Privacy Policy

EasyBase Cloud (“EasyBase”, “the service”) is the web-based CRM for glazing and home-improvement businesses, used at app.easybasecrm.com. It holds a business’s customers, enquiries, jobs, appointments, documents, messages and invoices in one place, and connects to the email, SMS and messaging accounts the business chooses to link. This policy explains what information the service processes, why, and the choices you have. It covers the EasyBase web application, the customer portal and the easybase.co.uk website. The EasyBase CRM and EasyBase Companion mobile apps have their own policies.

EasyBase CRM is a trading name of Inverti Ltd, a company registered in England and Wales (Company No. 15608883) (“we”, “us”).
You can contact us about anything in this policy at hello@easybase.co.uk.

EasyBase is a tool that businesses subscribe to for their own use. The business that holds the subscription (your employer, or your own company) decides what goes into it and is the data controller for everything it stores there: its customers, enquiries, jobs, files and messages. EasyBase processes that information on the business’s instructions as its data processor.

For the information we need to run your account itself — your sign-in details, security settings, session records and billing — EasyBase is the data controller.

If you are a customer of a business that uses EasyBase and your details are held in its account, that business is the controller of your information. Please contact it directly about how it uses your data; we will help it respond to you.

Your account. Your name, work email address, password (stored hashed, never in plain text), role and permissions, the teams you belong to, your working hours and holiday records, and records of when and from where you sign in.

Your company’s business records. Whatever the business puts into EasyBase: customer and contact details, site addresses, enquiries, quotes, jobs, appointments, tasks, notes, photos, documents, invoices, payments and the history of each record. Access to these is governed by the permissions your company gives you.

Connected email accounts. If you or your company connect a Google or Microsoft mailbox, EasyBase reads messages from it and sends replies through it so that email about customers and jobs can be handled from inside the CRM. We store the messages we sync and the tokens needed to keep the connection working. We only access mailboxes you have chosen to connect, and you can disconnect them at any time from Settings, which revokes our access.

EasyBase’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to display, organise and reply to email inside EasyBase; it is never used for advertising, never sold, and is not read by people except where you ask for support, where it is needed for security, or where the law requires it.

SMS and messaging. If your company connects a Twilio account for text messages or a Facebook Page for Messenger, the messages exchanged with customers through those channels are stored in the CRM alongside the customer’s record. The credentials for those accounts belong to your company and are stored encrypted.

Customer portal. A business can let its customers see their own jobs and documents through a portal. Customers sign in with a one-time link emailed to the address the business holds for them; we store the link token until it is used or expires.

Billing. Subscriptions are paid through Stripe. We store your Stripe customer reference and subscription status; card details are entered on Stripe’s own pages and never reach EasyBase.

Technical information. Standard server logs (IP address, browser, pages requested, timestamps) kept for security and to keep the service working, and a session cookie that keeps you signed in. We do not use advertising or analytics cookies.

The website. If you ask a question through the assistant on easybase.co.uk or send us an enquiry, what you type and any contact details you give are stored in our own EasyBase account so we can reply.

We use it to sign you in and keep your session secure; to show you your company’s records and let you work on them; to send and receive the email, text and chat messages you ask it to; to run the features of the service, including AI features (see below); to bill the subscription; to provide support when you ask for it; and to keep the service reliable, secure and free of misuse.

We do not sell your information, use it for advertising, or use it to profile you.

EasyBase includes features that draft, summarise and organise for you: the assistant, suggested replies, record summaries, the daily briefing, task and schedule suggestions, and extracting details from an enquiry. When you use one of these, the relevant text — for example the record you are looking at, or the email you are replying to — is sent to OpenAI to generate the result. OpenAI acts under contract on our instructions, does not use the content to train its models, and does not keep it beyond what is needed to return a response and prevent abuse. Nothing is sent unless you use an AI feature, and the result is yours to edit or discard.

Each customer’s data is kept in its own database, with attachments in its own storage container, on Microsoft Azure in the United Kingdom. Connections to the service are encrypted (HTTPS), and data is encrypted at rest.

Your company’s business records are kept for as long as the company keeps them; it controls what is created, edited and deleted in its account. When a subscription ends, we keep the company’s data for a short period so it can be exported or the subscription reinstated, and delete it on the company’s request or once that period has passed.

Your account details are kept while you have access to EasyBase and removed or anonymised when you no longer do. You can ask for your account to be deleted from Settings or by emailing us; your company’s administrator is told of the request, because the records you created belong to the company and stay with it.

Server logs are kept for a limited period for security purposes and then deleted.

We share data only with the service providers we need to run EasyBase, each acting under contract and only on our instructions:

• Microsoft Azure — hosting, databases, file storage and our own system email.
• OpenAI — the AI features described above.
• Stripe — subscription billing.
• Google and Microsoft — only when you connect a mailbox, and only to the extent needed to read from and send through it.
• Twilio and Meta — only when your company connects an SMS account or Facebook Page, to carry those messages.
• getAddress.io, Postcodes.io and Google Places — looking up an address from a postcode; the postcode you type is sent to the service to find matches.
• OpenStreetMap — showing job locations on a map; the address being mapped is sent to be placed on it.
• Expo and OneSignal — delivering push notifications to the mobile apps, where you have installed them.

We will disclose information where the law requires it. We never sell personal data.

Under UK and EU data-protection law you have rights over your personal data, including access, correction, deletion and objection. For business records held in your company’s EasyBase account, contact your employer (the data controller), and we will support them in responding. For your account details, or anything else in this policy, contact us at hello@easybase.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

EasyBase is a business tool and is not directed at children.

If we make material changes to this policy we will update this page and the effective date above, and where appropriate notify your company.

Inverti Ltd (trading as EasyBase CRM), Company No. 15608883
Email: hello@easybase.co.uk