Quick Summary
- →We collect information you provide and data about how you use our services
- →Your data is used to provide and improve our AI automation services
- →We never sell your personal information to third parties
- →You have rights to access, correct, and delete your data
- →Google user data is used only for CRM features you authorize, per Google's Limited Use requirements
- →Questions? Email us at info@cxtrack.com
1. Introduction
CxTrack ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website cxtrack.com, use our AI automation services, voice agents, CRM integrations, or interact with us in any way. By accessing or using our services, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access our services.
2. Information We Collect
2.1 Personal Information You Provide
- •Contact information (name, email address, phone number, company name)
- •Account credentials (username, password)
- •Business information (industry, team size, revenue range)
- •Payment and billing information (processed through secure third-party providers)
- •Communications you send us (emails, support requests, demo requests)
- •Survey responses and feedback
2.2 Information Collected Automatically
- •Device information (IP address, browser type, operating system)
- •Usage data (pages visited, time spent, click patterns)
- •Cookies and similar tracking technologies
- •Log files and analytics data
- •Email engagement data, such as whether you open emails we send you, collected via standard open-tracking pixels
- •Geolocation data (country, region, city) derived from your IP address
- •Session activity captured by analytics tools, such as pages viewed, clicks, scrolling, and mouse movement. These tools are configured to mask text you type into form fields, and do not load unless you accept our cookie banner
2.3 Information from Third Parties
- •Social media profiles (when you connect accounts)
- •CRM and business tool integrations you authorize
- •Payment processor transaction confirmations
- •Marketing partners and lead generation services
3. How We Use Your Information
- •Provide, operate, and maintain our AI automation services
- •Process transactions and send related information
- •Send administrative communications (service updates, security alerts)
- •Respond to inquiries, support requests, and demo requests
- •Personalize and improve your experience
- •Analyze usage patterns to enhance our services
- •Develop new products, features, and functionality
- •Send marketing communications (with your consent)
- •Detect, prevent, and address technical issues and fraud
- •Comply with legal obligations and enforce our terms
4. Voice Agent & AI Data Processing
Our AI voice agents and automation tools may process: • Call recordings and transcriptions (stored securely and encrypted) • Customer interaction data from your CRM • Business workflow data to optimize automations • Performance metrics and analytics All AI-processed data is handled in accordance with industry best practices. We do not use your customer data to train our AI models without explicit consent. Call recordings are retained for the duration specified in your service agreement and can be deleted upon request.
5. Google User Data
CxTrack connects to Google services so that you can use your Gmail, Google Calendar, Google Drive and Google Contacts data inside the CRM. This section describes how we access, use, store and share data received through Google APIs. CxTrack's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5.1 Data Accessed
- •Profile information: Your name, email address, and profile picture, used to sign you in and identify your account (scopes: openid, email, profile)
- •Gmail: Permission to send email on your behalf (scope: gmail.send), and permission to read, organize and update messages in the mailbox you connect, including marking messages as read and moving them to trash (scope: gmail.modify). CxTrack does not request permission to permanently delete messages
- •Google Calendar: Permission to read your calendar events and to create or update events (scopes: calendar.readonly, calendar.events)
- •Google Drive: Permission to search and read files in your Drive (scope: drive.readonly). CxTrack uses it to search your whole Drive when you use Search Drive or Auto-discover on a customer profile, and to read Google Docs transcripts of your Google Meet meetings. Separately, permission to create files in your Drive and to update only the files CxTrack created, such as exported spreadsheets and statement copies (scope: drive.file)
- •Google Contacts: Permission to read your contacts (scope: contacts.readonly)
- •OAuth tokens: Short-lived access tokens (approximately 1 hour) and long-lived refresh tokens used to maintain your connection without requiring repeated sign-in
5.2 How Google Data Is Used
- •Profile data is used only to identify your account and to display your name and avatar within the CRM
- •Gmail: When you connect Gmail, CxTrack copies the messages in your Inbox and Sent folders into your CRM workspace. The first copy covers the last 90 days; after that, new messages are copied about every 5 minutes. CxTrack stores each message's full text and attachment details, and attachments on incoming messages can be saved to the matching customer record. This includes messages to and from people who are not your customers; a message is linked to a customer record only when its sender or recipient matches one. Messages involving an address on your do-not-record list are skipped. When you mark a message as read or delete it in CxTrack, Gmail makes the same change (deleted messages go to Gmail's Trash). CxTrack does not archive, label or permanently delete your messages. If you turn on receipt scanning in Settings, CxTrack reads incoming messages that look like receipts or invoices in order to propose expense entries for your approval; this is off unless you enable it
- •Google Calendar: Events are displayed in the CRM calendar and dashboard, and CxTrack creates or updates events, including Google Meet links, for meetings, follow-ups and appointments you schedule in the CRM
- •Google Drive: When you click Search Drive or Auto-discover on a customer profile, CxTrack searches the names and text of the files in your whole Drive and shows the matches (Auto-discover searches for the customer's name and company). Only files you choose are linked to the customer, and for those CxTrack stores the file's name, type, size, link and thumbnail, not its contents. When you sync meeting transcripts in Settings, CxTrack searches your Drive for Google Docs whose name contains "transcript" and imports their text as meeting notes. Transcripts come only from your Drive; CxTrack does not request access to Google Meet
- •Google Sheets: When you click Export to Sheets, CxTrack creates a new spreadsheet in your Drive and writes the exported rows into it. CxTrack does not open or read your existing spreadsheets and does not import data from Google Sheets. For some accounts, CxTrack also saves copies of statements it has archived into a folder it creates in your Drive
- •Google Contacts: When you click Sync Now in Settings, CxTrack reads your saved contacts (name, email addresses, phone numbers, company, job title and photo), matches them to CRM customers by email address, and lists the rest as suggested leads you can choose to import. CxTrack does not change your Google Contacts and does not read your "Other contacts" (people you have emailed but never saved)
- •Automated processing: CxTrack uses AI models to summarize, categorize, search and draft within your workspace. Meeting transcripts are summarized by Anthropic Claude and Google Gemini models, reached through OpenRouter. Synced email may be processed by CxTrack's AI assistant, AI agents, expense detection and next-action suggestions, and is turned into search embeddings by OpenAI. This processing exists only to provide the user-facing features you use inside CxTrack and operates on your organization's data alone. Data received from Google APIs is not used to develop, improve or train generalized AI or machine-learning models
- •We do not use Google user data for advertising, market research, credit decisions or any purpose unrelated to the CRM features you have authorized
- •CxTrack does not allow humans to read your Google user data unless: (a) you provide affirmative consent for a specific message, (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized
- •You can disconnect Google at any time from Settings in the CRM, or from your Google Account permissions page at myaccount.google.com/permissions. Disconnecting revokes our tokens and stops all further access. Retention and deletion of synchronized data are described in 5.5; deletion requests go to info@cxtrack.com (Section 16, Contact Us)
5.3 Google Data Sharing
- •We do not sell, rent, or trade Google user data to any third party
- •We do not share Google user data with third parties except as necessary to provide the CRM service (for example, our infrastructure provider Supabase processes encrypted tokens to facilitate API calls)
- •We do not provide Google user data to advertising platforms, data brokers, or information resellers
- •Google user data may be disclosed if required by law, regulation, or valid legal process, or to protect the rights, safety, or property of CxTrack and its users
- •Where AI features process Google user data, the AI provider receives only the content needed for the feature you invoked and may not use it to develop, improve or train generalized AI or machine-learning models. AI requests sent through OpenRouter are restricted to providers that do not collect prompts and to zero data retention endpoints. OpenAI, which creates search embeddings from synced messages, does not train on this data but may keep request logs for up to 30 days for abuse monitoring
- •We do not transfer Google user data to any third party for the third party's own purposes
5.4 Google Data Storage and Protection
- •OAuth access tokens and refresh tokens are encrypted using AES-256 and stored in Supabase Vault, a dedicated secrets management layer separate from application data
- •Google user profile information (name, email) is stored in our application database with encryption at rest
- •Synchronized Gmail messages and attachments, linked Drive file references, imported Google Meet transcripts and matched Google Contacts are stored in our application database with encryption at rest, and are visible only to members of your organization with the relevant permissions
- •Calendar events from your connected account are synchronized into your CRM workspace and stored with encryption at rest so they can be shown alongside customer records; they remain available to your organization after you disconnect and are deleted on request (see 5.5)
- •All data in transit is protected with TLS 1.2 or higher encryption
- •Our infrastructure is hosted in Supabase's ca-central-1 (Canada) region with SOC 2 Type II certified data centers
- •Access to stored tokens is restricted to authenticated, authorized server-side processes only and is never exposed to client-side code
5.5 Google Data Retention and Deletion
- •OAuth tokens are retained only for as long as your Google account remains connected to CxTrack
- •When you disconnect your Google account from CxTrack settings, all stored tokens (access and refresh) are permanently deleted from Supabase Vault immediately
- •If your CxTrack account is deleted, all associated Google OAuth tokens and cached profile data are permanently removed within 30 days
- •You may revoke CxTrack's access at any time through your Google Account permissions page (myaccount.google.com/permissions) or through the CxTrack settings panel
- •Synchronized Google data (email messages and attachments, calendar events, Drive file references, Meet transcripts, contact matches) remains in your CRM workspace after you disconnect so your customer history stays intact; you can request its deletion at any time by emailing info@cxtrack.com, and it is permanently removed within 30 days of the request or of your account's deletion
5.6 Google API Services Limited Use Disclosure
- •CxTrack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements
- •CxTrack only uses Google user data to provide and improve the user-facing CRM features described in this policy
- •CxTrack does not use Google user data for serving advertisements or for any purpose other than providing the CRM functionality you authorized
- •CxTrack does not allow humans to read your Google user data unless: (a) you provide affirmative consent for a specific message, (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized
6. Data Sharing & Third-Party Service Providers
Sub-processors that may receive your data:
- •Supabase / AWS (ca-central-1, Canada) - primary database, storage, and edge function infrastructure
- •Netlify (US edge / global CDN) - frontend and marketing-site hosting; HTTPS termination only, no customer database data at rest
- •Stripe (US) - payment processing
- •Retell AI (US) - voice agent call routing and transcription
- •Twilio (US) - telephony and SMS
- •OpenRouter (US) - routes AI features (CoPilot, meeting summaries, document extraction, call analysis) to Google Gemini and Anthropic Claude models, only on providers that do not collect prompts
- •OpenAI (US) - text embeddings that power search and summaries (call summaries, meeting transcripts, notes, email and SMS logs, assistant memory)
- •Deepgram (US) - speech-to-text for call and meeting audio
- •Google Maps Platform (US) - geocoding, routing and roof data for customer addresses (when used)
- •Browserless (US) - headless browser sessions for portal automations (when used)
- •Plaud (US) - recording devices (when connected)
- •Hunter (Belgium / US), Firecrawl (US) and Brave Search (US) - prospect research (company domains, names and search terms) (when used)
- •DigitalOcean (Toronto, Canada) - the server that carries calls from partner phone systems to the AI agent
- •Google APIs: Gmail / Calendar (US) - email and calendar sync for users who connect Google
- •Microsoft Graph: Outlook / Teams (US) - email, calendar, and meeting sync for users who connect Microsoft
- •Resend (US) - transactional email delivery
- •QuickBooks / Intuit (US) - accounting integration (when connected)
- •Firma.dev (European Union) - e-signature processing (when used)
- •Mailchimp (US) - email marketing lists (when connected)
- •Cal.com (US) - calendar scheduling (when connected)
- •Newton Velocity (Canada) - mortgage loan origination sync (mortgage broker template only)
- •ip-api.com (US) - IP-based geolocation (city, region, country) for locale configuration and security logging
- •Google Analytics / Google LLC (US) - website analytics (loads only after you accept our cookie banner)
- •Hotjar / Contentsquare (US / EU) - product-experience analytics and session replay (loads only after you accept our cookie banner)
- •Mixpanel (US) - product analytics and session recording (loads only after you accept our cookie banner)
We may also share information with:
- •Government authorities or other third parties, only in response to valid, legally binding process. Each request is reviewed by our President; we narrow or challenge requests that are overbroad, notify the affected customer before any disclosure unless the law prohibits it, disclose only the minimum required, and keep a record of every request.
- •Successors in the event of a merger, acquisition, or asset sale
We do NOT:
- •Sell your personal information to third parties
- •Share your data for third-party advertising without consent
- •Provide access to your business data to competitors
7. Cookies & Tracking Technologies
We use cookies and similar technologies for: • Essential cookies and first-party visit logging: Required for the site to function and to operate securely. • First-party aggregate measurement: We keep simple totals of how often key parts of a page are used, for example how many times an offer was shown, dismissed, or submitted on a given day. These are counts only. They include no IP address, no device or browser details, no identifier, and no cookie, and they cannot be traced back to you or to an individual visit. • Analytics and session-recording tools: We use Google Analytics, Hotjar (Contentsquare), and Mixpanel to understand how visitors use our site. Hotjar and Mixpanel may record session activity, including pages viewed, clicks, scrolling, and mouse movement. These tools are configured to mask text you enter into form fields. The analytics and session-recording tools listed above do not load until you accept our cookie banner. If you decline, they are not loaded. Essential cookies, first-party visit logging, and first-party aggregate measurement may still apply, because they are used to operate the site, keep it secure, and understand overall usage without identifying anyone. You can also manage cookies through your browser settings; disabling certain cookies may affect site functionality.
8. Data Security
We implement industry-standard security measures including: • SSL/TLS encryption for data in transit • AES-256 encryption for data at rest • Access controls and authentication requirements • Employee security training and confidentiality agreements While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but will notify you of any breach as required by law.
9. Data Retention
We retain your personal information for as long as necessary to: • Provide our services to you • Comply with legal obligations • Resolve disputes and enforce agreements When data is no longer needed, we securely delete or anonymize it. You may request deletion of your data at any time, subject to legal retention requirements.
10. Your Privacy Rights
Depending on your location, you may have the right to:
- •Access the personal information we hold about you
- •Correct inaccurate or incomplete information
- •Delete your personal information
- •Restrict or object to certain processing
- •Data portability (receive your data in a structured format)
- •Withdraw consent for marketing communications
- •Lodge a complaint with a supervisory authority
To exercise these rights, contact us at info@cxtrack.com. We will respond within 30 days.
11. International Data Transfers
CxTrack operates from Manitoba, Canada. If you are accessing our services from outside Canada, your information may be transferred to and processed in Canada or other jurisdictions where our service providers operate. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and compliance with applicable data protection laws.
12. Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
13. Third-Party Links
Our website may contain links to third-party sites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.
14. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via email or prominent notice on our website. Continued use of our services after changes constitutes acceptance of the updated policy.
15. Security, Geolocation & Anti-Scraping Measures
To operate our website securely, detect automated scraping, and protect our content, we use passive, defensive measures. These are separate from the optional analytics tools described above and are used only to run and protect the site: • We log request metadata for site visits, including IP address, browser type, referring page, and pages viewed. • We derive approximate location (city, region, country) from IP address using a third-party lookup service (ip-api.com). We do not use this to identify you personally. • Our pages carry invisible content-attribution markers and a faint per-session identifier so that copied or leaked material can be traced back to a session. This identifier is stored in your browser and is not linked to your personal identity. • Hidden trap links and honeypot paths detect automated crawlers that ignore our published crawling rules. A person browsing normally never encounters them. • We may alert our own team to unusual or automated activity, such as high-volume scraping. We use these measures solely to secure the site and protect our content. We do not use them to build advertising or marketing profiles about you, and we do not sell the data they generate.
16. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:
Stop Guessing. Start Automating.
Book a 30-minute call. We'll walk through your workflow and show you exactly how CxTrack fits your business.
