Skip to content
firstmovercrm

Policy

Privacy Policy

This policy describes firstmovercrm, operated by firstmovercrm. A registered legal entity name and postal address are not stored in the application and must be confirmed before this policy is used as a final legal notice.

Who this applies to

The platform hosts separate company workspaces. A real estate company and its invited users are the customer. People who submit a Facebook or Instagram lead form are the leads stored inside that company's CRM.

Categories of data

  • Account data: name, email, phone, role, and a hashed password for company users and the platform operator's admin accounts.
  • CRM data: leads, clients, follow-ups, tasks, properties, projects, notes, assignments, and activity recorded in the company workspace.
  • Billing data: plan, invoice amounts, payment references, and evidence files a company submits for manual review.
  • Meta data: the Meta user identifier returned at connection, selected Page and form identifiers, campaign names saved with a form, lead field answers, and webhook processing status. Page and user tokens are encrypted before storage.
  • Technical data: session records and standard server logs needed to operate sign-in and the API.

Purposes

Data is used to provide the CRM, keep each company's records separate, authenticate users, assign work to the company's team, bill the company subscription, and import lead-form submissions the company has chosen to connect. Meta authorization is completed on Meta's screen. The customer controls which account and assets they authorize.

Sharing

Customer CRM records are shown to users of that same company according to their role. The platform operator can open the operator console for company administration and billing. Meta receives the authorization request and webhook setup for the shared Meta app. The application does not sell CRM or lead data. Hosting and database providers that run the deployed service process data on the operator's behalf.

Storage and retention

Data is stored in the application database for as long as the company workspace remains active. Disconnecting Meta removes that company's saved Pages, forms, and connection token. Leads already copied into the CRM stay until a deletion request for those records is completed. Passwords are stored as hashes. Meta tokens are encrypted at rest in the application database.

Security practices

Company APIs require a signed token, and the company id comes from the user record rather than from a value typed by the browser. Permissions limit module access. This policy does not claim that the service is certified, fully compliant, or encrypted in every layer. HTTPS should be used on the public production domain; that depends on the deployment, not on a setting in the marketing pages.

Requests

Deletion steps are on the User Data Deletion page. Questions can be sent from the Contact page. A public support email has not been configured yet.