Draft pending legal review
Privacy Policy
1. Who is responsible for your data
EDGE CRM is a CRM and shared inbox for sales teams, provided by EDGE, Nasr City, Cairo, Egypt («EDGE», «we»).
- Our business customers (the «Business») connect their own Facebook Pages, Instagram accounts and WhatsApp numbers to EDGE CRM. The Business decides why and how the personal data of the people who message it is used, so the Business is the controller of that data.
- EDGE runs the software on the Business's behalf and on its instructions only. For that data EDGE is the processor, under a data processing agreement with the Business.
- EDGE is the controller only of the small set of data it keeps for itself: the Business's account and billing contact, and security logs of our servers and website.
Contact: info@edgexcrm.net.
2. Whose data this covers
- People who contact a Business through WhatsApp, Facebook Messenger or Instagram messages to the Business's connected pages, accounts and numbers, and people whose details a Business enters by hand or imports.
- The Business's staff who sign in to EDGE CRM (agents and administrators).
3. What we collect, and where it comes from
From Facebook, Instagram and WhatsApp (Meta)
When a Business connects a channel and a person writes to it, Meta sends us, through its official APIs:
- the identifier of the connected Facebook Page, Instagram account or WhatsApp business account and number;
- the sender's identifier on that platform and the profile name the platform shows (and, for WhatsApp, the phone number);
- the content of the messages: text, and the photos, voice notes, files and other attachments exchanged, with their time and delivery status;
- if the person wrote after tapping an ad or a post: the details the platform sends with the first message (such as the ad identifier, ad title and click identifier);
- the access tokens the Business grants us so that we can receive and send messages for its channel. These are stored securely and used only for that purpose.
We do not ask for health, religious, political or biometric data, and the service is not designed to hold it. We do not collect your Meta password.
From the Business and its staff
- Contact and sales record: name, phone number, notes, comments, follow-up dates, sales stage, products or programmes of interest, bookings, and agreed and paid amounts, entered by the Business's staff or imported by them.
- Staff data: sign-in email, full name, role, online status and last activity, which leads a staff member handled and changed, internal team messages, and in-app notifications.
- Staff devices: a notification token, device identifier, platform and app version for each phone or browser that turned on notifications.
Generated by the service
- Message arrival records: the identifier and time of each message (no text), used for counts.
- Change history: who changed a lead, profile or setting, when, and the old and new values. When a record is deleted, the history keeps a copy for a limited time (see section 7).
- Server logs: IP address, time and the page or file requested when someone opens our website or the application.
4. Why we use it
We use the data only to provide EDGE CRM to the Business:
- to show and answer business messages inside the CRM: receive the messages people send to the Business on WhatsApp, Messenger and Instagram, display them to the Business's staff, and send the staff's replies back through the same channel;
- to share incoming conversations among the Business's staff and remind them to follow up;
- to keep the Business's sales record (leads, stages, bookings, payments);
- to notify staff on their phone or browser (a notification can show the sender's name and the first part of the message, unless the Business turns message text off);
- to keep the service secure, investigate faults and keep a change history;
- to make encrypted backups.
We do not use the data for advertising, we do not sell it, we do not build profiles for anyone other than the Business, and we do not use it to train AI models. Data received from Meta is used only to operate the features described above.
Legal basis: performing our contract with the Business, the Business's own lawful basis (for example the consent or legitimate interest it relies on to answer people who write to it), and our legitimate interest in keeping the service secure. The applicable law is the laws of the Arab Republic of Egypt.
5. Who can see it
- The Business's staff, according to their role: agents see the conversations of the inboxes they belong to and the leads assigned to them; administrators see the Business's whole record.
- Not other businesses. Each Business's records carry its own key and the database refuses reads and writes across businesses.
- EDGE personnel with technical access are limited to what is necessary to run and support the service.
- Service providers that host or carry the data for us (section 6).
- Authorities, only when the law requires it.
6. Who we share it with (sub-processors) and where it is stored
We share data only with the providers needed to run the service. Each acts on our instructions under a contract.
| Provider | What it does | Location |
|---|---|---|
| Namecheap, Inc. | Runs the application and the messaging system that holds messages and files | Data centre location to be listed here before any customer data is processed |
| Supabase | Hosts the database (records, sign-in, files) | Frankfurt, Germany (EU) |
| Cloudflare, Inc. | Protects and routes connections; stores encrypted backups | Global network (United States company) |
| Browser push services (Google, Apple, Mozilla) | Delivers notifications to staff phones and browsers | Global |
Meta (Facebook, Instagram, WhatsApp) is the channel through which messages travel; its own terms and privacy policy apply to what it does with your data on its platforms. The data may be stored and processed outside your country; where the law requires, we rely on the safeguards it provides for such transfers.
7. How long we keep it
| Data | Kept |
|---|---|
| Conversations, messages, files, contact record and sales record | As long as the Business uses the service, unless the Business deletes them earlier |
| Message arrival records (ids and times) | 400 days |
| In-app notifications | Read ones 30 days, all 90 days |
| Change history (including a copy of deleted records) | 365 days |
| Staff device registrations for notifications | Deleted after 60 days unused, or as soon as the device stops accepting notifications |
| Server access logs (IP addresses) | 90 days |
| Encrypted backups | 35 days |
| After the Business stops using the service | Exported to the Business on request, then deleted |
8. Your rights
Depending on the law that applies to you, you may ask to know what data is held about you, get a copy, correct it, have it deleted, object to or restrict its use, and withdraw consent. Because the Business decides how your data is used, please ask the Business first; if you write to us, we pass your request to the Business and help it answer within 30 days.
9. Deleting your data
See our Data Deletion Instructions. In short: email info@edgexcrm.net with the subject Data deletion request. Copies in the change history and in encrypted backups are removed when they expire (section 7). Businesses can also disconnect a channel at any time from their inbox settings, and when a Business leaves the service its data is exported to it and then deleted.
10. How the data is protected
- each Business's data is separated by the database itself;
- connections are encrypted in transit (TLS);
- staff sign in by personal invitation; there is no open sign-up;
- roles limit what each staff member can see and do;
- a change history is kept;
- backups are encrypted.
No system is perfectly secure. If we learn of a breach affecting your data, we tell the Business without undue delay and within 72 hours, and the Business informs the authority and you where the law requires.
11. Children
EDGE CRM is a business tool and is not directed to children. Businesses are responsible for how they use it with minors.
12. Changes
We publish any change to this policy on this page, with the date at the top.
13. Contact
EDGE, Nasr City, Cairo, Egypt, phone +20 101 986 5875, email info@edgexcrm.net.