Privacy Policy

1. Data controller

Arya-Crm ("we", "the Platform") is a real-estate CRM available at https://arya-crm.com. For any question about this policy or about how your personal data is processed, contact us at [email protected].

2. Data we collect

• Account data: full name, email address, password (stored encrypted) and your company details.
• Business data: the information you or your team record in the Platform (properties, clients, activities, sales and finances).
• Technical data: the session cookie required for authentication and technical access logs.
• Google Calendar data: only if you voluntarily connect your Google account (see section 3).

3. Google Calendar integration

The Platform offers an optional integration with Google Calendar. If you choose to enable it, the following terms apply:

• Access (raw data): with your explicit authorization via OAuth 2.0, the app requests only https://www.googleapis.com/auth/calendar, openid and email. This lets us read the email of the connected Google account, list your calendars (to skip holiday, birthday and subscribed calendars) and read, create, modify and delete events on those calendars. We do not access Gmail, Drive, Contacts, Photos or Tasks.
• Aggregated or anonymized data: we do not build aggregated or anonymized datasets from Google user data for advertising, third-party analytics or model training.
• Use: we use this data only for the user-facing feature of syncing CRM visits, calls and tasks with your Google Calendar, and importing relevant events into the Platform agenda. A change created or deleted in the CRM is reflected in your Google account, and an event created in Google appears in the CRM.
• Storage and protection: we store encrypted OAuth tokens, the connected Google account email and the identifier of each synchronized event (google_event_id). Traffic uses HTTPS. We do not store the full contents of your calendar.
• Transfer: Google API data is not sold, rented or shared with data brokers, advertisers or third-party AI services. It may only be processed by our infrastructure providers (hosting and database) under confidentiality and solely to operate the CRM, or by a competent authority if required by law.
• Retention and deletion: tokens and sync metadata are kept only while the connection is active. If you disconnect Calendar, request account deletion, or revoke access at myaccount.google.com/permissions, we delete those tokens and stop accessing your Google account.
• Limited Use: the use of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for targeted advertising, lending, or to develop, improve or train generalized AI/ML models, and we do not transfer it to third-party AI services.

4. How we use information

We use the collected data to:

• Provide, operate and maintain the CRM service.
• Authenticate your identity and protect your account.
• Provide technical support and respond to your requests.
• Send service-related operational communications.
• Improve the CRM using account and business data you enter. This does not include data received from Google APIs.

5. Cookies

We use a single session cookie (crm_inmo_token) that is strictly necessary to keep you signed in. We do not use third-party cookies for advertising or tracking.

6. Data sharing

We do not sell or rent your personal data. We may only share information with infrastructure providers (hosting and storage) that process it under confidentiality obligations and exclusively to operate the service, or when required by a competent authority in accordance with the law.

7. Security

We apply reasonable technical and organizational measures to protect your data: encryption in transit (HTTPS), securely hashed passwords, per-company access control and regular backups. No system is 100% infallible, but we continuously work to protect your information.

8. Data retention

We keep your data while your account remains active. If you request account deletion, we will delete or anonymize your information within a reasonable timeframe, unless the law requires longer retention.

9. Your rights

You may exercise your rights of access, rectification, deletion, portability and objection to the processing of your personal data by writing to [email protected]. We will respond within a reasonable timeframe.

10. Changes to this policy

We may update this Privacy Policy from time to time. The current version will be published on this page with its update date. If changes are significant, we will notify you within the Platform.

11. Contact

For any question about this Privacy Policy or about how your data is processed, contact us at [email protected].