MasterCRM Privacy Policy

Effective date: November 13, 2026

This Privacy Policy explains how MasterBorn, Inc. (“we,” “us”) collects, uses and protects information when you use MasterCRM (the “Service”), an AI-native CRM that helps organizations manage relationships with their contacts.

Data controller and developer. MasterBorn, Inc. is the developer of MasterCRM and the controller of account information. The app is at https://app.mastercrm.ai and our website is at https://mastercrm.ai.

1. Who this policy covers

The Service has two kinds of people in it:

• Users: staff and volunteers of an organization (our “Customer”) who sign in to the Service.
• Contacts: donors, alumni, members and other people whose records a Customer stores in the Service.

For Contact data, the Customer decides what is collected and why. We process it on the Customer’s behalf and under their instructions. If you are a Contact and have questions about your data, please reach out to the organization that holds your record. We will help them respond.

2. Information we collect

• Account information: name, email address, organization, role, and profile photo if you sign in with Google.
• Customer content: Contact records, gifts, payments, notes, imports, lists and anything else a Customer adds to the Service.
• Public information: to power features like the Signal Digest, we may gather publicly available information about Contacts and their employers (for example, news mentions, job changes, board seats, liquidity events, or whether an employer matches gifts).
• Payment information: if a Customer uses our payments features, payments are handled by our payment processor. We receive transaction details (amount, date, status), not full card numbers.
• Usage information: log data such as IP address, browser type, pages visited, and actions taken, used to keep the Service secure and working.
• Support communications: anything you send us when you contact support.

3. How we use information

• To provide, maintain and improve the Service.
• To authenticate users and keep accounts secure.
• To run the features a Customer turns on, including AI-assisted search, chat, summaries and signal detection.
• To send service emails, such as invitations, receipts, security alerts and product updates.
• To respond to support requests.
• To meet legal obligations and enforce our Terms of Service.

We do not sell personal information. We do not use Customer content to train AI models, ours or anyone else’s.

We may create de-identified and aggregated data from Customer content and Service usage, and use it to improve our products and share insights such as benchmarks and trends. This data does not identify any Customer or individual.

4. How we share information

• Service providers: we use trusted vendors for hosting, databases, email delivery, payment processing, data enrichment and AI processing. They may only use the data to provide services to us. The categories and named vendors are listed under Subprocessors below.
• Within your organization: other users in your Customer’s workspace can see data based on their permissions.
• Legal reasons: when required by law, or to protect the rights, safety or property of our users, Customers or the public.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, data may transfer as part of that deal, subject to this policy.

Subprocessors

We currently use these subprocessors to run the Service:

• Cloudflare: hosting, network, and email delivery.
• Neon: database hosting and authentication (Neon Auth, which runs the sign-in flow).
• Google: Gemini AI models, used through Cloudflare AI Gateway for AI features.
• Exa: public web search for data enrichment.
• Langfuse: AI observability and tracing.

We also use a payment processor for payments features. For a current list of subprocessors, email support@mastercrm.ai.

5. AI features

Some features send Customer content to AI model providers to generate answers, summaries or suggestions. These providers process the data only to return results to us. Customer content sent to AI providers is not used to train their models. AI output can be wrong, so please review it before acting on it.

6. Google user data

MasterCRM offers “Sign in with Google” only. Google sign-in is handled by our authentication provider, Neon Auth (Neon Inc.), which runs the OAuth flow and stores your identity for us. This section describes how MasterCRM accesses, uses, stores, shares and deletes Google user data.

Data we access

We request only these Google OAuth scopes: openid, email and profile. From Google, we receive:

• your Google account ID (a unique identifier for your Google account);
• your name;
• your email address;
• whether Google has verified your email address;
• your profile photo URL.

We do not request Gmail, Google Calendar, Google Drive, Google Contacts or any other Google API scope.

How we use it

We use Google user data only to provide and improve user-facing features of MasterCRM:

• to create your account and sign you in;
• to show your name and photo in the app and to teammates in your workspace;
• to send service emails, such as invitations and security alerts.

We never use Google user data for advertising, sell it to data brokers or resellers, use it for credit-worthiness or lending decisions, use it to create databases, or use it to train generalized or non-personalized AI or machine learning models.

How we store and protect it

Google user data is stored in our Postgres database, hosted by Neon on AWS in the United States, and is linked to your user account. We protect it with:

• TLS encryption in transit and encryption at rest;
• least-privilege access for staff and systems;
• tenant isolation with row-level security, so one workspace cannot read another’s data;
• monitoring of our systems for misuse and unauthorized access.

How we share it

We share Google user data only with:

• Neon (authentication and database hosting) and Cloudflare (hosting, network and email delivery), as service providers under contract, and only to provide the Service;
• teammates in the same workspace, who can see your name, email address and photo;
• authorities, when required by law;
• a buyer or successor, in a merger, acquisition or sale of assets, under the same protections as this policy.

We do not sell Google user data, and we do not share it with AI model providers.

Retention and deletion

We keep Google user data while your account is active. To delete it, email support@mastercrm.ai from the address on your account and ask us to delete your account. We delete the data within 30 days of your request. Backups roll off within 90 days.

You can revoke MasterCRM’s access at https://myaccount.google.com/permissions. Revoking access stops future sign-ins with Google. It does not delete existing account data, so if you also want your data deleted, request deletion as described above.

Limited Use and AI

MasterCRM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train non-personalized or generalized AI or machine learning models, and it is not sent to AI model providers.

7. Data retention

We keep Customer content for as long as the Customer’s account is active. After an account is closed, we delete or anonymize Customer content within 90 days, unless the law requires us to keep it longer. Backups are overwritten on a rolling schedule. Customers can export their data before closing their account or at any time during those 90 days.

8. Security

We use industry-standard safeguards, including encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach affecting your data, we will notify the affected Customer as required by law.

9. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to certain uses. Users can update most account details in the Service. For other requests, email support@mastercrm.ai. If you are a Contact, we will forward your request to the organization that holds your record.

10. Children

The Service is meant for adults working for or volunteering with organizations. We do not knowingly collect information from children under 13. Customers are responsible for getting any consent required to store information about minors.

11. International transfers

We are based in the United States, and Customer content is stored in the U.S. Some of our providers may process limited data in other countries. Where required, we use appropriate safeguards for these transfers.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify users by email or in the Service before they take effect. The effective date at the top shows when it was last updated.

13. Contact us

MasterBorn, Inc.
1313 16th Ave S, Nashville, TN 37212
support@mastercrm.ai