Privacy Policy

At BottleCRM, we believe in complete transparency about how we handle your data. As a self-hostable, open-source CRM, your privacy and data ownership are fundamental rights.

Information We Collect

Self-Hosted Deployments

When you self-host BottleCRM, we do not collect any of your business data, customer information, or usage analytics. All data remains on your servers under your complete control.

The Hosted App (app.bottlecrm.io)

If you use BottleCRM through our hosted app instead of running it yourself, RunCode Inc. stores what it needs to run it for you:

• Your account: your name and email address, and how you sign in (an emailed link or code, or Google).
• Your organization's CRM data: the leads, contacts, deals, tickets, invoices and other records you and your team add. Each organization's data is kept separate, and it is used only to provide the service to you.
• Security records: sign-ins, failed attempts and account changes, with the IP address and browser they came from, so we can protect accounts and look into abuse.
• Where you came from: the first time you open the sign-in page, a cookie notes any campaign tags in the link you followed and the name of the website that sent you (only the site's name, never the full address). When you create an organization, that is stored with it. Nothing else about you is recorded this way.

Payments for Hosted Plans

Paid plans on the hosted app are sold through Link, Stripe's merchant of record (Stripe Managed Payments). Stripe is the payment processor and Link is the reseller. When an organization admin buys a plan, Link processes the buyer's payment and contact details under Link's and Stripe's own privacy policies, which you can read at link.com/privacy and stripe.com/privacy. Link emails the receipts and invoices.

RunCode Inc. never sees or stores card numbers. For an organization with a paid plan, we store only:

• the Stripe customer ID and subscription ID;
• the plan, the subscription status and the billing period dates;
• the Checkout session ID.

Self-hosted BottleCRM has no billing, so none of this applies to it.

Cookies on the Hosted App

The hosted app sets only its own cookies: the ones that keep you signed in and remember which organization you are working in, short-lived ones that protect signing in with Google, and the "where you came from" cookie above, which lasts at most 30 days and is deleted once you create an organization. It sets no advertising or third-party tracking cookies.

Website Analytics (bottlecrm.io only)

• Basic website analytics (page views, visitor count, referral sources)
• IP addresses (anonymized and not linked to personal identity)
• Browser type and device information (for optimization purposes)

Information You Provide

• Contact information when you reach out for support or inquiries
• Feedback and suggestions submitted through our channels
• Professional service requests and consultation details

How We Use Your Information

What We DO Use Information For:

• Responding to support requests and inquiries
• Improving our website and documentation
• Providing professional services when requested
• Communicating important updates about BottleCRM
• Running the hosted app and keeping accounts secure
• Keeping an organization's plan in step with its subscription
• Counting, in aggregate, how new organizations find BottleCRM and which first steps help them, so we can improve it
• Sending up to three getting-started emails in the first week after you create an organization, to the person who created it, with tips chosen by what is already set up. Each one has a one-click unsubscribe.

What We DON'T Use Information For:

• Selling or sharing with third parties
• Advertising, or sharing data with advertisers
• Tracking you across other websites, or building advertising profiles
• Any form of data monetization

Service providers that run parts of the hosted app for us, such as servers, file storage and email delivery, handle data only to provide those services to us. Payments are the exception: Stripe, our payment processor, and Link, Stripe's merchant of record, handle the buyer's payment and contact details for hosted plans under their own privacy policies, as set out under Payments for Hosted Plans above.

Alerts on the phone app, such as a lead assigned to you, are delivered through Google's Firebase Cloud Messaging. The alert's text, which can include a lead's name and where it came from, passes through that service to reach your device. You can turn these alerts off in the app at any time.

Data Storage & Security

Self-Hosted Security

When you self-host BottleCRM, you are responsible for implementing appropriate security measures. We provide documentation and best practices to help secure your installation.

• Use HTTPS/SSL encryption for web traffic
• Implement proper database security and access controls
• Regular security updates and patches
• Backup and disaster recovery procedures

Your Privacy Rights

Data Subject Rights (GDPR)

• Right to access your personal data
• Right to rectification (correction)
• Right to erasure ("right to be forgotten")
• Right to data portability

Self-Hosting Advantages

• Complete control over data location
• No third-party data sharing
• Compliance with local regulations
• Custom data retention policies

Contact Information

Open Source Transparency

Complete Transparency: As an open-source project, you can inspect our entire codebase to verify how data is handled, stored, and processed. This level of transparency is impossible with proprietary CRM solutions.

View Source Code