Privacy Policy

1. Two kinds of data

YOUR data, as a visitor or customer: name, company, phone, email, what you filled in the form and where you came to the site from.

YOUR CUSTOMERS’ data, which you enter into the system yourself: contacts, messages, tasks, files. For these you are the controller and we merely process them on your behalf, on your instructions. We do not use them for any other purpose.

2. What we collect on this site

From the demo request form: name, company, phone, email, number of managers, and whether you are coming from another CRM.

Visit source: campaign parameters from the address (utm_source, utm_medium and similar) and the page you came from, if any. It is kept in your browser’s session storage until you submit the form.

The site does not use Google Analytics, Meta Pixel or other trackers, does not load fonts or scripts from third parties, and sets no advertising cookies. That is also why there is no cookie banner.

3. Why we use it

To answer your demo request and prepare an offer — the basis is performance of a contract, or steps taken at your request before entering one.

To issue invoices and keep accounting records — the basis is a legal obligation.

To keep the service running, prevent abuse and improve the product — the basis is our legitimate interest.

4. Where the data sits

On servers in the Republic of Moldova, operated by „IPHOST” S.R.L. Backups are taken daily and stay in the same space.

5. Who else can touch the data

We use providers that help us deliver the service. Each receives only what it needs and has no right to use the data for its own purposes:

Meta Platforms Ireland Ltd. — messages from WhatsApp, Facebook and Instagram

Telegram Messenger — messages from Telegram

Google Ireland Ltd. — files attached through Google Drive

artificial intelligence and speech-processing providers — through an API, only the message text or call audio needed for Glucose AI to reply or for speech to be transcribed, and only where these features are enabled. We send the exact list on request at support@glucose.md

the SIP telephony provider — calls and their recordings

the payment processor and the bank — billing data

„IPHOST” S.R.L. (Republic of Moldova) — server hosting

We do not sell data to anyone and do not share it for advertising.

6. WhatsApp, Facebook and Instagram

When you connect a WhatsApp Business number or a Facebook page to GlucoseCRM, we act as a Meta technical provider, while you remain the controller of your own conversations. You authorise the connection yourself and can break it at any time in Settings → Chats & messengers.

From Meta we receive, and store in your account: the customer’s phone number or identifier, the name they display, message content and attached files, the time of sending, and the delivery status (sent, delivered, read, failed). We use this only to show you the conversation inside the CRM and to deliver your reply.

We do not use WhatsApp, Facebook or Instagram data for advertising, do not sell it, do not combine it with other customers’ data, and do not train artificial-intelligence models on it. Every organisation is isolated at the database level.

Deletion: write to support@glucose.md and we delete the requested conversations within 30 days at the latest. Requests arriving through Facebook (“Delete my data”) are processed automatically and receive a tracking code. Once you disconnect the number or the page, we receive nothing further from Meta.

7. Google Drive, Google Calendar and Google Sheets

When you connect a Google account to GlucoseCRM, we request only the permissions the feature you turned on actually needs: the files you pick yourself or that the CRM creates (drive.file), the events of your own calendar (calendar.events), and your name, email address and profile picture, so we can recognise you when you sign in. We do not request access to the rest of your Drive and we do not read other calendars.

We use the data received from Google ONLY to do what you asked for: attach the file you chose to a lead, put your tasks in your calendar, import the rows of the sheet you point us to. We do not sell it, we do not use it for advertising and we do not show it to our other customers.

We do not use data received through Google APIs — neither raw nor derived — to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models. The AI features of the CRM work only on the data of your own account, at your request, and train no model on it.

GlucoseCRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

You can withdraw access at any time: in the CRM, under Market → Google Drive or Google Calendar → «Disconnect», or in your Google account, under Security → Third-party apps with account access. How the data imported from Google is deleted is described on the «Data deletion» page.

8. How long we keep it

Contact form data: up to 24 months from the last interaction, if you do not become a customer.

Account data and your customers’ data: for the term of the contract and a further 90 days after it ends, for export. Then it is permanently deleted.

Accounting documents: for the period required by the tax law of the Republic of Moldova.

9. How we protect it

Encrypted connection (HTTPS) on all traffic, passwords stored as cryptographic hashes, roles and permissions inside the account, isolation between organisations at the database level, daily backups, and an action log on every lead card.

The servers are hosted in the data centre of „IPHOST” S.R.L. (Republic of Moldova), which is certified to ISO/IEC 27001 for information security management. The certification belongs to the hosting provider and covers its infrastructure; it supports the measures required by personal data protection law (including the GDPR where it applies) but does not replace our own.

No system is perfect. If a breach occurs that may affect your data, we will notify you without undue delay.

10. Your rights

You may request access to your data, correction, deletion, restriction of processing, a copy in a portable format, or object to processing based on legitimate interest.

Write to support@glucose.md and we will answer within 30 days at the latest. If our answer does not satisfy you, you may contact the National Center for Personal Data Protection of the Republic of Moldova.

11. Changes

If we change this policy, the new version is published here and the date at the top is updated. Material changes are announced by email at least 30 days before they take effect, and if you disagree you may cancel the subscription before that date — the same rules as for changes to the Terms.