Privacy Policy

1.Introduction

Genellipse Inc. ("Genellipse," "we," "us," or "our") is committed to protecting the privacy and security of personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you access or use the GENECRM platform and related services (collectively, the "Services") at crm.genellipse.ai.

This Policy applies to all users of the Services, including account administrators, end users, and visitors to our website. By using the Services, you agree to the terms of this Privacy Policy.

This Privacy Policy is designed to comply with PIPEDA (Canada), Canada's Anti-Spam Legislation (CASL), the EU General Data Protection Regulation (GDPR), and other applicable privacy laws.

2.Information We Collect

2.1 Information you provide directly

• Account registration details: name, email address, company name, phone number, job title
• Billing and payment information (processed by third-party payment processors — we do not store full card numbers)
• Content you upload or create within the platform, including contact records, leads, accounts, deal information, notes, activities, and documents ("Customer Data")
• Communications you send to us, including support requests, feedback, and correspondence
• Information provided during demo or onboarding sessions

2.2 Information collected automatically

• Usage data: features accessed, actions taken, frequency and duration of use
• Log data: IP addresses, browser type and version, device type, operating system, referral URLs, timestamps
• Cookies and similar tracking technologies (see Section 6 below)
• API access logs, key usage analytics, and webhook delivery history

2.3 Information from third parties

• Data received through integrations you authorize (e.g., email or third-party data providers)
• Information from payment processors regarding subscription status
• Identity-provider information when you authenticate using single sign-on

2.4 Customer Data (your clients' information)

When you use GENECRM to manage your contacts, leads, and clients, you upload personal information about those individuals ("Customer Data"). Genellipse processes Customer Data solely on your behalf and in accordance with your instructions. You are the data controller of Customer Data; Genellipse is the data processor. You are responsible for ensuring you have the appropriate legal basis to share this data with us and that affected individuals are informed of its use.

3.How We Use Your Information

3.1 To provide and operate the Services

• Create and manage your account
• Process transactions and send related information (receipts, invoices)
• Deliver core CRM features including contact management, pipeline, automations, and AI tools
• Provide technical support and respond to inquiries
• Monitor platform performance and security

3.2 To improve the Services

• Analyze usage patterns and product engagement to improve features and user experience
• Conduct research and development on new features
• Train and improve AI models powering GENECRM's intelligence features (using aggregated and de-identified data where possible — see Section 4.3)

3.3 For communications

• Send transactional messages (account updates, security alerts, billing notifications)
• Send product updates, newsletters, and marketing communications (with your consent where required by CASL or other applicable law)
• Notify you of changes to these policies

3.4 Legal and compliance purposes

• Comply with applicable laws, regulations, and legal processes
• Enforce our Terms and Conditions
• Detect, investigate, and prevent fraud, abuse, or security incidents
• Respond to law enforcement requests where lawfully required

4.AI Features and Data Use

4.1 AI features overview

GENECRM includes AI-powered features such as a built-in AI assistant, predictive lead and deal scoring, and intelligent pipeline forecasting. These features help you derive greater insights from your CRM data.

4.2 How AI features process your data

When you use AI Features, your Input Data (data you provide or that exists in your account) is processed to generate Outputs such as predictions, suggestions, or summaries. Input Data may be processed by Genellipse's AI models or by vetted third-party AI providers, including Anthropic, operating under data processing agreements.

4.3 AI model training

Genellipse may use aggregated and de-identified data derived from platform usage to train and improve its AI models. Your individually identifiable Customer Data will not be used to train models that serve other customers without your explicit consent.

4.4 AI output disclaimer

AI Outputs are provided for informational purposes only and are not professional advice. You should independently verify AI Outputs before making business decisions.

5.How We Share Your Information

5.1 We do not sell your personal information

Genellipse does not sell, rent, or trade your personal information or Customer Data to third parties for their own marketing or commercial purposes.

5.2 Service providers

We share information with trusted third-party service providers who assist us in operating the Services, subject to confidentiality and data processing agreements. These include:

• Cloud infrastructure and hosting providers
• Payment processors
• AI and machine learning providers, including Anthropic, which powers GENE Copilot
• Email and communication platforms
• Analytics and monitoring services
• Customer support platforms

5.3 Business transfers

In the event of a merger, acquisition, sale of assets, or other corporate reorganization, your information may be transferred to the successor entity. We will notify you of such transfers where required by law.

5.4 Legal requirements

We may disclose your information if required to do so by law or if we believe in good faith that such disclosure is necessary to comply with a legal obligation, protect and defend the rights or property of Genellipse, prevent fraud or illegal activity, or protect the personal safety of users or the public.

6.Cookies and Tracking Technologies

• Strictly necessary: Required for platform function (session authentication, security tokens). Cannot be disabled.
• Functional: Remember your preferences and settings to enhance your experience.
• Analytics: Help us understand how users interact with the Services. Data is aggregated and anonymized where possible.
• Marketing: Used for targeted advertising (only with your consent where required by law).

You can control cookie preferences through your browser settings or the cookie consent tool on our website. Disabling certain cookies may affect platform functionality.

7.Data Retention

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account data: Retained for the duration of your subscription plus a reasonable period for legal compliance.
• Customer Data: Retained for the duration of your subscription; deleted within 90 days of account termination (or earlier upon request).
• Logs and usage data: Typically 12 months, after which aggregated or deleted.
• Encrypted backups: May persist for up to 90 days.

8.Data Security

Genellipse employs industry-standard technical and organizational measures to protect your data, including:

• Per-tenant data isolation using PostgreSQL row-level security (RLS), ensuring your data is never accessible to other tenants
• Encryption of data in transit (TLS 1.2+) and encryption of sensitive secrets at rest
• Comprehensive audit logging of data access and change events
• Role-based access controls (RBAC) with granular permissions
• API key rotation and usage analytics per key
• Multi-factor authentication (TOTP) available for all users
• An incident response plan with notification obligations as required by law

No system is completely secure. While we take all commercially reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

9.Your Privacy Rights

9.1 Rights under PIPEDA (Canadian users)

Under PIPEDA, you have the right to access, correct, and withdraw consent to the collection of your personal information (subject to legal and contractual restrictions), and to file a complaint with the Office of the Privacy Commissioner of Canada.

9.2 Rights under GDPR (EU/EEA users)

If you are located in the EU/EEA, you have the following additional rights:

• Right of access (Article 15 GDPR) — request a copy of your personal data
• Right to rectification (Article 16 GDPR) — correct inaccurate or incomplete data
• Right to erasure / 'right to be forgotten' (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR) — receive your data in a portable format
• Right to object to processing (Article 21 GDPR)
• Right to lodge a complaint with your local supervisory authority

GENECRM's built-in GDPR Export & Deletion tools allow you to fulfill data subject requests directly from the platform.

9.3 Exercising your rights

To exercise any of the above rights or submit a data subject access request, contact us at admin@genellipse.com. We will respond within the timeframes required by applicable law (generally thirty (30) days, with possible extensions where permitted).

10.International Data Transfers

Genellipse is headquartered in Canada. If you access the Services from outside Canada, or if your Customer Data relates to individuals in other jurisdictions, your information may be transferred to and processed in Canada or other countries where our service providers operate.

For transfers of personal data from the EU/EEA, Genellipse relies on appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission. Contact us at admin@genellipse.com for more information.

We do not currently offer region-pinned data residency. If your organization has a residency requirement, raise it with our team before you sign so we can be clear about what we can and cannot commit to.

11.Children's Privacy

The Services are not directed at or intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

12.Links to Third-Party Services

The Services may contain links to third-party websites, integrations, or applications. Genellipse is not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with GENECRM.

13.Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Posting the updated Policy at crm.genellipse.ai/legal/privacy with a revised Effective Date
• Sending an email notification to the address associated with your account
• Displaying an in-platform notification

Your continued use of the Services after such notification constitutes your acceptance of the updated Policy.

14.Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at admin@genellipse.com or visit us at crm.genellipse.ai.

If you are unsatisfied with our response, you have the right to lodge a complaint with the applicable privacy regulator in your jurisdiction — for example, the Office of the Privacy Commissioner of Canada, or your EU/EEA supervisory authority.