Data stays in Turkey
The application and database run on servers in Istanbul (Netlen, Tier III data center).
Trust center
How we treat your data, openly, on one page.
CRM Warden accesses your data to find the work your team forgot in the CRM. Here we set out the limits of that access: where we keep it, what we read, what we never store and how we protect it.
Reads only what it needs
Only the fields the rules need are read; notes and messages are not stored, and contact values are never written in plain form.
Never touches your records
It changes no fields and deletes no records. It only writes notifications and the tasks you approve.
Encrypted keys
CRM access keys are stored in the database encrypted with AES-256-GCM.
What do we read from your CRM?
Read and stored
- Title, stage, owner and dates of leads, deals, contacts and companies (created, last activity, expected close)
- Deal amount and currency (for priority and the month-end forecast)
- Type, owner and due date of open activities (calls, meetings, tasks)
- Users' name, email and department (to route alerts to the right person and their manager)
- Stage and source names (for readable names in reports)
Never stored
- Notes, descriptions and comments
- Email, chat and message contents; call recordings
- Your customers' postal addresses; phone numbers and emails in plain form (only an irreversible digest, for duplicate detection)
- Files and attachments
- Contents of completed activities
Written to your CRM
- In-CRM notification to the owner and their manager
- Follow-up tasks you create or approve (Pro)
Warden doesn't message anyone until you confirm in the panel that you've informed your employees.
How do we protect it?
Passwordless sign-in
You sign in with a one-time code valid for 10 minutes; the code itself is never stored. Sessions rotate on refresh.
Customer data kept apart
Every query is scoped to the customer account; managers only see their own departments. Authorisation and data access are checked by automated tests.
Encrypted connections and keys
All connections use HTTPS; CRM access keys are encrypted with AES-256-GCM using versioned keys.
Limited, audited support
Our support team can view your panel read-only for at most 30 minutes. Each access is written to your audit log by name and a banner shows in the panel.
Doesn't overload your CRM
The CRM's API limits are respected with a budget; near the limit Warden slows down so your team's work isn't disrupted.
Protected against abuse
Sign-in attempts and API requests are rate-limited; internal error details are never shown to users.
Cookie-free website
This website uses no advertising or tracking cookies; visits are counted on our own server without storing IP addresses.
Your account, your control
Download your data or delete your account from the panel; when you uninstall the app all data is deleted within 30 days.
Who is who under GDPR?
Your CRM data: you are the controller, we are the processor
Your company is the controller for the records and employee data in your CRM; CRM Warden processes that data only on your instructions and to provide the service (processor).
Account and website data: we are the controller
CRM Warden is the controller for your panel account, billing correspondence and the live chat on this website. Details are in our privacy notice.
A ready-made template for informing your employees: Employee notice template
Subprocessors
| Service | Purpose | Location |
|---|---|---|
| Netlen | Hosting: application, database and queue servers | Turkey (Istanbul) |
| Email delivery: sign-in codes, reports and notification emails |
Your CRM provider (e.g. Bitrix24, HubSpot, Zoho) is not our subprocessor: it is the service you chose and use under your own contract. We notify our customers before adding a new service to this list.
How long do we keep it?
30 days
All data after the app is uninstalled
400 days
Alert and report history (for year-on-year comparison)
180 days
Report log and website live chat
1 day
Sign-in code records (the code itself is never stored)
Expired data is deleted automatically every day. All periods: KVKK privacy notice
Agreements and requests
Data processing agreement (DPA)
Request a signed data processing agreement and a list of technical and organisational measures for your company; we will send them to you.
Request the DPAPersonal data requests
Write to us to exercise your rights under the GDPR and KVKK; we respond within 30 days at the latest.
Reporting a vulnerability
If you've found a security vulnerability, please tell us first and don't disclose it until we've fixed it. We review every report and get back to you.