Privacy Policy

Who we are

CollabSpring ("we", "us") is a CRM for influencer-marketing agencies. For the data an agency puts into its workspace — its creators, brands and contacts — the agency is the controller and we process that data on its behalf. For the account details of the people who use CollabSpring, we are the controller. Contact us about anything in this policy at support@collabspring.com.

What we store

• Account data: your name, email address, password hash (or your Google sign-in identity), role, and security settings such as two-factor authentication.
• Workspace data: the creators, brands, agencies, collaborations, contracts, invoices, notes, templates and settings your team creates or imports.
• Outreach data: the emails your team sends through the service, their delivery status, and the replies and leads detected for them (see "Your mailbox").
• Billing data: your plan and subscription status. Card and payment details are collected and held by Paddle, not by us.
• Technical data: IP address, browser and device signals used for security, rate limiting and abuse prevention, and server logs kept for a limited time to operate and debug the service.

Your mailbox

Outreach sends from the mailbox your agency connects via OAuth (Google, Microsoft, Zoho) or SMTP; CollabSpring never operates a shared inbox on your behalf, and you choose which permissions to grant. With read access, CollabSpring looks at the sender, subject, date and a short preview of new inbox mail to detect replies to your outreach, delivery failures and new leads. Message bodies are not stored: conversations you open are fetched live from your mailbox and cached only for a few minutes. For leads, CollabSpring keeps the sender's address and name, the subject and a preview of at most 500 characters. Disconnecting the mailbox deletes its stored tokens, stops CollabSpring's inbox notifications and revokes CollabSpring's access at Google and Zoho; Microsoft lets only you or your administrator revoke an app, from your account's app permissions page.

Google user data

• Gmail: with your permission we send email as you (gmail.send), read new inbox mail to detect replies, bounces and leads as described above (gmail.readonly), and list your "Send as" aliases so you can choose the sending address (gmail.settings.basic).
• Google Sheets: if you turn on the external backup, we create and write only the spreadsheet files this feature creates in your Drive (drive.file); we cannot see your other files.
• Google sign-in: we receive your name and email address to create and sign in to your account.
• We use this data only to provide these features to you. We do not sell it, use it for advertising, or use it to train AI models, and people at CollabSpring do not read it unless you ask us to for support, it is needed for security, or the law requires it.
• CollabSpring's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI processing

When a first message arrives from an address that isn't in your CRM, its sender, subject and short preview are sent to the AI provider your workspace uses (the platform default, Google Gemini on a paid tier that does not train on customer data, or a provider you configured with your own key) to classify it as a creator, brand or agency enquiry. AI drafting and conversation summaries send the relevant contact details or conversation to the same provider when you ask for them. CollabSpring does not use your mail or CRM data to train AI models.

People you email

Every campaign email and automatic follow-up CollabSpring sends carries an unsubscribe link and a one-click List-Unsubscribe header where the mail provider supports it. Using it records the opt-out on the agency's contact, and campaigns and automatic follow-ups stop including that person. If you were contacted by an agency using CollabSpring and want your data removed, ask that agency; you can also write to us and we will pass the request on.

Tenant isolation

Every workspace's data is stored with its workspace identifier and every query is scoped to it, so one agency can never see another agency's records. Mailbox and AI-provider credentials are encrypted at rest.

Service providers

We use these providers to run the service. Each processes data only on our instructions and only for the purpose listed:

• Amazon Web Services (United States): servers and databases that host the application.
• Cloudflare: DNS, and encrypted object storage for files and backups.
• Google (Gemini API): AI features, as described above.
• Resend: delivery of account and notification emails (sign-in, verification, reminders).
• Paddle: checkout, payments, invoicing and tax, as our Merchant of Record.
• The mailbox provider you connect (Google, Microsoft, Zoho or your SMTP host): sending and reading outreach mail, as you authorise.

Cookies

CollabSpring uses only the cookies needed to keep you signed in and secure. We do not use advertising or third-party tracking cookies.

Retention and deletion

• Workspace data is kept for as long as the workspace exists. You can export all of it at any time from the app, including while the workspace is read-only.
• To delete your workspace or your personal data, email support@collabspring.com from the account's address. We delete it from the live system within 30 days.
• Encrypted backups are kept for up to six months and then deleted; deleted data disappears from them as they expire.
• Workspaces whose trial or subscription has ended may be deleted after the retention period shown in the app.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, and to object to its processing. Email support@collabspring.com and we will respond within 30 days. You can also complain to your local data-protection authority.

Changes

If we change this policy materially, we will notify workspace Owners by email before the change takes effect and update the date above.