Privacy policy

Last updated October 24, 2026

99 CRM is a customer relationship management service operated by apphero Tech LLC ("apphero", "we"). This policy explains which data 99 CRM handles, why, and the choices each person has.

Data we process

• Account data: the work email address used to sign in, the organizations a person belongs to and their role.
• CRM data: the records an organization keeps in 99 CRM (leads, contacts, accounts, deals, activities) and the records 99 CRM reads from or writes to the CRMs the organization connects, such as Salesforce, Zoho CRM or Lofty.
• Google Workspace data: when a person connects their Google account, 99 CRM reads their Google Calendar events and Gmail messages (sender, recipients, subject, date and the opening lines), read only.
• Requests to the AI: the sentences a person types in 99 CRM and the records needed to answer them.

How we use Google user data

99 CRM uses Google Calendar and Gmail data for two purposes, both for the person who connected the account and their organization's customer records:

• Answering requests: finding a meeting, an email or what was agreed with a contact, alongside the CRM records. This data is read at the moment of the request and is not stored.
• Keeping customer records up to date: every quarter of an hour, 99 CRM notes on the organization's records the emails exchanged with its leads, contacts and clients (direction, subject, date and opening lines), and adds a follow-up task after each meeting with them. These notes are stored with the records and visible to the members who can see those records. 99 CRM asks the mailbox only for the emails exchanged with the addresses the organization's CRM holds, and notes only the meetings those people attend: the rest of the mailbox and calendar is neither fetched nor stored.

Disconnecting the account stops both. Notes already made stay with the organization's records.

99 CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to serve advertising, not sold, not used to train or improve artificial intelligence models, and not read by any person at apphero except with the user's explicit consent for support, for security purposes, or to comply with the law.

Artificial intelligence

To answer a request, 99 CRM sends the request and the data needed to answer it to the AI provider the organization chose and connected with its own key (Anthropic or OpenAI). These providers process the data under their commercial API terms, which exclude training on it.

Sharing

We share data only with the service providers that run 99 CRM (Cloudflare for hosting, the AI provider an organization chooses, and the email service that delivers sign-in codes), each bound to process it on our instructions. When an organization connects a CRM that 99 CRM writes to, such as Lofty, 99 CRM sends that CRM the leads, notes and follow-ups its members record in 99 CRM, on the organization's instruction. We do not sell personal data.

Security and retention

Data is encrypted in transit and at rest. The access granted by Google, Salesforce, Zoho or Lofty is stored as an encrypted token that only 99 CRM's servers can open. Disconnecting an account in Setup deletes the token and, where the provider allows it (Google, Salesforce, Zoho), revokes the access at the provider; Lofty offers no such revocation, so the agent also removes 99 CRM in Lofty's settings. An organization's data is deleted within 30 days of the end of its subscription.

Your choices

Each person can disconnect Google Workspace at any time in Setup, Connectors, Calendar & email, or from their Google account's third-party access page. To access, correct or delete personal data, write to jerome@apphero.tech.

Changes

We will post any change to this policy on this page and update the date above.