Legal
Privacy Policy
This policy explains what personal information SpexCRM collects, how we use it, and the choices you have. It applies to visitors of our website and to businesses ("Organizations") and their users who sign up for the SpexCRM platform.
Information We Collect
- Account information — name, email address, phone number, and password when you register.
- Organization & business data — company details, and the client, contact, project, and invoicing information your team enters into the platform while using it.
- Billing information — subscription payments are processed by Paystack. We do not store your card details ourselves; Paystack handles and secures that information under its own privacy and security practices.
- Communications — messages sent via the platform's WhatsApp (via Twilio) and email (via Elastic Email) features, so we can deliver and log them on your behalf.
- Usage & technical data — log data, error reports, and basic session information used to keep the platform secure and working correctly.
How We Use Information
- To provide, maintain, and secure the SpexCRM platform for your Organization.
- To process payments and manage your subscription.
- To send transactional communications — account notifications, invoices, password resets, and messages you send through the platform to your own clients.
- To monitor for errors and abuse, and to improve reliability and performance.
- To respond when you contact our support team.
Third Parties We Work With
We use a small number of trusted service providers to operate SpexCRM. Each only receives the data it needs to perform its function:
| Provider | Purpose |
|---|---|
| Paystack | Subscription billing and payment processing |
| Twilio | Sending and receiving WhatsApp messages you initiate through the platform |
| Elastic Email | Delivering transactional and account-related emails |
| Rollbar | Error tracking, so we can find and fix problems quickly |
| Open Exchange Rates | Currency conversion rates for multi-currency invoicing (no personal data involved) |
We do not sell your personal information, and we do not share your Organization's client/business data with third parties for their own marketing purposes.
Data Separation Between Organizations
SpexCRM is a multi-tenant platform: every Organization's data is logically scoped and kept separate from every other Organization's data. Users only ever see data belonging to the Organization(s) they're a member of.
Cookies
We use essential cookies to keep you logged in and to protect the platform against cross-site request forgery. We do not use third-party advertising or tracking cookies.
Data Retention
We retain your Organization's data for as long as your subscription is active. If you cancel, your data is retained for 30 days afterward — long enough to reactivate or export anything you need — after which it is permanently deleted. You can export your data at any time from the platform's reporting tools.
Your Rights
Depending on your jurisdiction (including under South Africa's Protection of Personal Information Act, POPIA), you may have the right to access, correct, or request deletion of your personal information, and to object to certain uses of it. To exercise any of these rights, contact us and we'll assist you.
Security
We use industry-standard measures — including encrypted connections (HTTPS), access controls, and restricted internal access — to protect your information. No system is 100% secure, but we take reasonable steps to safeguard your data against unauthorized access, loss, or misuse.
Children's Privacy
SpexCRM is a business tool and is not directed at, or intended for use by, children.
Changes to This Policy
We may update this policy from time to time. If we make material changes, we'll notify Organization owners by email or via a notice on the platform.
Contact Us
Questions about this policy or your data? Get in touch and we'll help.
Last updated: 28 September 2026