Privacy notice

Drewframe CRM is run by the organisation that invited you, using a CRM platform provided by Drewframe.

That organisation is the controller of the data in this workspace: its customers and contacts, deals, projects and notes, and the accounts of the people who use it. It decides what is recorded and why, and questions about that data are best sent to it.

Drewframe is its processor. It hosts and secures the workspace and acts only on that organisation's instructions, under a written data processing agreement. It does not use workspace data for its own purposes, sell it, or share it with anyone not listed below.

• Your account: your name, email address, your role in the workspace, and a securely hashed password that nobody can read, including Drewframe. If you set up an authenticator app, the secret it uses.
• What the organisation records: companies or customers, their contacts, deals, follow-ups, quotes and statements of work (and whether a customer accepted one), projects, tasks and notes, and who did what and when.
• Security data: your IP address is checked to limit repeated sign-in and password reset attempts, and is not stored with your account. The platform keeps short-lived technical logs to investigate faults and attacks.

Only cookies that are strictly necessary: one that keeps you signed in, and a short-lived one used when you switch between workspaces. There is no analytics, advertising or tracking, which is why you are not asked to accept anything.

• Supabase — The database and sign-in service. Workspace data and accounts are stored in London.
• Cloudflare — Runs the application and protects it from attack. Requests pass through its network, which is worldwide.
• Resend — Sends invitations, password resets, quotes, statements of work, and the notification emails you can turn off under Settings: mentions, assignments, answers to your quotes, a morning list of follow-ups due and a Monday summary.
• GitHub — Holds nightly backups for 30 days. They are encrypted before they are uploaded, and GitHub cannot read them.

The current list is also published at drewframe.co.uk/trust. Some of these providers are based in the United States. Where data is processed outside the UK, the transfer relies on safeguards UK law recognises: the UK extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum to the standard contractual clauses.

• For as long as the organisation uses the workspace, or until it deletes the record.
• When a record is deleted permanently, it is gone at once, and from the nightly backups within 30 days.
• When an organisation stops using the platform, its workspace and the accounts that belong only to it are deleted, and gone from backups within a further 30 days.
• Invitations are removed 30 days after they are accepted or expire.

• Every connection is encrypted, and each workspace's data is kept apart by the database itself, not only by the app.
• Sign-in is rate limited, and passwords are hashed.
• Drewframe support staff can enter a workspace only with access granted for it, and only after passing an authenticator check. Every grant is logged, and appears in the workspace's own Members page for the organisation to see.
• Backups are encrypted before they are stored, with a key kept outside the systems that hold them.

You can ask for a copy of your data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format.

For data in this workspace, ask the organisation that invited you: it is the controller and can act on it directly. If you cannot reach them, or your question is about Drewframe itself, email hello@drewframe.co.uk and we will respond within one month, passing requests to the organisation where the law requires it.

You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.