BMD CRM

Privacy Policy

Effective September 4, 2026

This Privacy Policy describes how Superior Technical Solutions (“we,” “us,” or “our”) collects, uses, and protects information when you use BMD CRM (the “Service”), our internal customer relationship management platform available at claud-crm.vercel.app.

Who We Are

Superior Technical Solutions
291 E 1400 S Ste 8, St. George, UT 84790
john@stsutah.com

Information We Collect

When you use the Service, we may collect the following information:

  • Account information — your name, email address, and login credentials when you sign in.
  • Contact records — names, email addresses, phone numbers, company names, notes, tags, and other details about contacts and leads you or your team add to the CRM.
  • Communication data — emails, appointments, and notes created or logged through the Service.
  • Google account data — if you connect a Google account, we access Gmail and Google Calendar data through Google’s OAuth 2.0 flow. This includes sending email on your behalf, reading email metadata for CRM sync, and creating or updating calendar events.
  • Usage data — basic information about how you use the Service (pages viewed, actions taken) to help us improve it and diagnose issues.

How We Use Google User Data

When you connect a Google account, we request access to specific Gmail and Google Calendar scopes. We use this access only to provide features you have chosen to use:

  • Gmail — to send emails from your connected inbox (e.g. lead notifications, template emails, booking confirmations), and to sync recent email activity to CRM contacts.
  • Google Calendar — to create, update, and cancel calendar events for booked appointments through the Service.

We do not sell your Google user data. We do not use it for advertising. We do not use it for AI or machine learning model training. We use it solely to provide the CRM features you have chosen to enable.

BMD CRM’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How We Store and Protect Data

Data is stored in Supabase (PostgreSQL) with row-level security enabled. OAuth refresh tokens are encrypted at rest. Access to your data is restricted to authorized users of your team.

Sharing of Information

We do not sell your data. We do not share your personal information or Google user data with third parties except as needed to run the Service (for example, sending email through Google’s API on your behalf) or where required by law.

Revoking Access

You can revoke BMD CRM’s access to your Google account at any time by visiting Google Account Permissions. You can also delete your BMD CRM account by contacting us at the email above.

Data Retention

We retain your data for as long as your account is active. If you delete your account, we delete or anonymize your data within 30 days, except where retention is required by law.

Children’s Privacy

BMD CRM is not intended for use by anyone under the age of 18, and we do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Effective” date at the top and, if the changes are material, notify you through the Service.

Contact

Questions? Email us at john@stsutah.com.