Privacy Policy

1. Who we are and whose data this covers

CoveCRM is operated by Vault Commerce Group LLC. This Policy describes personal information processed through our website, accounts, CRM, communications, support, and integrations. It covers visitors, account users, and people whose information customers submit. The categories processed depend on the features used; not every category is collected from every person.

For account administration, billing, security, and our own website activities, Cove determines relevant processing purposes. For Customer Data handled on a business customer's instructions, that customer generally determines why it is collected, whom to contact, and the lawful basis; Cove may act as a processor or service provider. Roles depend on the activity and applicable law. The customer's notices and any applicable DPA also matter.

See our California & U.S. State Privacy Supplement, Notice at Collection, Cookie Policy, and Subprocessors & Integrations Register.

2. Information we may process

• Identity and account information: name, email, telephone number, company, role, account preferences, authorized-user details, and support contact information.
• Authentication and security information: password hashes, session and verification information, connected-account authorization tokens, security logs, access information, and abuse-prevention signals. Do not send passwords or full payment details in support requests.
• Lead and contact information: names, phone numbers, emails, addresses or state, notes, tags, source, appointments, lead status, files, custom fields, and original imported rows.
• Communications: SMS/MMS text and media supplied through supported workflows; email content, attachments where supported, headers and metadata; call participants, numbers, timing, duration, status, routing, recordings, transcripts, voicemail content, and delivery information.
• AI information: instructions and prompts, relevant lead and conversation context, recordings or audio, transcripts, notes, outputs, summaries, coaching, scores, recommendations, and support interactions processed for AI features.
• Consent and preference evidence: consent text/version, source and page URLs, submitted choices, account/sender identity, recipient details, timestamps, IP address, user agent, opt-out records, and customer certifications.
• Device, usage and analytics information: IP address, browser/device details, pages and actions, clicks, scrolls, session identifiers, local-storage preferences, logs, and session-replay information subject to provider masking and settings.
• Advertising and integration information: referral codes, advertising/cookie identifiers, campaign/ad/page/form identifiers, Meta Lead Ads responses, connected-account details, attribution, conversion events and outcomes, Google identity details, calendar information, and customer-directed spreadsheet rows.
• Billing and telecom registration: plan, purchases, subscriptions, invoices, usage, payment-provider references and payment-method details returned by the provider; business identity, address, contact, and tax/business-registration information supplied for A2P or telecom onboarding. Payment card processing is handled by payment providers.
• Optional prospecting/recruiting information: professional-license or business information from customer-selected sources, social profiles and interactions, prospect qualifications, and connected browser/account-session information where these features are available and used.

3. Customer-selected sensitive and insurance information

Customers may choose to submit or import date of birth, age, health-related information, income or financial information, mortgage balances/payments, beneficiary details, marital or military information, and insurance or coverage information. Flexible notes, recordings, transcripts, messages, and custom fields can also contain sensitive information. Cove does not require all of these categories from every customer or lead.

Customers must minimize the information they submit, provide required notices, obtain necessary permissions, and confirm that the selected service is appropriate for their obligations. Do not submit Social Security numbers, full financial-account credentials, or data requiring a special regulated environment unless Cove has expressly agreed in writing to the necessary protections. No HIPAA compliance or business associate agreement is implied by the ability to enter health information.

4. Sources

We receive information directly from visitors and users; from customers, their personnel and authorized vendors; from customer uploads and imports; from people completing lead, booking, or opt-in forms; from communications participants; and from connected providers such as Google, Meta, telecom carriers, payment and email services. We also receive device/usage information automatically, and may derive summaries, classifications, scores, or other inferences from information processed for the services.

Where optional prospecting is used, sources may include public professional-license records, customer-provided lists, and customer-directed social-platform activity. Public availability does not mean that every subsequent use or contact is permitted.

5. Purposes

• Create and administer accounts; authenticate users; provide support and operational notices.
• Store and organize leads, import data, maintain conversations, coordinate appointments and calendars, and execute customer-configured workflows.
• Route calls and messages; manage numbers and telecom registration; record or transcribe communications in enabled workflows; provide AI features, coaching, summaries, and analysis.
• Process subscriptions, usage billing, payment disputes, affiliate attribution and payouts, and accounting records.
• Measure use and performance; diagnose problems; improve features; provide customer-directed advertising attribution, campaign reporting and optimization.
• Detect fraud, abuse and security events; document consent or requests; enforce agreements; comply with legal obligations and resolve disputes.

Where applicable law requires consent or another basis for a use, that requirement still applies. A general purpose listed here does not authorize a customer to disregard a recipient's choices or use sensitive data for unrelated purposes.

6. Recipients and disclosures

Information may be disclosed to infrastructure, database, communications, AI, payment, email, analytics, security, support, and professional-service providers to perform the relevant activities. It may also be available to authorized customer users, intended communications recipients, and integrations the customer directs us to connect. Permissions and the selected workflow determine what is transferred.

Providers may act on Cove's behalf, on the customer's behalf, or for their own purposes under their terms, depending on the service and applicable law. Payment networks, communications carriers, customer-connected platforms and advertising providers should not all be assumed to have the same legal role. See the register for known providers and distinctions.

We may disclose information when legally required, to protect rights and safety or investigate abuse, to professional advisers under appropriate duties, or in a business transfer subject to applicable legal protections. We may also disclose information at your direction or with consent. We do not make an absolute promise that information is never shared.

7. AI processing

When enabled workflows use AI, relevant lead information, conversation history, prompts, audio, recordings, transcripts, notes, appointments, support context, and related metadata may be sent to OpenAI or another identified provider to generate responses or analysis. Some workflows operate automatically rather than awaiting approval of each output. AI summaries and inferred scores may be inaccurate.

Cove does not use customer lead data, communications, call recordings, transcripts, or Google user data to train generalized AI or machine-learning models owned by Cove. Provider processing, retention, and any optional model-training settings are governed by the applicable provider arrangements; this Policy does not represent that every provider offers identical retention or training controls.

Customers should choose appropriate data, permissions, and supervision and avoid sending unnecessary sensitive information. AI-assisted organization or prioritization does not establish a lawful basis for consequential decisions about insurance or other rights.

8. Google and customer-directed imports

Google identity features use basic identity scopes such as email, profile, and openid. Google Calendar connections may use the https://www.googleapis.com/auth/calendar scope to read, create, update, or otherwise manage events needed for the connected calendar workflow, including appointment details, participants, times, and availability.

Google user data is used to provide the connected functionality for your account. We do not sell Google user data or use it to train generalized AI or machine-learning models. Disconnect the integration where available or revoke access through your Google Account. Revocation stops future authorized access; it does not automatically remove records already imported into Cove or cancel separate customer-installed workflows.

Customers may import spreadsheet or file data, including Google Sheets rows sent through a customer-installed Apps Script/webhook workflow. This is separate from Google Calendar authorization. Manage the installed script and its data delivery at the source as well as any Cove connection. Imported data is then handled as Customer Data.

9. Meta, advertising, attribution, and analytics

Meta/Facebook connections may process ad accounts, pages, forms, lead responses, campaigns, performance, and permissions. Where a hosted funnel has a configured Meta Pixel, browser page and lead events may be sent to Meta. When Conversions API functionality is enabled, event data may include hashed phone/email or customer identifiers, IP address, browser information, advertising/cookie identifiers, page URLs, campaign identifiers, and outcomes such as qualification, appointments, sales or policy issuance.

These activities support customer-directed measurement, attribution and advertising optimization. Hashing identifiers does not make them anonymous. This description does not state that health details are included in every advertising event. Customers must evaluate the sensitivity and permissibility of their selected events and destinations.

Microsoft Clarity processes website interaction and session information, including clicks, scrolling, device details and session replay, to help understand use and improve the experience. Microsoft may process identifiers for analytics and advertising-related purposes under its terms. Affiliate attribution uses referral information. Email providers may report delivery, opens, clicks, replies or unsubscribes when configured.

See the Cookie Policy and Microsoft Privacy Statement. The current cookie banner is an acknowledgment, not a control that blocks optional technologies. Cove does not currently provide an automatic Global Privacy Control response or a preference center. Applicable legal rights are not waived by these limitations.

Legal definitions of sale, sharing and targeted advertising differ from ordinary usage and can include disclosures without payment. A provider transfer is not automatically a statutory sale or sharing, and a statement about monetary transactions alone does not resolve that question. Available rights and how to request them are described in the state supplement.

10. Retention and deletion

Retention depends on the type of information, the active service or customer instruction, the need to document consent and suppression, and legal, tax, accounting, telecom, security, fraud, dispute and contractual requirements. Account and CRM data may be retained while needed for the customer relationship; billing and consent records may need longer retention. Provider copies and backups can have separate retention periods.

Deleting a lead, disconnecting an integration, canceling billing, or closing access does not necessarily delete all related messages, recordings, transcripts, logs, evidence, vendor copies, or backups. Contact us for a privacy deletion request or customer data- return/deletion assistance. Where a request is legally required and applicable, retained exceptions must have a lawful basis; this Policy does not authorize indefinite retention simply for convenience.

We have not published a fixed deletion deadline for every category or backup system. Any executed DPA or applicable law controls required deletion, restricted retention and assistance.

11. Security and location of processing

Cove uses measures such as HTTPS for encrypted transmission and account access controls intended to protect information. No system is perfectly secure, and this Policy is not a certification, guarantee against breach, or representation of a particular audit standard. Customers should secure credentials, permissions, devices and connected accounts.

Cove is a U.S. service. Providers and customer-directed recipients may process information in other locations according to the applicable service arrangements. We do not represent that every category remains in a particular country. Where a restricted international transfer requires additional safeguards, those must be established in the applicable agreement; this Policy alone is not a transfer mechanism.

12. Requests, verification, and authorized agents

Send privacy requests to support@covecrm.com or legal@covecrm.com. Describe the right you want to exercise, how you interacted with Cove or the relevant customer, and enough information to locate the records. Do not send passwords, full payment details, or unnecessary sensitive documents.

Depending on your location and applicable law, rights may include access, correction, deletion, portability, objection, restriction, and certain opt-outs. We may need to match information to records or use an existing authenticated relationship to verify identity. Verification requirements vary by request; we will not impose identity verification on an opt-out where law prohibits doing so.

An authorized agent may submit a request with evidence of permission. Where permitted or required, we may verify the individual's identity or confirm the authorization directly. We will explain a denial or request for additional information and respond within applicable legal timeframes, including notice of a permitted extension.

If Cove processes information for an agency or other business customer, that business may be responsible for deciding the request. We may refer you to it or assist it as required. This does not prevent you from asking Cove about processing for which Cove is responsible. State-specific rights and appeal information appear in the supplement.

13. Children

CoveCRM accounts are intended for adults conducting business, not for children under 18. We do not direct the service to children or seek information from them for our own marketing. A customer may include information about dependents or beneficiaries only with a lawful basis and any required notices or parental permissions. If you believe a child has provided information improperly, contact us so it can be assessed and handled under applicable law.

14. Changes and contact

We may update this Policy to reflect changes in practices or law. We will identify the revised effective date and version and provide additional notice or obtain consent where required. Continued use is not a substitute for consent where law requires affirmative permission for a new purpose.

CoveCRM / Vault Commerce Group LLC: support@covecrm.com for privacy/support, or legal@covecrm.com for legal inquiries.