← Back to home

Privacy Policy – Simple CRM

Last updated: May 12, 2026

Simple CRM (“the extension”) is a Gmail-native CRM tool designed to help users manage contacts, track opportunities, and run mail merge campaigns using Google Sheets and the Google Apps Script Mail service.

We take privacy seriously and collect only the minimum data required for the extension to function. We do not operate a proprietary backend server for storing or processing user email data.

1. Data We Access (Google OAuth)

The extension uses Google OAuth to access specific data. We do not request full Gmail API scopes; instead, we adhere to the principle of "Least Privilege":

• Google Sheets (.../auth/spreadsheets): Used to read and write CRM records, opportunity notes, and campaign results in spreadsheets you designate.
• Google Drive (.../auth/drive.file): Used strictly to create and edit specific files (such as CRM databases or Team Reports) created by the extension.
• User Identity (.../auth/userinfo.email): Used to identify your account for subscription management via ExtensionPay.
• Google Apps Script Mail Service (.../auth/script.send_mail): Used solely to execute mail merge campaigns that you manually trigger. This allows the extension to send emails via Apps Script without requiring access to your full Gmail inbox history or API.

2. Gmail Integration & "Email Summary"

The extension provides features inside your Gmail browser tab to help associate active email threads with CRM records.

• Tab-Only Context: We do not use Google’s Gmail API to read your inbox. Gmail-related features read only what is rendered in the active, open browser tab when you interact with the extension.
• Local Processing: The "Email Summary" feature uses rule-based logic to strip signatures and disclaimers to create concise notes. This processing is performed locally within your browser; email content is never transmitted to our servers or third-party AI APIs.
• Intent Detection: The extension may scan the active thread for keywords (e.g., "meeting") or time-based phrases (e.g., "next week") to suggest follow-up actions. This analysis happens entirely on your device.

3. Google API Limited Use Disclosure

Simple CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do NOT use user data for advertising, data brokering, or training AI models.

4. Data Storage

• Local Device Storage: The extension stores CRM metadata, settings, and duplicate protection hashes using chrome.storage.local. This data remains on your device.
• Google Sheets: Your primary CRM data—including contacts, opportunities, and team reports—is stored within specific Google Sheets files that you control.

5. Mail Merge Mechanism

Test and live mail merge sends are only initiated when you explicitly click the corresponding buttons. Because we use the script.send_mail scope, the extension cannot search, delete, or modify your existing Gmail messages.

6. Data Sharing & Third Parties

Data is not sent to any proprietary servers. Information is only exchanged over encrypted HTTPS connections with Google APIs (for CRM functionality) and ExtensionPay/Stripe (for subscription management) when you trigger a feature that requires them.

7. Payment Processing

We use ExtensionPay and Stripe to manage subscriptions.

• When you subscribe, ExtensionPay stores your email address and payment status.
• We never see or store your financial details; all transactions are handled securely by Stripe.
• See the ExtensionPay Privacy Policy for details.

8. Export and Deletion

• Export: You can export your CRM data as a JSON file via the extension Settings at any time, or access it directly via your associated Google Sheets.
• Deletion: Uninstalling the extension removes locally stored metadata from the browser. Google Sheets and Drive files remain in your account until you manually delete them.

9. Security

The extension uses Google-approved OAuth2 protocols and Chrome’s secure storage APIs. All communication is encrypted using industry-standard HTTPS.

10. Contact Information