Privacy Policy

This policy explains how Anvil CRM handles personal data. It covers our website at anvilcrm.com, the Anvil CRM application at app.anvilcrm.com, the Anvil connector that lets AI assistants work with your CRM data, and the Anvil CRM Quick Capture browser extension. Together we call these the "Service".

Who We Are

AnvilCRM is a trading name of Twelvebit Technology Ltd, a company registered in England and Wales with company number 14829331, whose registered office is at Fifth Floor, 167-169 Great Portland Street, London, W1W 5PF, United Kingdom. In this policy, "AnvilCRM", "Anvil", "we", "us", and "our" mean Twelvebit Technology Ltd.

For questions about this policy or your personal data, email support@anvilcrm.com.

Our Role

Anvil is a business tool. Our role depends on the kind of data:

• We are the controller of data about our own users and visitors: account and sign-in data, billing records, website and analytics data, and messages you send us.
• We are a processor of the CRM content that a customer stores in its workspace, such as the names and contact details of its own contacts, leads, and customers. The customer that owns the workspace is the controller of that data. We process it only to provide the Service to that customer and on its instructions.

If your details are in a workspace that belongs to another company and you want to exercise your privacy rights, please contact that company first. If you contact us, we will pass your request to them where we can.

Personal Data We Collect

Account data

• Your name, email address, and profile picture.
• Your password, which we store only as a secure hash, and whether you have verified your email address.
• If you sign in with Google: your Google account identifier, name, email address, and profile picture, and the sign-in tokens that Google issues. We encrypt these tokens before we store them.
• If you turn on two-factor authentication: the secret for your authenticator app and your backup codes, which we encrypt.
• Your preferences, such as time zone and date format, and the answers you give during onboarding, such as your role, company size, industry, and how you heard about us.

Sign-in and security data

• Session records, which include the IP address and browser user agent of the device that signed in, and the time of your last sign-in.
• One-time sign-in and verification codes, which we store only in hashed form and which expire after a short time.
• Short-lived counters, keyed by IP address or email address, that we use to limit repeated sign-in and email requests.

Workspace and membership data

• Workspace names, the members of each workspace, their roles, groups, and permissions.
• Invitations, including the email address of the person invited.
• In-app notifications and your notification preferences.
• A history of changes to CRM records, which shows which member made each change and when.

CRM content

Workspace members decide what to store in the CRM. This usually includes personal data about other people, for example:

• Contacts and people: names, email addresses, phone numbers, job titles, companies, addresses, and website or social profile links.
• Companies, leads, deals, products, pipelines, and the amounts, currencies, and dates attached to them.
• Activities such as tasks, calls, meetings, and emails, including their attendees, and notes and comments.
• Custom fields and custom objects that a workspace creates.
• Files that members upload, such as attachments and profile pictures, and the file name, type, and size of each file.
• Data that members import from spreadsheets or export to CSV files.

Support tickets and inbound email

If a workspace uses the ticketing feature, emails sent to its support address become tickets. We store the sender's name and email address, the subject, the message text, the original email content, and email thread identifiers. We also send ticket emails on behalf of the workspace.

Google Calendar data

If you connect Google Calendar, we store the email address of the connected Google account, encrypted access tokens, and sync status. Anvil creates a dedicated "Anvil CRM" calendar in your Google account. It syncs CRM meetings and tasks with that calendar, including titles, descriptions, times, locations, attendees, and meeting links.

We use Google user data only to provide the calendar sync that you turn on. We do not sell it, we do not use it for advertising, and we do not use it to train AI models.

Billing data

Our payment provider, Dodo Payments, collects and processes your card and payment details. We do not receive or store full card numbers. We send Dodo Payments the name and email address of the person who starts a checkout and the workspace name. We keep the plan, seat count, subscription status, billing dates, and the reference identifiers that Dodo Payments gives us. When Dodo Payments notifies us of a payment event, we keep only a minimal receipt. We do not keep the notification content, addresses, or payment details.

AI assistant connection data

If you connect an AI assistant to Anvil, we keep a record of the connection and a log of the assistant's tool calls. The section "AI Assistants Connected to Anvil" below explains what these records contain.

Website, analytics, and referral data

• Google Analytics on the website and in the app records the pages you view, the buttons you click, your browser and device type, and your approximate location. We remove query strings from page addresses before we send them, except campaign parameters. We do not load analytics on password-reset or invitation pages.
• In the app, we also send Google Analytics a random account identifier, your workspace plan, and whether you are a workspace admin. We do not send your name or email address to Google Analytics.
• twelvebit analytics on the website records the pages you view, the website you came from, your browser and screen width, and your approximate location. It sets a random visitor identifier in a cookie that the app can read. When you create an account, create a workspace, start a checkout, or start a paid plan, the app server sends twelvebit that event with the visitor identifier and the plan. We do not load twelvebit in the app, and we do not send twelvebit your name, your email address, or your workspace data. We pass the visitor identifier to Dodo Payments when you pay, so that twelvebit can link the payment to your visit.
• If you arrive through an affiliate link, our affiliate partner Affonso stores a referral cookie. When you create a new account, we send Affonso your name, email address, and account identifier so that it can credit the affiliate who referred you. We also pass the referral identifier to Dodo Payments when you pay.
• Our servers and our network provider record technical data, such as IP addresses and request times, to deliver and protect the Service.

Messages you send us

If you use our contact form, enterprise enquiry form, or in-app feature request form, or email us, we receive your name (where you give it), email address, company website (for enquiries), and the content of your message.

Free quote and invoice tools

The free quote, estimate, and invoice tools on the website run in your browser. What you type, including your customer's details, stays in your browser's storage and is not sent to us. If you choose "Track this quote in Anvil", we receive the quote without its logo and keep it for up to 24 hours, until you sign in and add it to your workspace. We delete it when it is added or when the 24 hours end.

Quick Capture browser extension

The Anvil CRM Quick Capture extension for Google Chrome reads the web page in your current tab only when you click its button. It uses Chrome's "activeTab" and "scripting" permissions and cannot read your other tabs. On that page, or only in the text you selected, it looks for email addresses, phone numbers, names, the company name, and the website, and shows them in its popup.

• The extension stores nothing. It sends nothing to us or to anyone else in the background.
• The details leave the popup only when you act. "Save to Anvil" opens the Anvil app with the details in the page address, and you check them before you save. "Copy" puts them on your clipboard. "Download CSV" saves a file on your computer.
• Details that you save in Anvil become CRM content, and we handle them as described under "CRM content" above.
• We do not use these details for advertising, we do not sell them, and we do not use them to decide creditworthiness.

How We Use Personal Data

We use personal data to:

• Provide the Service: create accounts, sign you in, run workspaces, store and show CRM content, and run the features and integrations that you turn on.
• Send service emails: sign-in and verification codes, password resets, invitations, welcome messages, scheduled reports, and ticket emails.
• Take payments and manage subscriptions.
• Answer support requests, enquiries, and feature requests.
• Keep the Service secure: prevent abuse, limit repeated requests, investigate incidents, and keep audit records.
• Understand how people use the website and the app so that we can improve them, and measure our marketing and affiliate programme.
• Meet our legal obligations and enforce our terms.

We do not sell personal data. We do not use CRM content to train AI models. We do not use CRM content for our own marketing.

Legal bases

Where data protection law requires a legal basis, we rely on:

• Contract, to provide the Service that you or your organization signed up for.
• Legitimate interests, for security, fraud prevention, support, analytics, product improvement, and our affiliate programme.
• Consent, where the law requires it, for example for optional integrations. You can withdraw consent at any time.
• Legal obligation, where we must keep or disclose data by law.

For CRM content, we act on the instructions of the workspace customer, which is responsible for its own legal basis.

AI Assistants Connected to Anvil

Anvil provides a connector that uses the Model Context Protocol (MCP). With it, a workspace member can connect an AI assistant, such as ChatGPT, Claude, or Cursor, to Anvil. This is how it works:

• An admin must allow it. A workspace admin must first turn on "Allow agents in this workspace". Assistants are read-only until an admin also turns on "Allow agents to write".
• You choose what to share. You sign in to Anvil and approve the connection on a consent screen. There you choose the workspaces the assistant can use and the access it gets: read, write, or delete.
• It acts as you. The assistant can never do more than you can. Anvil checks your role, record permissions, and pipeline visibility on every request.
• Data goes to the assistant's provider. When the assistant reads data from Anvil, we send that data to the assistant, and so to the company that provides it, such as OpenAI, Anthropic, or Cursor. This can include your name and email address, your workspace names, and the CRM content that the assistant asks for, such as contacts' names, email addresses, phone numbers, job titles, companies, deals, activities, notes, comments, and record history. That company handles the data under its own terms and privacy policy, not this one. Please read them before you connect.
• What we keep. We keep a record of each connection: the assistant's name, the workspaces and access you approved, and when it was connected, last used, and disconnected. We also keep a log of each tool call. The log shows the connection, the member, the assistant, the tool name, the result, the duration, the time, and the identifiers of the records involved. The log never contains your prompts, the data that the assistant sent, or the field values that Anvil returned.
• How long. We delete tool-call log entries automatically 90 days after the call. Workspace admins can see a summary of recent agent use.
• How to stop it. Go to Settings, then Integrations. There you can remove one workspace from a connection or disconnect the assistant from every workspace. A workspace admin can disconnect any assistant in their workspace, or turn off agent access, under Settings, then AI agents. After you disconnect, the assistant cannot make further requests. Signing out of Anvil or changing your password does not disconnect an assistant, so disconnect it separately if you need to.

Who Receives Personal Data

We share personal data only with the recipients below, and only for the purposes shown. Service providers act on our instructions.

• netcup (server hosting in Germany): runs the servers that host our database and application.
• Cloudflare (network, content delivery, and security): all traffic to our website and app passes through Cloudflare.
• Vercel (Vercel Blob file storage): stores uploaded files, profile pictures, and CSV exports in private storage.
• Resend (email): sends our service emails and receives inbound support emails for workspaces that use ticketing.
• Dodo Payments (payments): processes checkouts, subscriptions, and payment details.
• Google: Google sign-in, Google Calendar sync when you connect it, and Google Analytics.
• twelvebit (analytics): our own analytics service, also operated by Twelvebit Technology Ltd. It records website visits and the signup and plan events described above.
• Affonso (affiliate tracking): records affiliate referrals and signups.
• The AI assistant provider you choose: receives the data your assistant reads, as described above.
• Other members of your workspace: see your name, email address, and activity in that workspace, according to the workspace's permissions.
• Professional advisers and authorities: when necessary to get legal or accounting advice, to meet a legal obligation, or to protect our rights and users.
• A buyer or successor: if we sell or reorganize our business, under the protections of this policy.

International Transfers

Our database and application servers are in Germany. Some of the providers listed above, including Cloudflare, Vercel, Resend, and Google, are based in the United States or process data in other countries. When we transfer personal data out of the UK or the European Economic Area, we rely on an adequacy decision or on safeguards such as the standard contractual clauses in our providers' data processing terms.

How Long We Keep Data

• Account data: while your account is active. When you ask us to delete your account, we delete it from our live systems.
• Sign-in sessions: a session expires 14 days after it was last renewed. It renews at most once a day while you use the Service. Verification codes expire after a short time.
• CRM content: until a workspace member deletes it, or until the workspace is deleted. When a member deletes a CRM record, we keep it and its attachments for 30 days, and then we delete them permanently.
• Quotes sent from the free quote tool: until you add the quote to your workspace, and never more than 24 hours.
• Import details: we delete the record of a finished spreadsheet import, including its row-level errors, 90 days after the import.
• AI assistant tool-call log: 90 days, then deleted automatically. The record of each connection stays while the workspace exists, so admins can see which assistants had access.
• Google Calendar tokens: until you disconnect Google Calendar. When you disconnect, we ask Google to revoke access and we delete the stored tokens. Meetings and tasks that were already synced stay in the CRM as activities.
• Billing records: while the workspace exists, and afterwards as long as tax and accounting law requires.
• Messages you send us: as long as we need them to answer you and keep a record of our support history.
• Analytics data: kept by Google Analytics for the retention period set in our Google Analytics account, and by twelvebit for the retention period of our twelvebit plan.
• Affiliate referral cookie: 90 days.
• Backups: our backups are encrypted and we keep each one for 14 days. Deleted data can remain in a backup until that backup is deleted, at most 14 days later.

Your Controls

• Profile: change your name, profile picture, and preferences in the app. Reset your password from the sign-in page.
• Two-factor authentication: turn it on or off in your account settings.
• AI assistants: remove or disconnect them under Settings, then Integrations. Admins can also use Settings, then AI agents.
• Google Calendar: disconnect it under Settings, then Integrations. You can also remove Anvil's access in your Google account settings.
• Notifications: choose which in-app notifications you receive in your settings.
• Export: export CRM records to CSV files, where your role and plan allow it.
• Correction and deletion: edit or delete CRM records in the app. To delete your account or a whole workspace, email support@anvilcrm.com.
• Cookies: block or delete cookies in your browser settings, as described below.

Cookies

• Essential cookies: keep you signed in, protect your session, and complete the Google Calendar connection. The Service does not work without them.
• Analytics cookies: Google Analytics cookies on the website and in the app, and the twelvebit visitor and session cookies, set by the website and read by the app.
• Affiliate cookie: the Affonso referral cookie, set when you arrive through an affiliate link.

We do not use advertising cookies. You can block or delete cookies in your browser. If you block essential cookies, you cannot sign in.

Your Privacy Rights

Depending on where you live, including the UK and the European Economic Area, you have these rights over personal data for which we are the controller:

• The right to access: ask for a copy of your personal data.
• The right to rectification: ask us to correct data that is wrong or incomplete.
• The right to erasure: ask us to delete your data, unless we must keep it by law.
• The right to restrict processing: ask us to limit how we use your data.
• The right to object to processing: object to processing based on our legitimate interests.
• The right to data portability: receive your data in a common machine-readable format.
• The right to withdraw consent: where we rely on consent, withdraw it at any time.

To use these rights, email support@anvilcrm.com. We may ask you to confirm your identity. We answer within one month and do not charge a fee. For CRM content, we pass your request to the workspace customer that controls it. You can also complain to the data protection authority in the country where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk).

California Privacy Rights

If you live in California, you can ask us to tell you which categories and specific pieces of personal information we collected about you, to delete it, and to correct it. We will not treat you differently because you use these rights. We do not sell personal information. To make a request, email support@anvilcrm.com.

Security

We protect personal data with encryption in transit, encrypted storage of sign-in and calendar tokens, hashed passwords and codes, optional two-factor authentication, role-based permissions, and strict separation between workspaces at the database level. No online service is completely secure. Read more on our Security page.

Children

The Service is for business use. It is not directed at children under 16, and we do not knowingly collect personal data from them. If you think a child has given us personal data, email support@anvilcrm.com and we will delete it.

Changes to This Policy

We may update this policy when the Service or the law changes. We change the date at the top of this page each time. If a change is significant, we also tell account holders by email or in the app before it takes effect.

Contact Us

Email support@anvilcrm.com, or write to Twelvebit Technology Ltd, Fifth Floor, 167-169 Great Portland Street, London, W1W 5PF, United Kingdom.