SimplyCRM Privacy Policy

Effective date: November 6, 2026

SimplyCRM is run by David Neufeld, operating as DOUFT, in Canada. Contact: [email protected]. Mitchell, Manitoba, Canada.

What SimplyCRM does

SimplyCRM helps small businesses answer calls and messages, keep track of their customers and run their ads. A business using SimplyCRM decides what it collects from its own customers. For those customers, we handle information on that business's behalf.

What we collect

• Account details for people who use the app: name, email, phone number and business details.
• Details of a business's customers: name, phone, email, what they asked about, and answers given on forms.
• Messages, calls and comments, including call recordings and transcripts where a business has turned that on and given notice.
• Photos, videos and files that are sent or uploaded.
• How shared pages and videos are used: when they were opened, for how long, device, and an approximate location based on internet address.
• Information from connected accounts such as Facebook, Instagram, Gmail and TikTok, only after a business connects them.

How we use it

To run the service: answer and route messages, show a business its customers, send messages a business has set up, send alerts, keep the service secure, and bill for it. We do not sell personal information.

AI

SimplyCRM uses AI to help write replies, check whether a message needs urgent attention, and summarize conversations. To do this, the text of messages and comments is sent to our AI provider. People who ask are told they are dealing with an AI assistant. Where AI can reply on its own, a business chooses to turn that on.

Who we share it with

We share information only as needed to run the service, with these providers:

• OpenAI: AI processing of message and comment text.
• Cloudflare: network and security.
• Twilio: phone calls and text messages.
• Brevo: email delivery.
• Google Firebase Cloud Messaging and Apple Push Notification service: app alerts.

We also exchange information with services a business connects, such as Meta, Google and TikTok. Our servers are our own, located in Canada.

Facebook and Instagram data

If a business connects a Page or Instagram account, we use that data only to show and answer its messages and comments, publish what it chooses to publish, and report on its ads. Access tokens are stored encrypted on our server. A business can disconnect at any time.

Requests from public authorities

If a public authority asks for personal information, we check that the request is lawful, challenge requests that are not, share the minimum required, and keep a record of each request.

Keeping and deleting information

We keep information while an account is active. After an account closes, we delete its information within 90 days, unless the law requires us to keep it. To ask for your information to be corrected or deleted, contact [email protected]. If you are the customer of a business using SimplyCRM, you can also ask that business. To stop texts, reply STOP. To stop emails, use the Unsubscribe link.

Keeping it safe

We use access controls, encryption of stored credentials and separation between businesses. No system is perfectly secure, and we will act and notify as the law requires if there is a breach.

Your rights

You can ask to see or correct your personal information, and you can complain to the Office of the Privacy Commissioner of Canada.

Changes

We will post changes here and update the effective date.