Privacy Notice
Last updated
This notice explains what Larchmont CRM stores, why, where it goes and how long it stays. The CRM is made and run by Larchmont Digital, a marketing agency in Los Angeles, California. It is used by the businesses we work with ("clients") to talk to their own customers and prospects ("contacts").
What the CRM stores about the people who use it
- Your account. Name, e-mail address, a hash of your password (never the password), and, if you turn on two-step sign-in, an encrypted authenticator secret and hashed backup codes.
- Your sessions. The IP address and browser of each signed-in device, so you can see where you are signed in and sign out elsewhere.
- What you do in the CRM. An activity log of changes (who did what, when) that the workspace's administrators can read.
What the CRM stores about contacts, on behalf of a client
- Contact details the client enters, imports, or receives through a form, a booking page, a text, a call or an e-mail: name, phone number, e-mail address, company, tags, notes, and the answers to the client's questions.
- Conversations. Text messages and e-mails exchanged with the client, in both directions.
- Calls. Call logs, and when the client turns recording on, the recording, a transcript and a short summary. The CRM plays a recording notice to both sides.
- Website visits, when the client installs the CRM's tracking script on their own site: pages viewed, the referring site, campaign parameters and click identifiers in the link, device type and country. A visit is tied to a person only when that person fills in a form, books, or otherwise identifies themselves.
- Appointments, proposals, agreements and payments. What was booked, quoted, signed (with a hash of the signer's IP address) and paid. Card details never touch the CRM; Stripe handles them.
- Consent. Whether, when and how a contact agreed to receive texts or e-mails, and any request to stop.
Why
- To let the client answer, call, text, e-mail, book, quote and invoice the people they serve.
- To keep a record of consent and honour requests to stop.
- To show the client where their customers came from and what their advertising produced.
- To run the service, keep it secure and find faults.
Who it is shared with
The CRM relies on other companies to do its work. Each receives only what its job needs:
- Twilio carries text messages and calls, and stores call recordings.
- Resend delivers e-mail.
- Stripe processes payments.
- Google (Calendar, Ads, Business Profile), Meta (Ads) andMicrosoft 365 (mailbox), when the client connects those accounts.
- DeepSeek answers texts and runs the copilot when the client turns the AI features on: the conversation and the facts the client wrote about their business are sent to it. Groqtranscribes call recordings.
- Neon hosts the database and Vercel runs the application, both in the United States.
When a client connects Google Ads or Meta, the CRM reports leads and sales back to those platforms so their advertising learns who became a customer. Personal identifiers in those reports are hashed, and they are sent only for contacts who consented to advertising cookies; clients in regulated sectors can switch to sending the click identifier alone.
We do not sell personal information, and we do not share it for anyone else's marketing.
Text messages
Consent to receive texts is collected by the client and recorded in the CRM with its source and date. Reply STOP to any message to stop receiving texts from that business, and HELP for help. Phone numbers and consent records are never shared with third parties or affiliates for their marketing.
How long it stays
- Account and workspace data stays while the client's agreement is active, and for 30 days after it ends so the client can export it.
- A contact the client deletes sits in a bin for 60 days, restorable, then is erased.
- Nightly database backups are kept for 90 days, then discarded.
- Call recordings stay until the client deletes them.
Your rights
You can ask to see, correct, export or delete personal information about you. California residents have these rights under the CCPA, and we honour them for everyone. If the information was collected by one of our clients, ask that business; we act on their instructions and will not refuse a request they forward. We do not discriminate against anyone for exercising these rights.
Security
Connections are encrypted in transit. Passwords are hashed, integration credentials are encrypted at rest, and two-step sign-in is available to every account and can be required for a whole workspace. Access inside a workspace is by role, and an activity log records changes.
Children
The CRM is for businesses and is not directed at anyone under 18.
Changes
If this notice changes in a way that matters, we will tell workspace owners by e-mail. The date at the top says when it was last revised.
Contact
Larchmont Digital · Los Angeles, California · hello@larchmontdigital.com