Legal
Privacy policy
Last updated 27 August 2026. This covers what we hold about you, the person with the account. What you put into your CRM about other people is covered by the data processing agreement, where you are the controller.
What we hold about you
Your name, email address, and organization membership, held by WorkOS, which is our identity provider. Your billing contact and payment details, held by Stripe. We never see a card number. Your workspace name, timezone, and currency. Operational logs carrying a request id, a workspace id, and an actor id, and no customer data.
Why
To let you sign in, to give you the product, to bill you, and to keep the service running and secure. That is the whole list. We do not sell it, we do not share it for advertising, and we do not build a profile of you.
What we never do
We make no model calls anywhere in the product, so nothing you or your agents write reaches a model provider through us. We store no email bodies, transcripts, recordings, or attachments, because there is no field for them.
Who else touches it
| Company | What they process |
|---|---|
| Cloudflare | All CRM data, at rest and in transit, and the email address we send service notices to |
| WorkOS | Identity: user, organization, membership, and role |
| Stripe | Billing contact and payment data |
Your workspace runs on Cloudflare's global network and is not pinned to a region. O'Shea & Sons, LLC is a United States company, so treat processing as taking place in the United States and wherever Cloudflare operates.
How long
For as long as you have a workspace. When you delete it, the workspace is scheduled immediately and destroyed within seven days, with backups and replicas expiring within thirty-five. Billing records are kept as long as the law requires us to keep them.
Your rights
Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it, at hello@indraft.io. We answer within thirty days. If you are in the UK or the EEA you may also complain to your supervisory authority.
For the records inside your CRM, you already hold the controls: export everything from Settings whenever you want, and correct or remove any record directly.
Cookies
One session cookie, so you stay signed in. No advertising cookies and no third-party trackers. Our analytics counts page views without cookies and without following anyone between sites.
Who we are
O'Shea & Sons, LLC, an Illinois company, at hello@indraft.io. Illinois law governs this policy.