1. Scope
This policy applies to Gama CRM, its dashboards, APIs, messaging integrations, the Gama CRM App mobile application and business users.
2. Information we collect
- Business account information (company, plan, billing).
- Contact and system-user information.
- Security and session metadata such as IP address, browser/user-agent, login time and session status.
- End-user contact and messaging data processed on behalf of our customers.
3. Use of data
Data is used to operate the platform, manage conversations and contacts, provide integrations, support customers and maintain the security of the service.
4. WhatsApp and Meta integration
Gama CRM may process information through WhatsApp Business Platform / Cloud API when customers connect their business assets. The customer is responsible for having appropriate consent and legal basis to contact its users.
5. Data sharing
We do not sell personal data. Data may be processed by infrastructure, communications and other essential service providers necessary to deliver the service.
6. Security
We use access controls, tenant isolation and operational monitoring to protect the platform. To reduce credential sharing and unauthorized concurrent access, each Gama CRM user can keep only one active session per access type (web and mobile app); a new sign-in of the same type ends the previous session.
7. Data retention
Data may be retained while an account is active, as necessary to deliver services, or when required by law.
8. Rights and requests
Customers may request access, correction, export or deletion of eligible data by contacting support. See also our Data Deletion page.
9. International processing
Data may be processed outside the customer's country where infrastructure or service providers operate.
10. Changes to this policy
We may update this policy when necessary. Material changes will be communicated through reasonable means and the current version will be published on this site.
11. Mobile application (Gama CRM App)
The app lets users authorized by each company handle conversations from their device. It only accesses the camera, microphone, photos or files when the user requests it to send content, and that content is transmitted encrypted to the platform. To deliver push notifications, the app registers a device identifier, the device model and the app version through Expo and Google Firebase Cloud Messaging. Session credentials are stored encrypted on the device and removed on sign-out. The app contains no advertising or tracking tools and is not intended for anyone under 18. Permissions can be revoked at any time in the device settings.