Privacy Policy

Last updated: October 2, 2026

This Privacy Policy describes how Iberotech CRM (the “App”), available at https://itfcrm.site, collects, uses, stores, shares, and protects information. The App is operated by Iberoamerican Technology Foundation (“Iberotech”, “we”, “us”). It applies together with our Terms of Service.

In short: Iberotech CRM is an internal tool used only by invited Iberotech team members. If you connect your Google account, the App reads your recent Gmail messages, Google Calendar events, and Google Meet transcripts so it can keep the CRM up to date. The App only reads this data. We do not sell it, we do not use it for advertising, and we do not use it to train AI models.

1. Information we collect

Account information

When an administrator invites you, we store your name, email address, role, and access level. Sign-in is handled by our authentication provider, Supabase. Your password is stored by Supabase in hashed form and is never visible to us.

CRM records

Team members add and import records about the organizations and people Iberotech works with: names, job titles, organizations, email addresses and other contact details, projects, notes, and activity history. These records can include information about people who do not use the App themselves (see section 9).

Technical information

The App stores your sign-in session and a working copy of CRM data in your browser’s local storage so it loads quickly. The App does not use advertising or analytics cookies and does not include third-party tracking scripts. Our hosting providers keep standard server logs, such as IP addresses and request times, to operate and secure the App.

2. Google user data

This section explains how the App accesses, uses, stores, shares, protects, and deletes data it receives from Google APIs (“Google user data”). Connecting a Google account is optional, and the App only accesses Google user data after you sign in with Google and grant permission on Google’s consent screen.

2.1 Google user data the App accesses

  • Gmail messages (read only). Your recent messages, up to 150 per sync, including sender and recipient addresses, subject, date, message text, and the names, types, and sizes of attachments. The App does not download attachment contents.
  • Google Calendar events (read only). Events on your primary calendar from 30 days in the past to 30 days ahead, including title, time, location, description, organizer, attendees and their responses, and meeting links.
  • Google Meet records (read only). Records of your meetings from the last 14 days, including their transcripts and participant names. The App does not access meeting recordings.
  • Basic profile. Your name and email address, to identify which Google account is connected.

The App does not send email, change or delete messages, change labels, create or change calendar events, or read files in your Google Drive.

2.2 How the App uses Google user data

The App uses Google user data only to provide and improve the following features for you and your team:

  • matching emails, calendar events, and meetings to the right contacts, organizations, and projects in the CRM;
  • adding those interactions to each contact’s and organization’s activity timeline;
  • showing your upcoming and recent meetings in the App’s Agenda;
  • creating meeting notes, summaries, and action items from meeting transcripts;
  • preparing briefings and suggested next steps about partner relationships;
  • building a private search index so team members can find past conversations;
  • running a daily background sync, so the CRM stays current while you are not using it.

We do not use Google user data for advertising, to build user profiles for any purpose other than these features, to determine credit-worthiness or for lending, or to develop, improve, or train generalized AI or machine learning models.

2.3 How the App shares, transfers, or discloses Google user data

We do not sell Google user data. We share it only as needed to provide the features above:

  • Within Iberotech. Synced email messages are shown only to the team member who connected the Google account. Activities, meeting notes, and summaries created from them become part of the shared CRM and can be seen by other authorized Iberotech team members, because the CRM is a shared workspace for Iberotech’s partnerships.
  • OpenAI, our AI service provider. To create summaries, briefings, suggestions, and the search index, the App sends the relevant email text, meeting transcripts, and related contact details to OpenAI’s API. OpenAI processes this content only to return results to the App. Under OpenAI’s API terms, this content is not used to train OpenAI’s models.
  • Supabase (database and sign-in) and Vercel (hosting), which store and process data on our behalf to run the App.
  • Legal reasons. When required by law, or to protect the rights, safety, and security of Iberotech, our users, or others.
  • Business transfers. As part of a merger, acquisition, or sale of assets, with notice to you.

We do not transfer Google user data to anyone for any other purpose.

2.4 How the App stores and protects Google user data

  • All data is sent over encrypted HTTPS (TLS) connections, between your browser, the App, Google, and our service providers.
  • Data is stored in a Supabase-managed PostgreSQL database in the United States, which is encrypted at rest.
  • The access and refresh tokens that let the App reach your Google account are additionally encrypted with AES-256-GCM before they are stored, and they are never sent to the browser.
  • Every request for CRM data must come from a signed-in, invited Iberotech team member. Database and API credentials are kept in server-side configuration and are never exposed to the browser.
  • Access to the production systems is limited to the Iberotech administrators who run the App.
  • People at Iberotech do not read your Google user data unless you ask us to (for example, for support), it is needed for security purposes, or the law requires it.

2.5 Retention and deletion of Google user data

  • We keep Google user data only as long as it is needed for Iberotech’s work in the CRM, or until you ask us to delete it.
  • You can disconnect your Google account at any time in the App’s Settings. Disconnecting deletes the stored access and refresh tokens and stops all syncing. Information that was already synced stays in the CRM until it is deleted.
  • You can also remove the App’s access at any time from your Google Account connections page.
  • To have the data synced from your Google account deleted, including stored emails, calendar-based activities, meeting transcripts and notes, and search index entries, email rodrigo.sepsaga@iberotech.org. We will delete it within 30 days and confirm when it is done, except for anything we must keep by law.

2.6 Limited Use

Iberotech CRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Microsoft 365 and Zoom data

If you connect a Microsoft 365 account instead of Google, the App reads your messages from the last 90 days (up to 150 per sync), calendar events from 30 days in the past to 30 days ahead, your basic profile, and transcripts of Teams meetings it finds in your calendar. If Iberotech connects a Zoom account, the App receives a notification when a meeting transcript is ready and downloads the transcript (not the recording). This data is used, shared, protected, and deleted in the same way as Google user data in section 2.

4. How we use other information

We use account information and CRM records to run the App for Iberotech: to show and organize partner records, generate briefings and suggestions, let team members search the CRM, and keep the App secure.

5. How we share other information

We do not sell personal information. CRM records are shared with authorized Iberotech team members and with the service providers listed in section 2.3, only to run the App. The App also asks Google’s public favicon service for the logos of organizations in the CRM, which shares only the organization’s website domain.

6. Security

The protections in section 2.4 apply to all data in the App. No system is perfectly secure, but we take reasonable measures to protect the information we hold, and we will notify affected users of a security incident as required by law.

7. Retention of other information

We keep CRM records and account information for as long as they are needed for Iberotech’s work. When a team member’s access ends, an administrator removes them from the App, which also deletes the stored tokens for their connected mail accounts. You can ask us to delete your information as described in section 8.

8. Your choices and rights

You can ask us to access, correct, export, or delete your personal information by emailing rodrigo.sepsaga@iberotech.org. Depending on where you live, you may have additional rights under local privacy law; we will honor requests as those laws require.

9. People whose information is in the CRM

The CRM holds business contact information about people Iberotech works with, such as partners, donors, program participants, and their colleagues. If you believe we hold information about you, you can ask us what we have, ask us to correct it, or ask us to delete it, using the contact details below.

10. Children

The App is for Iberotech team members and is not directed to children. We do not knowingly collect personal information from children under 13 through the App.

11. International users

Iberotech works across Latin America and the United States. Information is processed and stored in the United States, where data protection laws may differ from those in your country.

12. Changes to this policy

We may update this policy from time to time and will change the “Last updated” date above. If we change how the App uses Google user data, we will notify users in the App and by email before the change takes effect and, where required, ask for your consent again.

13. Contact

Iberoamerican Technology Foundation
Iberotech CRM: https://itfcrm.site
Privacy questions and requests: rodrigo.sepsaga@iberotech.org