Privacy policy

Last updated 28 September 2026

Owl CRM is a customer relationship management (CRM) service run by Owl CRM. This policy explains what personal data the service handles, why, where it is kept and how it is deleted.

1. Two kinds of data, two roles

• People who use Owl CRM — the staff of the organisations that subscribe (our "clients"). For their login and account details, Owl CRM is the controller.
• People in a client's CRM — the leads, customers and participants a client keeps in Owl CRM. For this data the client is the controller and decides why and how it is used; Owl CRM is a processor that stores and processes it only on the client's instructions, as required by Article 28 of the GDPR. If you are in a client's CRM and want to exercise your rights, please contact that organisation; we will help them answer you.

2. What we collect

From people who use the service

• Name, email address and password (stored only as a one-way hash).
• The organisations they belong to and their role there.
• What they do in the service (records created or changed), kept as an activity history for their organisation.

Data clients keep about their contacts

• Contact details such as name, email address, phone number, city, country, date of birth, plus any custom fields the client creates.
• Notes, tasks, deals, class enrolments, form submissions and marketing consent.
• Emails sent to contacts and whether they were delivered, opened or clicked.

Data from Meta (Facebook, Instagram and WhatsApp), only when a client connects it

• Ad accounts: campaign names, and daily spend, impressions, clicks and lead counts per campaign. No data about individual people who saw the ads.
• Facebook Pages and lead ad forms: the Pages and forms the client chooses, the questions on each form, and the answers people submit through those forms (for example name, email and phone number), with the campaign and ad the answer came from.
• Instagram Direct: the Instagram professional account linked to a connected Page, and the messages exchanged with people who write to it, including their Instagram name and username, media and whether messages were seen.
• WhatsApp Business: the client's business phone number and profile, message templates, and the messages exchanged between the client and the people who write to it or whom it writes to, including media and delivery status.
• An access token issued by Meta, used only to read and send the data above on the client's behalf.

3. Why we use it

• To provide the service the client subscribed to: storing contacts, bringing in leads, sending the emails and WhatsApp messages the client asks for, and showing reports (performance of a contract).
• To keep the service secure and working, prevent abuse and fix problems (legitimate interest).
• To meet legal obligations, such as invoicing and answering lawful requests.

4. How we use data from Meta

Data received through Meta's platforms is used only to provide the features the client turned on, inside that client's own account:

• Lead ad answers become contacts in the client's CRM, mapped to the fields the client chose.
• Ad spend and results are shown in the client's reports, next to the leads and customers each campaign brought in.
• WhatsApp and Instagram messages are shown on the matching contact so the client's team can reply. Replies are only sent when someone on the team writes them, and WhatsApp templates only when the client or its automations send them.

We do not sell data from Meta, use it for advertising, use it to build profiles outside the client's own CRM, share it with other clients, or transfer it to data brokers. Each client's data is isolated from every other client's at the database level.

5. Who else processes it

• Hosting: our servers are rented from a hosting provider in Germany (European Union). All data is stored there.
• Email delivery: the emails clients send go through our email delivery provider, which only uses them to deliver them.
• Meta Platforms: when a client connects Facebook, Instagram or WhatsApp, data is exchanged with Meta, which processes it under its own terms and policies.

We do not transfer personal data outside the European Economic Area, except where the client connects a service that does (such as Meta), under that service's safeguards.

6. How long we keep it

• Client data is kept while the client's subscription is active. A client can delete contacts and records at any time.
• When a client leaves, its data is deleted within 30 days, after the client has had the chance to export it.
• Meta access tokens are deleted as soon as the client disconnects Meta in the service, or removes the app in its Facebook settings.
• Backups are kept for up to 14 days and then deleted, so deleted data disappears from backups within that time.

7. How we protect it

• Encrypted connections (HTTPS) everywhere.
• Access tokens, and contacts' email addresses and phone numbers, are encrypted in the database.
• Each organisation's data is separated by database-level access rules, and staff see only the organisations they belong to.
• Access to servers is limited to the people who run the service.

8. Your rights

Under the GDPR you can ask to access, correct, delete or receive a copy of your data, to restrict or object to its use, and to withdraw consent at any time. People in a client's CRM should contact that organisation first. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

9. Deleting data from Meta

How to disconnect Meta and have the data it sent us deleted is explained on the data deletion page.

10. Changes

If this policy changes, the new version is published here with a new date, and clients are told of important changes in advance.