We keep your data safe, predictable, and in your control.

• Provide the CRM, client portal, billing, approvals, and ticketing features you expect.
• Secure your account and detect suspicious activity.
• Operate billing, invoicing, and subscription management.
• Deliver support and answer your questions.
• Improve the product based on usage trends and feedback.
• Communicate updates, security notices, and relevant product changes.

• Contract: We process data to deliver the services you sign up for.
• Legitimate interests: We keep the platform secure and improve performance.
• Consent: You opt in to marketing communications and optional analytics.
• Legal obligations: We retain certain data for tax and compliance.

We retain data only as long as needed to run the service and meet legal requirements. When an account is closed, you can export your data and request deletion. Some data may remain in backups for a limited period before being removed.

• Encrypted connections (TLS) for data in transit.
• Access controls and audit logs for accountability.
• Company-aware separation to prevent cross-company exposure.
• Monitoring and alerting for unusual behavior.

No system is perfect, but we continually improve our safeguards.

We do not sell your personal data. We may share limited data with trusted service providers who help us operate A1 CMS (hosting, email delivery, payment processing, error monitoring). They are bound by confidentiality and only access what they need to provide their services.

A1 CMS can connect to a Google account when you choose to connect one. Nothing is read from Google until you sign in to Google and grant the permission, and each feature asks only for the permission it needs.

• Signing in. Your name, email address and profile picture, used to identify your account and to show who is connected.
• Calendar and bookings. Permission to see and change events in the calendars you select, so an appointment booked in A1 CMS appears in your Google Calendar, a cancellation removes it, and your existing events block times that are no longer free.
• Mailbox. Permission to read, send and organise the mail in the mailbox you connect, so A1 CMS can show your conversations beside a customer or a lead, send your replies from your own address, and file a message against a record.
• Google Drive. Permission limited to the files you pick yourself in Google's own file picker, and to the files A1 CMS creates for you. A1 CMS cannot see the rest of your Drive.

Google data is used only to provide the feature you connected it for, and only inside your own workspace. We do not use it for advertising, we do not sell it, we do not pass it to anyone else except the infrastructure providers that run the platform on our behalf, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models. Our staff do not read it, except where you ask us to help with a support request, where the law requires it, or where we must investigate abuse or a security incident.

A1 CMS keeps the connection's access tokens, and the calendar entries, messages and file references that the feature needs to work, for as long as the connection is in place. Disconnecting the account in A1 CMS deletes those tokens and the data held for the connection. You can also withdraw the permission at any time from your Google account at myaccount.google.com/permissions, which stops any further access immediately.

Google data is protected the same way as the rest of your workspace: carried over HTTPS, held in your own tenant database rather than a shared one, reachable only by the staff accounts you have given the permission to, and the access tokens themselves are encrypted where they are stored. Our security practices are set out in full on our security page.

We do not use Google data for targeted advertising, we do not sell it or pass it to data brokers, we do not use it for creditworthiness or lending decisions, and we do not use it to train generalised artificial intelligence or machine learning models.

A1 CMS's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Essential cookies for authentication and session security.
• Preference cookies to remember your settings.
• Analytics signals to measure performance and usage trends.

You can configure cookie behavior in your browser. Disabling cookies may limit functionality.

A1 CMS may process data in the regions where we operate or where our infrastructure providers run data centers. We apply consistent safeguards across environments.

Questions or requests? Reach us at privacy@a1cms.com or submit a support ticket from your portal.