Privacy Policy

DevOpser CRM · operated by DevOpser · Last updated 5 November 2026

This policy explains what personal data DevOpser CRM (the “Service”) collects, why, who processes it for us, how long we keep it, and how you can make a request about it.

1 · What we collect

• Account data: your name, email address, a hashed password (if you set one), multi-factor authentication settings, and Google account identifier if you sign in with Google.
• Data you collect with the Service: form submissions, contacts, subscribers, and the emails you send through it. For this data you are the controller and we process it on your behalf.
• Billing data: if you take a paid plan, your subscription status. Card details are handled by Stripe and never reach our servers.
• Technical data: a session cookie to keep you signed in, and short-lived request data (such as your IP address, used only for rate limiting and abuse protection).
• Email events: bounces and complaints for messages sent through the Service, so we can suppress bad addresses.

2 · Why we use it

• To provide the Service: sign-in, storing your forms and contacts, and sending the emails you ask us to send.
• To keep the Service secure and reliable: authentication, rate limiting, abuse prevention, and troubleshooting.
• To bill you, where you choose a paid plan.
• To contact you about your account (for example sign-in codes and important service notices).

We do not sell personal data and we do not use it for advertising.

3 · Who processes your data

We use these providers to run the Service. Each processes data only on our instructions. For each one we list what it receives and why:

• Amazon Web Services (United States, US East region): hosting, database, cache, email delivery (SES), logging, tracing and secrets storage.
  • AWS App Runner runs the Service, behind the AWS WAF firewall. It receives every request you or your form visitors make, including IP address, browser details and whatever is submitted, so the Service can respond and so abusive traffic can be blocked.
  • Amazon RDS for PostgreSQL is the database. It stores your account data and the data you collect with the Service (forms, submissions, contacts, subscribers, the emails you send and AI chat conversations).
  • Amazon ElastiCache for Redis is the cache. It holds sign-in sessions, rate-limit counters keyed on IP address, and recent AI chat history.
  • Amazon CloudWatch Logs stores operational logs used for troubleshooting and security. Access log lines record the request method, route, status and response time, without IP addresses, headers or query strings; application messages can contain identifiers such as an account ID or email address when needed to diagnose an error.
  • AWS X-Ray tracing is enabled on the App Runner service, so request traces (paths, timings and errors) can be recorded to diagnose slow or failing requests.
  • AWS Secrets Manager holds the Service’s own credentials and keys, such as database passwords and the key that encrypts connected-mailbox tokens.
• Amazon Simple Email Service (SES) (AWS): sends the email that leaves the Service. It receives the sender and recipient addresses, subject, message content and reply-to address of each message, and reports back bounces and complaints so we can suppress bad addresses. It sends our own messages to you (sign-in codes, form notifications and service notices). It also sends your mailing lists on your behalf: when you send a broadcast or an autoresponder, your recipients’ addresses and your message go through the same provider, from the sender address or domain you verified, which is registered with SES for that purpose.
• Amazon Bedrock (AWS): AI features, where you use them. AI requests are processed within the United States and may be routed to other US regions by Amazon Bedrock. For an AI email draft, only the draft prompt you type is sent, together with our fixed drafting instructions; no contacts, subscribers or submissions are included. In the AI chat, the messages of the current conversation, including earlier turns, are sent with each new message. Prompts are not used to train the models.
• Stripe: payment processing for paid plans. It receives your name, email address, account ID and chosen plan so it can bill your subscription. Card details are entered on Stripe’s own checkout page.
• Google: sign-in, only if you choose “Sign in with Google” (we receive your Google account ID, email address and name), and sending email through your Gmail account, only if you connect it as your mailbox (the messages you send, with their recipients, go through Gmail using send-only access).
• Microsoft: sending email through your Outlook account, only if you connect it as your mailbox (the messages you send, with their recipients, go through Microsoft using send-only access).
• Telemetry provider: where configured, operational traces (request paths, timings and errors, without request bodies) are exported over OpenTelemetry to the monitoring provider we use.

If you add a webhook address to one of your forms, each submission is also sent to that address. You choose that destination, so it acts for you, not for us.

The site sets no third-party trackers: there are no analytics, advertising or social media tracking scripts or pixels on its pages.

4 · Retention

• Account data and the data you collect are kept while your account is active.
• When you delete your account (Account → Delete account), we immediately delete your leads and API keys, take your sites offline (they are set to draft and kept), and anonymise your account record by removing your name, email address, Google identifier, profile picture and multi-factor settings. Your forms, form submissions, contacts, subscribers and the emails you sent are kept. To have that remaining data erased, email info@devopser.io from the address on your account.
• Database backups roll over and are kept for up to 7 days, so erased data leaves backups within that window.
• Sessions expire when you sign out or after a period of inactivity. Rate-limit counters keyed on IP address expire within about 15 minutes.
• Operational logs are kept only as long as needed to run and secure the Service.

5 · Your rights and how to make a request

You can ask to access, correct, export, or delete your personal data, or object to how we use it. Email info@devopser.io from the address on your account and we will reply within 30 days. If you are a contact of one of our customers, please contact that customer first; we will help them respond. You may also complain to your local data protection authority.

6 · Security

Connections to the Service use HTTPS, the database and its backups are encrypted at rest, passwords are stored only as salted hashes, access to production is restricted, and secrets are held in a managed secrets store.

7 · Changes

We may update this policy as the Service evolves and will post the new version on this page.