Privacy policy

Effective October 17, 2026. Contact: [email protected].

Information used by backups

When an administrator connects Google Drive, FormaCRM receives the Google account identifier, verified email address and authorization tokens needed to create and manage that installation’s backup files. The requested Drive permission is drive.file, together with basic account identity. The backup service uses this information to identify the connected account, deliver backups, verify delivery, download backups for authorized administrators and remove expired backup files.

Storage and sharing

Backups contain the installation’s business database and saved uploads, which may include customer, transaction, employee and attachment data. Drive stores daily database/manifest ZIPs and shared upload files in a private installation folder. Unchanged uploads are reused across restore dates. Authorized downloads prepare ordinary complete ZIPs without an additional archive password. Authorized CRM administrators and people with access granted by the Drive account owner may access them. Hosting administrators can assist with backup operation and restoration. Google processes data under its own terms and privacy policy.

Google authorization tokens are encrypted in private hosting storage outside the public website and excluded from backup archives. FormaCRM does not sell Google user data or use it for advertising or training general-purpose AI models. FormaCRM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Retention and control

After a new backup is verified, FormaCRM retains 30 successful daily snapshots and removes manual snapshots older than 30 days. Shared uploads are removed only when retained restore points and active preparations no longer need them, after a 48-hour orphan safety period. The latest two complete successful ZIPs and the latest failed upload payload are retained privately on the host for recovery. Prepared download ZIPs expire after one hour. Backup history and operational settings remain with the hosted installation. Disconnecting Google Drive stops queued work and removes the installation’s stored Google authorization; existing Drive files remain in the account. Administrators may delete those files directly in Drive or contact support for help. Revoking FormaCRM through Google account settings may disconnect other installations authorized through the same Google application.

Notifications and requests

The configured notification email receives backup failure or missed-backup alerts using the installation’s SMTP service. Contact [email protected] to request assistance, deletion of stored connection data or clarification about your hosted installation’s data retention. Business records remain subject to the business owner’s instructions and applicable recordkeeping needs.