Product privacy notice

Last updated: 3 November 2026

AquaCRM is business software that agencies use to run their work. It holds their clients, enquiries, messages, projects, invoices and staff records. AquaCRM is provided by Edward Hallam, a sole trader in England and Wales, trading as AquaCRM the address given on request at [email protected] ("AquaCRM", "we"). ICO registration number: [ICO NUMBER].

This notice has two parts:

• Part 1 is for you if an agency (or one of its clients) keeps your details in AquaCRM. You might be a client, a customer, someone who sent an enquiry or a message, a job applicant or an employee.
• Part 2 is for you if you sign in to AquaCRM. You might be an agency's owner, staff member or freelancer, a client using a client portal, or a customer of one of those clients.

---

Part 1 — If an agency keeps your details in AquaCRM

1.1 Who is responsible for your information

The agency that uses AquaCRM decides what information about you it keeps and why. In some cases it is the agency's own client who decides. Either way, that business is the controller of your information. AquaCRM stores and processes it on their behalf and on their instructions, as their processor, under a written contract.

If you want to exercise your rights, contact the agency first. It is the one that can answer you. If you contact us instead, we will pass your request to the agency within [5] business days and tell you that we have done so. We will not answer for them unless they ask us to.

1.2 What may be held about you

It depends on how the agency uses AquaCRM. It can include:

• your name, email address, phone number, company, job title and business address;
• messages you have exchanged with the agency, by email, Facebook or Instagram, SMS, WhatsApp or phone, and their attachments, plus notes of meetings and calls;
• recordings of calls with you, and voice notes, if the agency records them in AquaCRM. The recording is stored in AquaCRM. Before a call is recorded, the person at the agency must confirm that everyone on the call has agreed;
• the enquiry you sent through a website form;
• proposals, invoices, orders, subscriptions and payment references. Card numbers are not stored in AquaCRM. Card payments are taken on the payment provider's own checkout;
• if you use a client portal: your account and what you do in it;
• if you applied for a job or work for the agency: your application, CV and employment records, which the agency keeps in AquaCRM's People area;
• if you work for the agency and clock in to AquaCRM: records of your working time. These include when you clocked in and out, how long you spent on each screen of AquaCRM, when you last used it and whether the page was open, idle time, check-ins, breaks and work you said you did elsewhere, your day and week plans and reviews, counts of your actions, the tasks you bid for, and your messages in the internal chat;
• anything else someone at the agency types into a note or uploads.

AquaCRM is not designed to hold sensitive ("special category") information, and the agencies' contract with us prohibits putting it in without our agreement. There is one exception. If you work for an agency that uses the People area, it may record your leave, and one type of leave is sick leave. Free-text notes, messages and CVs can also contain sensitive information if someone writes it there.

1.3 Where it comes from

From you, when you contact the agency or use a portal. From the agency's own records. From the agency's website forms and connected inboxes and calendars. And, for businesses the agency is prospecting, from public business listings the agency searches.

1.4 What we do with it

We use it only to provide AquaCRM to the agency. We do not sell it, and we do not use it for our own marketing.

1.5 Who else receives it

• Our hosting providers. Railway runs the application, in the EU West region. Supabase holds the database and stored files, in Ireland (EU). Files stored before the move to Supabase may still be held in Vercel's storage, which AquaCRM still reads; its region is not verified. The full list of our providers, with what each receives and where, is our sub-processor list: [LINK].
• GitHub and Vercel, when an agency publishes a client's project. If the agency publishes or deploys a client's project from AquaCRM without connecting its own GitHub or Vercel account, the project's files go to that provider under AquaCRM's own account. The same happens with GitHub, but not Vercel, when an agency owner works on the project in the code editor without a GitHub account of the agency's own. [Region not verified: the sub-processor list gives "US / global" for both. Confirm before stating a country.] [Ed to decide whether this stays; see sub-processors.md, open question E6.]
• Services the agency connects. The agency may connect its own accounts with an email provider, a payment provider, an AI provider, a messaging or phone provider, Google, GitHub or Vercel. AquaCRM then sends your information to that service when the agency uses the feature. For example, it sends your address and the message to the agency's email provider when the agency emails you. Those services act for the agency, under the agency's own agreement with them. Several of them are in the United States.

1.6 Transfers outside the UK

AquaCRM's main hosting is in the EU, but not all of it: older files may be in Vercel's storage (see 1.5), whose region is not verified. Your information can also leave the UK and the EU when one of our providers, or a service the agency has connected, is based elsewhere. This mainly means the United States. [Solicitor: describe the safeguards once confirmed — see sub-processors.md.]

1.7 How long it is kept

The agency decides. AquaCRM lets an agency set retention periods for some records. Unless the agency sets one, records are kept until the agency deletes them. In addition:

• when an agency erases a client from AquaCRM, the records linked to that client are deleted or anonymised. A small set is kept because the law may require it: invoices, contracts and proof of delivered work;
• AquaCRM keeps a limited number of recent recovery copies of its stored data, the 20 most recent per stored record. An erasure removes the erased client from those copies too;
• [Backups: once the backup system is running, say how long backups are kept and that an erased record remains in a backup until that backup expires.]

1.8 How it is protected

Among other measures, AquaCRM:

• serves everything over encrypted connections, and in production connects to its database over verified encrypted connections [unless its connection settings turn encryption, the certificate check or the host-name check off; see reviewer note 1.8];
• holds the credentials agencies give it for connected services encrypted [with the exceptions in reviewer note 1.8];
• checks, on every request, that the person is still allowed to see what they are asking for, and limits each person to their own agency and their granted access;
• requires a bot check, and limits the rate of attempts, before anyone can try a password;
• refuses unsafe file types in uploads, and scans uploads for malware where a scanner is configured.

The full list is in Annex 2 of our data processing agreement with agencies.

1.9 Your rights

You have the right to ask for a copy of your information, to have it corrected or erased, to object to or restrict its use, and to have it moved to another provider. Some of these rights apply only in certain circumstances. Ask the agency (see 1.1).

You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to help first.

1.10 If you visit a website that uses the Aqua Tag

Some agencies put the Aqua Tag on their own websites, or their clients' websites, to measure how the site is used. On those sites:

• the Tag sends nothing for analytics or marketing until you have made a cookie choice. After that, it sends only the kinds of event you allowed. A record of your choice is always sent;
• it records page, performance, error and conversion events, with a random identifier for your browser. Page addresses are recorded without their query string or anything after #;
• it never reads what you type into a form. If you send a form, the site's owner receives it through their own systems;
• the site's owner may also load other tools, such as analytics or advertising pixels. The site's owner decides which kind of cookie each tool counts as. By default analytics and advertising tools wait until you have allowed that kind of cookie, but the owner can mark a tool as necessary, and then it loads straight away. Those tools send information directly to their own providers, not to AquaCRM. The site's own privacy notice covers them.

---

Part 2 — If you sign in to AquaCRM

2.1 Who is responsible

AquaCRM is the controller of your account and of the security records about your sign-ins. The agency you work for, or use the portal of, is the controller of the work records you create, and Part 1 applies to those. [Solicitor to confirm this split — see open question S1.]

2.2 What we collect

• Your account. Your name, email address, role, which workspaces you belong to and, if you add one, a profile picture.
• Your password. Your password is checked by our authentication provider. We never store it in readable form: our own record holds only a salted, one-way scrypt hash.
• Two-factor sign-in, if you turn it on. Your authenticator is registered with our authentication provider. We keep your recovery codes only as one-way hashes, and each code is deleted when used.
• Sign-in sessions. For each session we record when it started, how you signed in, the IP address, the browser identifier, and when it was last used (updated at most every 15 minutes). If a session is ended early, we record when, by whom and why. This lets the owner of an agency workspace see the sessions in it and end them. [There is not yet a way for you to see your own sessions unless you are that owner.]
• Bot check. When you sign in, sign up or reset a password, a Cloudflare Turnstile check runs. It sends your IP address and a challenge token to Cloudflare.
• Rate limiting. To stop password guessing we count attempts. The lasting counters store a one-way keyed hash of the IP address or email, not the address itself.
• Activity. AquaCRM keeps an activity log of actions taken in a workspace, showing who took them, by name or email, and when. Some workspaces also show you counts of your own work (prospects added, calls made, emails sent, meetings booked, leads qualified, clients won) for daily and weekly targets.
• Error reports. If something goes wrong, our error monitoring may receive a report with an internal user id, the type of page and the error. Your name, email, passwords, cookies and the content you were sending are not added to it. [See reviewer note 2.2: the error's own text can contain personal data, and in many places the server also writes that text in full to our hosting provider's log.]
• Your working time, if you are agency staff and clock in. This is recorded in your agency's workspace, and the agency is responsible for it. See Part 1.2.
• Your messages to us, if you contact support.

We do not use your device's location. AquaCRM uses your microphone only when you choose to record a voice note or a call in the inbox. [Meeting rooms: if AquaCRM's hosted meetings are offered, add what they use. They take a camera image for your seat picture and connect your camera and microphone during a call. Your browser also sends your IP address to Google's public servers to set up the call, and the other people in the call can see it. See open question E6.]

2.3 Why we use it, and our lawful basis

2.4 Who receives it

Our hosting and security providers: Railway, Supabase, Cloudflare, and our error monitoring, Sentry, if enabled. Resend, our email provider, if you sign up a new agency: it sends the email that verifies your address. Google, if you choose "Sign in with Google" or connect your Google calendar. Also the people in your workspace who are allowed to see it. For example, an owner can see who has active sessions and the activity log. The full list is our sub-processor list: [LINK].

2.5 How long we keep it

• Sign-in cookie: up to 7 days by default. After that you sign in again.
• Our authentication provider's cookies: up to 400 days, the library default ([see reviewer note 2.7; to be shortened]).
• Session records: removed after the session expires, at the next sign-in on the service. No more than 50 recent sessions are kept for each person.
• Your account: for as long as it exists. There is not yet a way to delete your own account in the product. If you use a client portal, your account is deleted when the agency erases that client. Otherwise, ask your workspace owner or us, and we will delete it within [30] days. Records you created for the agency may stay with the agency (Part 1).
• Activity log: the most recent 50,000 entries across the service are kept. Older entries drop off as new ones are added, unless the agency has set a shorter period.
• Your own activity counts: 400 days.
• Error reports: as set in our error-monitoring service: [PERIOD — confirm in Sentry].
• Server logs at our hosting provider: [PERIOD — confirm with Railway]. These logs can include the text of errors, which can contain personal data such as an email address.

2.6 Your rights

The same rights as in 1.9. For your account and sign-in records, contact us at [PRIVACY CONTACT EMAIL]. We will answer within one month.

2.7 Cookies the application uses

The AquaCRM application sets:

• a sign-in cookie, which keeps you signed in. It cannot be read by page scripts;
• our authentication provider's (Supabase's) session cookies, set when you sign in with a password and when you set up or confirm two-factor sign-in, renewed while you use the application when their sign-in token is refreshed, and changed when you sign out;
• a security token cookie, which protects against forged requests;
• while you sign in with Google, a sign-in flow cookie that lasts 10 minutes;
• while you set up a new agency, a set-up cookie that lasts 30 minutes;
• short-lived message cookies that carry a sign-in or sign-up error back to the form;
• a brand cookie that remembers which sign-in page to show you, for 30 days;
• a few preference cookies that remember display choices, such as performance mode, the last department you viewed, or that you have seen a client portal's welcome screen;
• for the operator only, cookies for preview and demonstration modes.

These are needed for the application to work, or they remember a choice you made. The application itself does not set analytics or advertising cookies.

---

Contact and changes

Questions about this notice: [PRIVACY CONTACT EMAIL], or write to the address given on request at [email protected]. We will update this notice when what we do changes, and change the date at the top.

---