Privacy policy

ButlerCRM ("Butler", "we", "us") is a workspace for teams to manage contacts, deals, projects, email, calendars and AI agents. It is run by Ingenious Digital LLC at butlercrm.com. This page explains what information Butler handles, why, who else receives it and the choices you have. It describes Butler as it works today; when Butler changes, this page changes with it.

Questions or requests: mati@ingeniousdigital.com.

Your workspace and our role

Butler is organised into workspaces. The organisation that owns a workspace decides who joins it and what goes into it, and workspace owners and admins control its settings, connections and agents. We process workspace content to provide Butler to that organisation and its members.

Information we collect

Account information: your name, email address and password (stored only as a one-way hash), and optionally a phone number, profile photo, time zone and language.
Workspace content: what you and your team put into Butler, such as contacts, companies, deals, tasks, notes, documents, files, chat messages, calendar events, emails and the work agents do for you.
Calls: when your workspace holds calls in Butler and turns on call notes, the call's transcript and a summary are stored in the workspace.
Information from accounts you connect: described in the next two sections.
Public business information: the lead finder collects public business listings (such as a business's name, address, phone number and website from Google Maps) when a workspace member runs a search.
Technical information: the server records requests (time, page, response status and duration, and which account and workspace made the request) to run and secure the service.

Butler has no advertising, no third-party analytics scripts and no tracking cookies on its pages.

Google user data

Butler connects to Google only when you or your workspace choose to. Each connection asks Google for your consent on Google's own screen.

Sign in with Google and the Google integration

Under Settings, Integrations you can connect your Google account. Butler asks for your basic profile and email address, Google Calendar (calendar, calendar.events) and Gmail (gmail.readonly, gmail.send, gmail.modify). Butler uses them to:

sign you in;
show and sync the events in your primary calendar for the next 30 days, and create or update the events you schedule in Butler;
when your workspace turns on mailbox sync, copy recent messages from your inbox into the workspace and link them to the matching contacts, so your team sees the conversation history;
send the emails you write, or approve, in Butler from your Gmail address;
for support teams, have the support agent read a customer's thread and write a suggested reply into an existing Gmail draft, which a person reviews and sends from Gmail;
draft replies and summaries when you ask for them (see AI features below).

Gmail connector (read-only)

Under Connections a workspace owner or admin can connect a mailbox with the read-only scope gmail.readonly. Butler can then search mailbox messages, read messages and threads and list labels, only for the agents the admin gives access to, only when one of those agents does a task. The connector cannot send, delete or change email. It runs in an isolated container that can reach only Gmail.

Google Meet

When a workspace uses Google Meet for its calls, Butler can read the meeting space and its transcript (meetings.space.readonly, drive.meet.readonly) for calls you hold through Butler, to file notes and a summary with the call.

Google Play Console

A workspace can invite a Butler-owned Google service account to its Play Console with read-only permissions. Butler then reads app releases, ratings, reviews, crash rates and reports to show them on the Apps page. It does not change anything in Play Console.

How we treat Google user data

We use it only to provide and improve the features described above, which you can see in Butler.
We send it to others only as needed to provide those features (for example, to the AI provider that writes a draft you asked for), when the law requires it, or as part of a merger or sale with notice to you.
We never sell it, never use it for advertising and never use it to build profiles for anyone else.
We do not use it to develop, improve or train AI or machine-learning models.
Our staff do not read it, except with your permission for specific messages (for example when you ask for support), when needed for security or to investigate abuse, or when the law requires it.

Butler's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy , including the Limited Use requirements.

Disconnecting Google

Disconnecting in Butler deletes the stored Google tokens and stops all further access. For the Gmail connector, Butler also revokes the access with Google. You can remove Butler's access at any time at myaccount.google.com/permissions. Email and events already copied into a workspace stay there until the workspace deletes them or asks us to (see Keeping and deleting data).

Other accounts you connect

A workspace can also connect Zoom, GitHub, Slack, Shopify, Stripe, Klaviyo and n8n. Butler reads from them what that connection is for (for example, orders and products from Shopify, or pushes and pull requests from GitHub). Changes in those accounts (for example a Stripe refund) happen only after a person in the workspace approves them. Keys and tokens for these accounts are stored encrypted and never shown again after you enter them.

Instagram (read-only, through Composio)

A workspace can connect an Instagram Business or Creator account. You sign in on a page run by Composio (Composio, Inc.), which holds the account's Instagram access on Butler's behalf and makes Butler's requests to Instagram. Butler stores only a reference to that connected account, never an Instagram password or token. What passes through Composio: the requests Butler makes and what Instagram returns for them, which is the account's profile and counts, its posts, their insights, and the comments and replies on them. Butler gives Composio an identifier it derives from the workspace and the connection, not your name or email. Butler only reads: nothing is posted, answered or sent from Butler, and direct messages are never read. When the account is disconnected, Butler asks Composio to delete the connected account and revoke its Instagram access.

AI features

Butler's AI agents, drafting, summaries and search send the content needed for each request (for example the email thread you want a reply to, or a contact's recent history) to an AI model provider and return the result to you. We use MiniMax and Alibaba Cloud Model Studio (DashScope). DashScope also turns workspace records into search indexes and, when call notes are on, transcribes call audio. A workspace admin can instead point Butler's AI at another provider using the workspace's own account with that provider; that provider then receives the content under the workspace's own agreement with it. Agents cannot send email, publish or change connected accounts without a person's approval.

We share information only as described here:

Hosting: Butler runs on servers we operate, rented from Contabo, which also stores our backups and call recordings.
Email delivery: account and notification emails go out through a mail server we operate.
AI providers: MiniMax and Alibaba Cloud (DashScope), as described above.
Media generation: if your workspace uses Content Studio, image, video and speech requests go through our media service to MiniMax and, for some formats, WaveSpeed.
Composio: if your workspace connects Instagram, Composio holds that account's access and carries Butler's read requests to Instagram and the answers back, as described above.
Services you connect: Google, Zoom and the other accounts your workspace connects receive the requests Butler makes to them on your behalf.
Operational telemetry: PostHog receives counts and timings of Butler's internal service calls. It receives no workspace content and nothing that identifies you.
Legal reasons: when the law requires it, or to protect the rights and safety of Butler's users or the public.

We do not sell personal information.

Cookies and local storage

Session cookie (_igdcrm_key): keeps you signed in. It is encrypted and signed.
Remember-me cookie: set only when you choose "Keep me signed in", and expires after 14 days.
Local storage: remembers display choices in your browser, such as theme and which menu sections are open.

Native desktop storage

The native desktop app keeps its workspace access token in your operating system's credential store. On that computer, app settings keep the selected server address, workspace and user names, and token-expiry metadata. Updated desktop connections also keep the workspace identifier and a hash used to match the stored token to that workspace and server. This hash is not an access token and is not sent to web pages or other services. Signing out removes the stored token and identity metadata, including that hash; the server address remains for your next sign-in.

Security

All traffic uses HTTPS.
Passwords are hashed. On the server, Google and other access tokens, API keys and connection credentials are encrypted with AES-256-GCM before they are stored. Native desktop access tokens use the operating system's credential store.
Each workspace's data is separated in the database, and people see records according to their role in the workspace.
The Gmail, GitHub, Slack and Shopify connectors run in isolated containers that can reach only their own service.

Keeping and deleting data

We keep account and workspace information for as long as the account or workspace is active. Workspace members can delete records in Butler at any time. To delete your account or a whole workspace, email mati@ingeniousdigital.com; we confirm the request with the account or workspace owner and complete it within 30 days. Deleted data can remain in backups for a limited time until those backups are replaced. Service status history is kept for 35 days.

Your choices and rights

You can see and correct your account details under Settings and disconnect any account you have connected. You can ask us for a copy of your information, to correct it or to delete it by emailing mati@ingeniousdigital.com. If your information is in a workspace that another organisation owns, we may refer your request to that organisation.

Children

Butler is a business tool and is not meant for anyone under 16.

Where data is processed

Our servers and the providers above may process information in countries other than yours, including the United States, the European Union and Singapore.

Changes to this policy

We update this page whenever Butler changes what it collects, where it sends information or what it asks Google for, and the date at the top changes with it. If a change affects how we use data you already gave us, including Google user data, we will tell you and ask for your consent first.

Contact

Ingenious Digital LLC, mati@ingeniousdigital.com.