign-in, next-auth.state and next-auth.pkce.code_verifier cookies help verify the sign-in response. They expire after 15 minutes or are cleared when the sign-in checks complete.

On HTTPS deployments, authentication cookie names may start with __Secure- or __Host-. Large session tokens may be split across multiple cookies. These cookies are not used for advertising or website traffic analytics.

6.2 Temporary App Cookies

The Service also uses short-lived first-party cookies for specific actions:

• Contact Form Recovery: simplecrm_contact_form_flash temporarily stores the contact details you entered, including any supplied custom fields, so the form can be restored after a conflicting contact detail causes a redirect. This cookie expires after 2 minutes and is limited to the relevant contact page.
• Invitation Display: simplecrm_invite_link_flash temporarily stores an invitation recipient's email address, invite link, and expiry so an administrator can view or copy the invitation after a redirect. This cookie expires after 5 minutes and is limited to the relevant settings or administration page.

Our login and temporary app cookies are marked HttpOnly, so scripts running in the page cannot read them, and use the SameSite=Lax setting to restrict when browsers send them with requests from other sites. Account settings, including your default workspace, are stored in our database rather than in preference cookies.

We also store your analytics and browser-diagnostics choices in the first-party jindo_privacy_consent cookie for 180 days. This cookie is used only to remember your choices. It uses SameSite=Lax and Secure on HTTPS, and is readable by the app's scripts so they can apply your preferences. It does not contain your name or email address. After expiry, or if the preference format changes, we may ask you to choose again.

6.3 Vercel Web Analytics

We include Vercel Web Analytics to understand traffic to our website and app when analytics is enabled for the deployment and permitted by your privacy choices. For visitors in the EU, UK, or other EEA countries, we load it only after they allow analytics. If we cannot determine a visitor's country, we ask for consent before loading optional analytics or browser diagnostics. It records page views and related information such as the page URL, referrer, timestamp, approximate location, and device, operating system, and browser characteristics.

Vercel uses a hash derived from the incoming request rather than an analytics cookie to distinguish visitors. Its visitor identification expires after 24 hours. We use its reports for aggregate traffic statistics, not cross-site advertising profiles. Page URLs and query parameters may contain workspace or record identifiers; cookie-free analytics does not mean that every URL is free of personal information.

We do not currently use Google Analytics, advertising pixels, or analytics cookies. Browser settings that block cookies alone do not necessarily stop cookie-free analytics requests.

6.4 Error and Performance Monitoring

When configured, Sentry receives error reports and sampled performance information to help us troubleshoot and improve reliability. Optional browser diagnostics follow your browser-diagnostics choice, with prior consent required for visitors in the EU, UK, and other EEA countries, or when the country is unknown. This may include the diagnostic data described in Section 1.2, such as URLs, error messages, stack traces, request timings, and navigation or interaction breadcrumbs. We do not currently enable Sentry Session Replay to record a reproduction of your browsing session. Server-side operational logging and monitoring continue separately to operate and secure the Service; the browser-diagnostics control does not disable those server-side records.

6.5 Your Choices

You can delete or block cookies through your browser settings. Blocking the login session cookie prevents the current app from keeping you signed in. Blocking temporary app cookies may prevent contact forms from being restored or invitation links from being displayed after redirects.

For visitors in the EU, UK, and other EEA countries, we show a consent banner with equally available "Accept optional" and "Reject optional" choices and settings for analytics and browser diagnostics. These optional categories start off until you choose to allow them. We determine the country from our hosting provider's approximate IP-based country information, without asking for precise device location. We also show the banner when country information is unavailable. Elsewhere, optional analytics and browser diagnostics may run by default unless you disable them.

You can open "Cookie settings" on any page to change or withdraw your choices. Saving a choice refreshes the page to apply it and remove any previously loaded optional tracking scripts. Refusing optional analytics or browser diagnostics will not prevent you from signing in or using the core CRM features. You do not need to accept optional tracking to sign in; your browser does need to allow authentication cookies. You can contact privacy@jindocrm.com with questions or requests about analytics and diagnostic processing. This policy does not treat cookie-free technology as automatically exempt from applicable privacy requirements.

7. Data Retention

7.1 Client Data

We will retain Client Data for as long as your Subscription remains active. Upon termination or expiration of your Subscription:

• We will retain Client Data for 30 days, during which you may request an export;
• After 30 days, we will delete Client Data from our production systems;
• Backup copies may persist for up to 90 days as part of standard backup rotation and disaster recovery procedures;
• We may retain Client Data longer if required by law.

7.2 Account and Usage Information

We retain account information (name, email, company, subscription details) for as long as your account is active, plus a reasonable period for legal and compliance purposes (typically 3–7 years). Usage and analytics data may be retained in aggregated or de-identified form indefinitely.

7.3 Backup and Disaster Recovery

Due to the critical nature of data backups, deleted data may persist in backup systems for up to 90 days. These backups are not routinely accessible for individual recovery requests.

8. Data Security

We take data security seriously and implement reasonable technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit (TLS/HTTPS) and at rest;
• Password hashing and authenticated sessions, with Google sign-in available as an alternative;
• Access controls and role-based permissions;
• Regular security assessments and vulnerability testing;
• Employee training on data protection practices;
• Incident response procedures for data breaches.

However, no security measure is 100% secure. We cannot guarantee absolute security. You acknowledge the inherent risks of transmitting information over the internet and agree to hold us harmless for any security breach not caused by our negligence.

9. Your Privacy Rights

9.1 Access and Portability

You have the right to access personal information we hold about you and, in certain jurisdictions, to obtain a copy in a portable format. You may access much of your account information directly through the Service settings. For other requests, contact us at the address in Section 16.

9.2 Correction and Updates

If your personal information is inaccurate or outdated, you may request that we correct or update it. You may also update your account information directly through your account settings.

9.3 Deletion and Right to Be Forgotten

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., where we are required to retain data by law or to fulfill our obligations to you). Note that deletion of your account will not delete Client Data that remains in backups for disaster recovery; however, this data will not be accessible to you and will be permanently destroyed after backup rotation periods.

9.4 Objection to Processing

Where processing is based on legitimate interests, you have the right to object. You may also ask us to stop promotional communications by contacting us, or by using an unsubscribe link where one is provided. Essential account and invitation communications are separate from promotional communications.

9.5 Restriction of Processing

In certain circumstances, you may request that we restrict how we process your personal information while we verify its accuracy or determine the lawfulness of processing.

9.6 Exercising Your Rights

To exercise any of the rights above, please contact us at the address in Section 16, providing sufficient detail about your request. We will respond within 30 days (or as required by applicable law).

10. California Consumer Privacy Act (CCPA) Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with certain rights. This section applies in addition to the rights described in Section 9.

10.1 Right to Know

You have the right to request what personal information we collect, use, share, and sell about you over the past 12 months.

10.2 Right to Delete

You may request deletion of personal information we have collected from you, subject to exceptions for information we need to complete your transaction, provide services, or comply with legal obligations.

10.3 Right to Opt-Out of Sale or Sharing

We do not sell or share personal information for cross-context behavioral advertising. However, if this changes, we will provide an opt-out mechanism.

10.4 Right to Correct

You have the right to request correction of inaccurate personal information.

10.5 Right to Limit Use

You may request that we limit our use of your personal information to purposes necessary to provide the Service.

10.6 Non-Discrimination

We will not discriminate against you for exercising any of these rights. We will not deny services, charge different prices, provide lower quality service, or suggest that you will receive different treatment based on your exercise of CCPA rights.

10.7 Authorized Agent

You may designate an authorized agent to submit requests on your behalf. The agent must provide proof of authorization and a signed declaration of authority.

10.8 Submitting a Request

To submit a request under the CCPA, please contact privacy@jindocrm.com using the contact details in Section 16. We will respond within 45 days.

11. International Data Transfers

Our servers are located in the United States. If you are located outside the United States, your personal information will be transferred to, stored in, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

For users in the European Union or other jurisdictions with strict data transfer requirements, we rely on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms to facilitate lawful data transfers. Please contact us if you require additional information about our transfer mechanisms.

12. Third-Party Integrations

The Service may allow you to integrate third-party applications and services. If you choose to integrate third-party services, those services may collect, access, and process your data according to their own privacy policies. We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies before authorizing integration.

13. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will delete such information promptly. If you believe we have collected information from a child under 13, please contact us immediately.

14. Do Not Track

Some browsers include a "Do Not Track" feature. Because there is no industry-wide consensus on how to interpret DNT signals, we do not currently alter our data collection practices in response to DNT browser signals. However, you may exercise your preferences through other mechanisms described in this Privacy Policy.

15. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Privacy Policy on our website with a new "Effective Date." Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

We encourage you to periodically review this Privacy Policy to stay informed about how we protect your information.

16. Contact Us

If you have any questions about this Privacy Policy, your privacy, or our data practices, please contact us at:

White Cat Black Dog, LLC

Jindo CRM Privacy Team

Cupertino, California

Email: privacy@jindocrm.com

Website: jindocrm.com

Additional Information

For specific questions about your account or to access your personal information, please log in to your Jindo CRM account or contact our customer support team at support@jindocrm.com.

Last Updated: October 8, 2026