Privacy Policy
This Privacy Policy explains what information Headway ("we", "us", "our") collects when you use Marshal CRM (the "Service"), how we use it, how we share and protect it, how long we keep it, and the choices you have. It includes a dedicated section on data we receive from Google when you connect Google Calendar.
1. Who we are
Marshal CRM is a customer relationship management application for sales teams, operated by Headway (headway.co.ls) in the Kingdom of Lesotho. Contact: support@headway.co.ls.
Organisations ("customers") use Marshal CRM to manage their own leads, contacts, companies, deals and activities. For that customer data, the organisation is the controller and we process it on its behalf and on its instructions. For information about the people who sign in to the Service (users), including data from connected Google accounts, we are the controller.
2. Information we collect
2.1 Information you give us
- Account information: name, title, email address, phone number, password (stored only as a one-way hash), role, organisation, and an optional profile picture.
- Customer data you enter: leads, contacts, companies, deals, products, activities (calls, meetings, tasks, emails), notes, comments, file attachments, and messages, including the names, email addresses and phone numbers of your own contacts.
- Support communications: what you send us when you contact us.
2.2 Information from connected services
- Google Calendar (optional, only if you connect it): see section 4.
- Microsoft Outlook calendar (optional, only if you connect it): your Microsoft account email address and access tokens that let the Service create and manage calendar events for your CRM activities.
2.3 Information collected automatically
- Device and notification data: if you allow push notifications in the mobile app, we store your device's push token and your notification preferences.
- Technical data: IP address, browser and device type, and request and error logs. We keep these for security, abuse prevention and troubleshooting.
- Browser storage: the web app keeps your sign-in session and a few preferences (such as theme and filters) in your browser's local storage. We do not use advertising or third-party tracking cookies.
3. How we use information
- To provide the Service: store and show your organisation's data, run automations and workflows, send activity reminders and notifications, and send the emails you ask us to send.
- To keep accounts secure: authentication, password resets, account lockout, preventing abuse and investigating incidents.
- To support you: respond to requests and tell you about important changes to the Service.
- To keep the Service reliable: monitor performance and fix errors, using operational data.
We do not sell personal information. We do not use customer data or Google user data for advertising, and we do not build marketing profiles.
4. Google user data (Google Calendar)
Connecting Google Calendar is optional. A user connects it from Settings → Integrations so that meetings and other activities scheduled in Marshal CRM appear in that user's own Google Calendar.
4.1 What data we access
| Permission (scope) | What it lets us do | Why we need it |
|---|---|---|
openid, email (userinfo.email) | Read the email address of the Google account you connect. | To show which Google account is connected, and to make sure you don't receive invitations to your own events. |
https://www.googleapis.com/auth/calendar.events | Create, update and delete events in your primary Google Calendar. | To add each meeting or activity you schedule in Marshal CRM to your calendar (title, start and end time, description with a link back to the deal, attendee email addresses, and a Google Meet link when you ask for one), to update the event when you reschedule or edit the activity, and to cancel it when the activity is deleted. |
We only act on events that Marshal CRM itself creates. We do not read, list, copy or analyse your other calendar events, and we do not access your Gmail, contacts, Drive or any other Google data.
4.2 How we use Google user data
- Only to provide and improve the user-facing calendar features described above, which the user starts and controls.
- Never for advertising, retargeting or personalised ads, and never to determine credit-worthiness or for lending.
- Never sold, and never transferred to third parties except as needed to provide these features, to comply with law, or as part of a merger or acquisition with notice to users.
- Never used to train or improve artificial-intelligence or machine-learning models.
- No human at Headway reads it, unless you ask us to for support and agree to it, it is needed for security (for example, investigating abuse), or the law requires it.
Limited Use: Marshal CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4.3 How we store and protect it
- OAuth tokens (the access and refresh tokens that let the Service call Google Calendar for you) are encrypted at rest with AES-256-GCM, kept on our servers only, never shown in the app, and never shared.
- Event references: for each synced activity we store the Google event ID, its calendar link, the Meet link (if any), and the sync status, so we can update or cancel the event later.
- The connected account's email address is stored to show which account is linked.
- All traffic to Google and to our Service uses encrypted HTTPS connections.
4.4 Sharing
Google user data is used only inside Marshal CRM to sync your calendar. Event details you create, such as the title, time and attendees, are sent to Google to create the event. Google then sends the invitations to the attendees you chose. Other users in your organisation can see the CRM activity and its meeting link, as they can for any activity they have permission to view; they cannot access your Google account.
4.5 Retention and deletion
- Disconnect at any time under Settings → Integrations → Disconnect. We then revoke the access with Google and delete the stored tokens immediately.
- You can also remove access from your Google Account at myaccount.google.com/permissions. The Service will then stop syncing and ask you to reconnect.
- Event references stored on CRM activities are deleted when the activity is deleted, or when your organisation's data is deleted.
- Events already created in your Google Calendar stay there until you or the Service delete them. Deleting the CRM activity cancels its event.
- To have all your Google-related data deleted, email support@headway.co.ls. We act on deletion requests within 30 days.
5. How we share information
We share personal information only with service providers that help us run the Service, and only as needed:
- Hosting and database infrastructure that stores the Service's data.
- Our email provider, for account emails and the emails you send from the Service.
- Expo, to deliver push notifications to the mobile app.
- Google and Microsoft, only when you choose to connect a calendar, and only as described above.
We may disclose information when the law requires it, or to protect the rights, property or safety of our users or others. Within your organisation, users can see the data your organisation stores, according to the roles and permissions your administrators set.
6. Data retention
We keep customer data for as long as the organisation's account is active, or until the organisation deletes it. After an account is closed, we delete or anonymise its data within 90 days, unless we must keep it longer by law. Technical logs are kept only for a limited period, for security and troubleshooting. Calendar connection data is handled as described in section 4.5.
7. Security
Data is encrypted in transit (HTTPS). Each organisation's data is kept separate at the database level with row-level security. Passwords are stored as one-way hashes, and third-party tokens are encrypted. Access to production systems is restricted. No system is perfectly secure, but we work to protect your information, and we will notify affected customers of a breach as the law requires.
8. Your rights and choices
Subject to the Data Protection Act, 2011 of the Kingdom of Lesotho and other applicable laws, you may ask to access, correct, export or delete your personal information, or object to how we use it. You can update most account details in the app, and you can disconnect calendars at any time. If your information is held by an organisation that uses Marshal CRM, please contact that organisation first; we will help it respond. To make a request, email support@headway.co.ls.
9. Children
The Service is meant for businesses and is not directed at children under 18. We do not knowingly collect information from children.
10. International transfers
Some of our service providers, including Google and Microsoft, may process data outside Lesotho. Where they do, we take steps to make sure the information stays protected in line with this policy.
11. Changes to this policy
We may update this policy. When we make material changes, we will update the effective date above and let users know in the Service or by email before the changes take effect.
12. Contact us
Headway, operator of Marshal CRM · Email: support@headway.co.ls · Website: headway.co.ls