Privacy Policy

Last updated: October 18, 2026

Salestead CRM (“Salestead”, “we”, “us”) is operated by Beansense Inc., a company based in Ontario, Canada. This policy explains what personal information we collect when you use salesteadcrm.com and app.salesteadcrm.com (the “Service”), why we collect it, who we share it with, and the choices you have.

1. Our role and yours

For your Salestead account, billing and website visits, we decide how personal information is used and are responsible for it under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

The customer and contact records you put into your workspace (for example your clients’ names, emails, deals and invoices) belong to your organization. We process them only to provide the Service to you, following your instructions. If someone asks us about information your workspace holds about them, we will refer them to you.

2. Information we collect

Information you give us

• Account details: your name, email address, company name and password (passwords are stored only as secure hashes by our authentication provider).
• Workspace content: customers, contacts, deals, invoices, events, projects, notes and other records you or your teammates create or import.
• Team information: the email addresses of people you invite and their roles.
• Billing details: your plan, billing address and the country used for tax. Card and payment details are collected and stored by Stripe, not by us.
• Messages to us: what you send when you contact support.

Information collected automatically

• Usage and device data: pages visited, actions taken, browser type, and IP address, used for security, troubleshooting and improving the Service.
• Approximate country: derived from your IP address by our hosting provider, used only to show prices in CAD or USD.

Information from websites and tools you connect

• Leads sent from your website forms or automation tools through your Salestead API keys, including any campaign tags (UTM parameters) and ad click identifiers present on the page, and the consent choice the visitor made.
• Data from connected services that you authorize, described in section 5.

3. How we use information

• To provide, maintain and secure the Service, including your account, workspace, team access and support.
• To process subscriptions, payments, taxes and invoices through Stripe.
• To send service emails you request or need, such as verification, password resets, invites and invoice emails you choose to send.
• To detect and prevent fraud, abuse and security incidents, and to comply with law.
• To understand how the Service is used, in aggregate, so we can improve it.

We do not sell personal information, and we do not use your workspace content to advertise to you or to others.

4. AI features

Some features, such as AI forecasts, deal next steps, customer summaries and invoice email drafts, use Claude, an AI model provided by Anthropic. When you use one of these features, the relevant records from your workspace are sent to Anthropic to generate the response. AI suggestions are shown to you for review and never change your data or send anything on their own. Under its commercial terms, Anthropic does not use this data to train its models. You can choose not to use AI features.

5. Connected services

If you choose to connect an account, such as Google Ads, Google Analytics, Google Search Console, Google Calendar, Gmail, Microsoft 365, Meta, LinkedIn, TikTok, Pinterest or Microsoft Advertising, we access only the data needed for the features you enable, using read-only permissions unless a feature clearly requires more. Examples include campaign names and performance metrics, website traffic reports, calendar events matched to your contacts, or emails exchanged with your contacts. Access tokens are encrypted and stored on our servers, never in your browser. You can disconnect a service at any time in Settings → Integrations, or by revoking access in that provider’s account settings; when you disconnect, we stop syncing and delete the stored tokens.

6. Google user data

Salestead’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we use Google user data only to provide and improve the user-facing features you enable; we do not use it for advertising, we do not sell it, we do not use it to train general-purpose AI models, and people at Salestead do not read it unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymized.

7. Who we share information with

We share personal information only with service providers that help us run Salestead, under contracts that limit their use of it, and when required by law.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy will continue to apply.

8. Where data is stored

Salestead’s database is hosted in the United States (Ohio), and some providers process data in other countries. This means your information may be accessible to courts, law enforcement and national security authorities of those countries. We use contracts and security safeguards to protect information wherever it is processed.

9. Cookies and similar technologies

We use only the cookies and browser storage needed to run the Service: keeping you signed in across salesteadcrm.com and app.salesteadcrm.com, remembering your display preferences, remembering your currency choice, and carrying a team invite through sign-up. We do not use advertising or cross-site tracking cookies.

10. How long we keep information

We keep account and workspace information while your account is active. If you delete your workspace or account, we delete or anonymize its information within 30 days, except that backups are overwritten on a rolling basis within 90 days and some billing records must be kept for up to 7 years for tax and legal purposes. Webhook delivery logs are kept for up to 90 days.

11. Your rights and choices

You may ask to access, correct or delete your personal information, ask what we hold and how it is used, or withdraw consent where we rely on it (which may limit what the Service can do). You can update much of your information in Settings. To make a request, email privacy@salesteadcrm.com; we will respond within 30 days. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada.

12. Deleting your data

To delete your data, including any data received from Facebook, Instagram, Google or other connected services:

• Disconnect a service: open Settings → Integrations, choose the service and select Disconnect. This stops syncing and deletes its stored access tokens. You can also remove Salestead’s access from your account settings on that service.
• Delete imported data or your account: email privacy@salesteadcrm.com from your account email with the subject “Delete my data”. We will confirm your request and delete the data within 30 days, then confirm by email.

13. Security

We use encryption in transit, encrypted storage of connection tokens, workspace-level access controls enforced by the database, hashed API keys, signed webhooks and limited staff access. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify affected people and the Privacy Commissioner as required by law.

14. Children

Salestead is a business tool and is not intended for people under 16. We do not knowingly collect their personal information.

15. Changes to this policy

We may update this policy. If changes are significant, we will notify account owners by email or in the app before they take effect. The date at the top shows the latest version.

16. Contact us

Privacy questions or requests: privacy@salesteadcrm.com
General: hello@salesteadcrm.com
Beansense Inc., Ontario, Canada