Privacy Policy

1.Two kinds of data

In short: Your account is ours to look after. The contacts and messages in your workspace are yours; we handle them only for you.

Account data is information about you as a Circlebase user: your name, email, sign-in and billing details. We decide how it’s used, so we are its “controller”.

Workspace data is what you and your team keep in Circlebase: contacts, companies, deals, leads, messages, notes and files. It usually includes personal information about your customers. Your organisation is its controller, and we process it only on your instructions, to provide the Service. If you are one of our customers’ contacts and want to see, fix or remove your data, please ask the business that holds it; we will help them.

2.What we collect

In short: What you give us at sign-up, what you put in your workspace, and basic technical data to keep it secure.

• Account: your name, email address and password (stored only as a secure hash), plus two-factor and passkey settings if you turn them on, your language and display preferences.
• Onboarding answers: optional answers about your business, role, team size, country, currency, time zone, goals and how you heard about us.
• Where you came from: the campaign tags in the link you followed (utm_source, utm_medium and similar) and the referring website, saved with your sign-up.
• Billing: your plan, number of paid people and invoices. Stripe collects your card details directly; we never see or store card numbers. If you cancel, the reason you choose and any comment are sent to Stripe.
• Workspace data: everything you and your team add, import or connect (see section 1).
• Technical and security data: your IP address and browser details for active sessions, and an activity log of who changed what in a workspace, with the IP address.
• Messages to us: what you write when you email us.

This website itself has no forms, no analytics and no tracking cookies.

3.Connected mailboxes and WhatsApp

In short: We only read and send what Circlebase needs: email with your contacts, and messages on your WhatsApp number. Never for ads.

When you connect a Google or Microsoft mailbox, you sign in with them and approve access. For Google we ask to read and send Gmail messages (gmail.readonly and gmail.send); for Microsoft, to read, write and send mail (Mail.ReadWrite, Mail.Send), plus your basic profile. We use this access only to:

• log emails between you and people who are already contacts in your workspace on their timeline (we don’t copy the rest of your inbox);
• send the emails you, your team or your sequences send from Circlebase;
• draft replies and summaries when you use the AI features.

Circlebase’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Gmail data for advertising, don’t sell it, don’t use it to train general AI models, and don’t let people read it unless you ask us to (for support), it’s needed for security, or the law requires it.

Mailbox and WhatsApp credentials are stored encrypted. WhatsApp works through your own WhatsApp Business number on Meta’s official Cloud API; messages and media sent to or from it are stored in your workspace. You can disconnect any mailbox or number at any time, which stops the access straight away.

4.How we use it

In short: To run Circlebase, keep it secure, bill you and talk to you about your account. We don’t sell data or show ads.

• to provide the Service you signed up for, including the features you turn on (contract);
• to keep accounts and data secure, prevent abuse and enforce our terms (legitimate interests);
• to bill you and keep financial records (contract and legal obligation);
• to send emails about your account: verification, security alerts, invitations, invoices and important changes (contract);
• to understand who uses Circlebase and improve it, using onboarding answers and where sign-ups came from (legitimate interests).

We don’t sell or rent personal information, we don’t share it for cross-context behavioural advertising, and we don’t look at workspace data except to provide support you ask for, to keep the Service secure, or when the law requires it.

5.AI

In short: AI features send the needed context to our AI provider to get an answer. Nobody trains models on your data.

When you use an AI feature (the assistant, reply drafts, summaries, first reads of leads, morning briefs), Circlebase sends the context it needs to our AI provider, currently Anthropic: for example the contact’s details and recent timeline, open deals and tasks, and your workspace playbook. The provider returns the answer and, under its commercial terms, does not use it to train its models. We don’t use your data to train AI models either.

Conversations with the assistant are saved in your workspace so you can come back to them. When a contact is permanently deleted, it is also removed from saved assistant conversations and briefs.

If you connect your own AI client (such as Claude or ChatGPT) over MCP, the data it reads is handled by that provider under your agreement with them.

6.Who helps us

In short: A short list of service providers, each getting only what it needs.

We use these providers to run Circlebase. Each may process personal information only to provide its service to us:

• Cloud hosting and storage: the servers, database, files and backups behind the app.
• Stripe: payments, invoices and tax.
• Anthropic: the AI features.
• Postmark: delivery of email sent from a workspace’s sending domain, and inbound replies.
• Cloudflare: hosting this website, and spam protection on hosted forms when a workspace turns it on.
• Google, Microsoft and Meta: only when you connect a mailbox or WhatsApp number, as described above.

We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of Circlebase, in which case this policy continues to apply to it.

7.How long we keep it

In short: While your account exists. Deleted records wait 30 days in Trash, then they’re gone.

• Account and workspace data: for as long as the account or workspace exists.
• Deleted records: kept in Trash for 30 days so they can be restored, then permanently deleted with their files.
• A deleted workspace: subscription cancelled at once; its data permanently deleted within 30 days.
• A deleted account: deleted at once, with any workspace you owned alone. Records you created in shared workspaces stay with those workspaces.
• Exports: download files are deleted after 7 days.
• Server logs: 14 days. Backups: up to 30 days.
• Invoices and billing records: as long as tax law requires.

8.Security

In short: Encryption in transit, encrypted credentials, two-factor sign-in, roles and an activity log.

The app runs only over HTTPS. Passwords are hashed; mailbox, WhatsApp and other connection secrets are encrypted; files are private and served only through short-lived signed links. You can turn on two-factor authentication or passkeys, give each person the role they need, and see every change in the activity log. AI and MCP access never goes beyond the role of the person who connected it.

No system is perfectly secure. If a breach affects your data, we will tell you without undue delay.

9.Cookies

In short: Only the cookies the app needs to work. No advertising or analytics cookies.

The app uses a few necessary cookies: one to keep you signed in (and a “remember me” cookie if you tick that box), one that protects forms against forgery, and preferences for your language, light or dark theme and the sidebar. This website sets none. Neither uses advertising or analytics cookies.

Hosted forms that a workspace protects with Cloudflare Turnstile load Cloudflare’s check, which processes the visitor’s IP address to stop spam.

10.People our customers message

In short: Unsubscribe links and STOP always work. Open and click tracking is off unless a workspace turns it on.

Bulk emails from Circlebase carry an unsubscribe link and a one-click unsubscribe header. Unsubscribing, or replying STOP (or إيقاف) on WhatsApp, marks you as do-not-contact in that workspace, and Circlebase won’t send its campaigns to you again. Tracking of email opens and link clicks is off by default; a workspace can turn it on for its bulk emails.

For anything else about your data in a workspace, contact the business that messaged you; it is responsible for it.

11.Your choices and rights

In short: See, export, fix or delete your data in the app, or email us. We answer within 30 days.

Most of this you can do yourself: edit your profile, export your personal data or your workspace, disconnect mailboxes and AI clients, and delete your account in Settings. Depending on where you live (for example the EU, UK or California), you may also have the right to access, correct, delete or port your data, to object to or restrict some uses, and to withdraw consent. Email info@circlebase.ai and we will respond within 30 days. We won’t treat you differently for using these rights.

If you’re unhappy with how we handled your request, you can complain to your local data protection authority.

12.International transfers

In short: Circlebase is a US company, so data may be processed in the US, with safeguards in place.

We and our providers may process data in the United States and other countries whose laws differ from yours. Where the law requires it, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.

13.Children

In short: Circlebase isn’t for anyone under 16.

Circlebase is a business tool for people 16 and older. We don’t knowingly collect information from children; if you think a child has signed up, tell us and we’ll delete the account.

14.Changes to this policy

In short: We’ll email you before important changes and update the date at the top.

When we change this policy we update the date at the top. If a change is important, we’ll email account holders before it takes effect.