Privacy policy

Last updated 14 August 2026

vaCRM is a tool for virtual assistants to run their client work. This explains what it holds about you, what it holds about your clients, and what you can do about either.

Who this is about

vaCRM is operated by [YOUR TRADING NAME], [YOUR ADDRESS], registered with the Information Commissioner's Office under [YOUR ICO NUMBER].

There are two sorts of people in here and the law treats them differently.

You, as a vaCRM customer. We decide what to collect about you and why, so we are the data controller.

Your clients. You decide what to record about them and why. You are their controller and we are your processor: we hold their details because you asked us to, and we do not use them for anything of our own.

What we hold about you

Your name, email address and password, which is stored hashed and cannot be read back by anyone including us.
Your business name, logo, colour and working hours, because the product uses them.
Your billing details if you are on a paid plan. Card numbers go to Stripe and never reach our servers.
A log of actions taken in your account, so that a question about what happened has an answer.

What you put in about your clients

Whatever you choose: names, contact details, requests and the messages on them, notes, time entries, invoices and files. We hold it, back it up and keep it available to you. We do not read it, mine it, sell it, or use it to train anything.

Your clients reach their own portal through a private link rather than an account, so we hold no password for them.

Google Calendar

If you connect Google Calendar, vaCRM reads the events on the calendars you choose so it can show them, and writes events you create here.

vaCRM's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: your calendar data is used to provide the calendar feature to you and nothing else. It is not sold, not used for advertising, not used to train any model, and no human at vaCRM reads it except where you have asked us to help with a specific problem or the law requires it.

Events are fetched when you open the page and are not copied into our database. Disconnecting from Settings revokes our access at Google's end as well as ours, and deletes the stored tokens immediately.

Email

If you add your own mail settings, notifications to your clients are sent through your mail provider under your own address. We store your mail password encrypted so that we can send on your behalf.

Who else is involved

Hostinger, who host the servers and the database.
Stripe, for payments, if you are on a paid plan.
Google, if you connect a calendar.
Your own mail provider, if you configure one.

We do not use advertising networks, analytics services or tracking tools.

How long it is kept

Your account data stays while your account is open. Close it and we delete it within 30 days, except anything we have to keep for tax or accounting, which is six years.

Client records stay until you delete them. Erasing a client from within vaCRM removes their personal details immediately.

What you can ask for

You can ask for a copy of what we hold, for it to be corrected, or for it to be deleted. Any client's full record can be exported from their page as a zip without asking us at all, which is usually faster than a request.

Ask at [YOUR CONTACT EMAIL]. If you are unhappy with the answer you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Traffic is encrypted in transit. Passwords are hashed. Credentials such as mail passwords and calendar tokens are encrypted before they are stored. Each account's data is separated at the database level, so one customer cannot reach another's.

Changes

If this changes materially we will tell you in the app rather than quietly updating the date at the top.