Privacy Policy

Account data is information about the people who use Core Sales — names, work email addresses, phone numbers, profile photos, roles and sign-in activity. We are the controller of this data.

Customer data is what your organisation puts into the Service about its own customers — contact details, appointments, quotes, call recordings, transcripts and reports. Your organisation is the controller of this data. We process it on your instructions, and this policy describes how.

• Account details you give us: your name, work email, phone number, company name and password.
• Content you create in the Service: customers, appointments, catalogue items, presentations, results and notes.
• Audio recordings and their transcripts, where your organisation uses the recording feature.
• Usage and device information: pages visited, actions taken, IP address, browser or device type, and timestamps.
• Diagnostic records: error reports and audit entries showing which account performed which action, and when.

We do not use cookies for advertising and we do not run third-party advertising trackers. The cookies we set are the ones needed to keep you signed in.

• To provide the Service: authenticate you, separate each company’s data, and deliver the features you use.
• To transcribe recordings and generate reports, where your organisation has enabled those features.
• To send transactional messages: invitations, password resets, and campaign messages your organisation sends to its own customers.
• To keep the Service secure: detect abuse, enforce usage limits, and investigate incidents.
• To support you, fix faults, and improve reliability and performance.
• To meet legal, accounting and tax obligations.

We do not sell personal information, and we do not share it with data brokers.

We share data with service providers who process it on our behalf, under contract, and only to run the Service:

• Supabase — database, authentication and file storage.
• Deepgram — speech-to-text transcription of call recordings.
• OpenAI — generation of written reports and summaries.
• Resend — delivery of transactional and campaign email.
• Twilio — delivery of SMS messages, where your organisation sends them.
• Railway and Vercel — hosting of the application and its background workers.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If our business is transferred, data may move with it, and this policy will continue to apply until it is replaced.

Our providers operate internationally, so personal information may be processed in a country other than your own. Where data leaves its country of origin, we rely on the safeguards offered by those providers, such as standard contractual clauses.

We keep account and customer data for as long as your organisation has an account. After an account closes, we delete or anonymise the data in the ordinary course, except where we must keep records to meet a legal obligation or to resolve a dispute.

Diagnostic and audit records are kept on a shorter schedule, sufficient for security investigation and support.

Access is separated by company at the database level, so one organisation cannot read another’s data. Data is encrypted in transit, credentials for third-party services are stored encrypted, and file downloads use short-lived links rather than public addresses.

No system is completely secure. If you believe an account or data has been compromised, tell us promptly through Report a problem in the app, or ask your organisation’s administrator to raise it with us.

Where the recording feature is used, audio and transcripts are stored against the appointment they belong to and are visible to authorised users in that organisation, in line with their role.

Obtaining consent to record is the responsibility of the organisation doing the recording, as set out in our Terms & Conditions. If you were recorded and want the recording removed, contact the company you met with; they control that data. You may also contact us and we will pass the request on.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to complain to a data protection authority.

If you use Core Sales through an employer, ask them first — they control your account and most of the data. For account data we control, send the request through Report a problem in the app, or have your administrator pass it to us, and we will respond within the period the applicable law allows.

Core Sales is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.

We may update this policy. When we make a material change we will give notice through the Service or by email before it takes effect, and we will update the date at the top of this page.

Questions about this policy, or about how your data is handled, can be raised through Report a problem in the app, or with your organisation’s administrator, who can pass them to us.