Privacy Policy

1. Who we are

Fifi CRM (“Fifi”) is a customer relationship manager for small teams, available at fetchfifi.com and app.fetchfifi.com. It’s run by CorporateMutt, LLC (“CorporateMutt”, “we”, “us”), a New Jersey limited liability company, at 740 Tutor Lane, Williamstown, NJ 08094, United States. Fifi is offered to customers in the United States.

This policy covers the Fifi website and app. Our Terms of Service also apply when you use Fifi.

For privacy questions and requests, contact our Privacy Lead, CorporateMutt, LLC, at support@fetchfifi.com.

2. Our role: controller and processor

Fifi handles two kinds of personal information, and our role is different for each:

• Account information is about you as a Fifi user, such as your name, email address and sign-in history, and the support tickets, security logs and texting registration fee agreements that go with your account or workspace. CorporateMutt decides how it’s used, so we’re its controller.
• Workspace content is what a team puts in its workspace: contacts, companies, deals, tasks, the timeline (including the photos a team adds to it) and tags, invoices, service and boarding records, and any email or texts Fifi stores for it, for example from a connected Gmail or Microsoft 365 / Outlook mailbox. The organization that uses the workspace (our customer) decides what goes in and why, so it’s the controller. CorporateMutt is its processor (sometimes called a “service provider”): we handle that content only on the customer’s behalf, to run Fifi for them. We don’t sell it or share it for advertising, and we don’t use it for any other purpose or combine it with other data, except as the law allows a service provider to (for example, to keep Fifi secure).

If your organization needs a data processing agreement (DPA) with us, for example to meet a US state privacy law’s requirements for service providers, email support@fetchfifi.com.

If you’re in someone else’s workspace, for example as one of their contacts, see If you’re in a Fifi workspace.

3. What we collect

Account information

• Your name and email address, and your profile photo link if you sign in with Google. Fifi accepts only verified email addresses, and not Apple’s “Hide My Email” relay addresses.
• Which sign-in methods you’ve linked (Google or Apple) and the account identifiers they give us. We never receive or store a password.
• Your timezone, taken from your browser when you set up and changeable in your profile, so “today” and “overdue” are right for you.
• Your workspaces and roles, your daily digest setting for each, and the invitations you send and receive.

Sign-in and security information

• Sessions: for each device where you’re signed in, its IP address, browser details (the “user agent”), and when the session started and was last used. You can see them in Settings → Sessions.
• Sign-in history: each sign-in is recorded with its time, IP address and a device label such as “Chrome on macOS”. We use it to recognize new devices and email you when one signs in.
• Email codes: if you sign in with an email code, we keep the address it was sent to, a one-way hash of the code (never the code itself) and how many wrong attempts were made. A code works once, expires after 10 minutes, and stops working after at most 5 wrong attempts.
• Bot checks: the sign-in page, booking forms and workspaces’ forms use Cloudflare Turnstile. Cloudflare receives your IP address and technical signals from your browser to tell people from bots.
• Rate limits: to stop abuse, we count recent requests using a one-way hash of your IP address or email address, never the address itself.
• API keys: for each key a workspace’s owners and admins create, its name, its access, who created it, when it expires, and when and from which IP address it was last used, shown to owners and admins in Settings → API. Fifi stores only a one-way hash of the key itself.
• Webhooks: for each webhook a workspace’s owners and admins add, its address, description, events and who added it, and its signing secret (encrypted). For each event sent, a copy of what was sent and, for each attempt, the response’s status code and how long it took; never the response itself.

Workspace content

Whatever your team adds to a workspace: contacts (names, email addresses, phone numbers, job titles, lead status and source), companies (names, domains, industries, phone numbers, addresses and notes), deals, tasks, notes, calls and meetings on the timeline, photos added to the timeline (see Photos on timelines), tags and custom fields. Depending on the modules a workspace uses, it can also include invoices and payments, service records, pets and boarding stays, and loads. This includes contacts and companies imported from CSV files.

Fifi isn’t designed for sensitive information such as health records, government ID numbers or full payment card numbers, and workspaces shouldn’t put it in (see our Terms).

Each record notes who created it and who last changed it. Each workspace also keeps an activity log, which its owners and admins can see, of who did what and when. It records some values as they change, such as company names, domains and industries, deal names, values and stages, tag names, members’ roles and the workspace’s name. For personal details it records only that a field changed, never the value: contacts’ names, email addresses, phone numbers and job titles; companies’ phone numbers, addresses and notes; task titles; and the text of notes, calls and meetings. Each log entry also stores the IP address the change came from, for security; Fifi doesn’t show it in the app.

Gmail data, if you connect Gmail

Each person can choose to connect their Gmail or Google Workspace mailbox to a workspace, in Settings → Email. This is separate from signing in with Google, and Google asks for your consent. Google hasn’t verified Fifi’s Gmail access, so Google shows a warning that the app is unverified before you consent, and limits the total number of people who can ever connect it (100 while the app is unverified); once that limit is reached, no more people can connect Gmail to Fifi. If you connect Gmail:

• Fifi asks Google for two permissions: to read your email (gmail.readonly) and to send email as you (gmail.send). Fifi sends only when you send an email from Fifi.
• Fifi looks at the last 90 days of your mail when you first connect, and then at new mail as it arrives. Google notifies Fifi of new mail through Google Cloud Pub/Sub, and Fifi also checks every few minutes in case a notification is missed.
• Fifi stores a message only if one of its participants matches a contact’s email address or a company’s domain in that workspace. It never stores mail between members of the same workspace, or mail involving a contact marked “do not track”. Other messages are read to make that check and then discarded, never stored.
• For each stored message, Fifi keeps the sender, recipients, date, subject, a short snippet and the plain-text body, plus Gmail’s message and thread IDs and the message’s Message-ID header, and links the conversation to the matching contacts, companies and open deals. Drafts, spam, trash and chats are never stored. Stored email is part of the workspace’s content, so other members of the workspace can see it there.
• Your Google refresh token, which lets Fifi keep access, is encrypted with AES-256-GCM, using a key kept separately from the database. Access tokens are kept in memory only, for minutes. Email addresses, subjects and message bodies never appear in our logs.
• Pictures from the internet in a stored email stay hidden until a member clicks Show images on that message. The member’s browser then loads them straight from the servers named in the email, so the sender (or their email service) can see the member’s IP address and that the images were loaded, as with any mail app.
• Email you send from Fifi goes through your Gmail account, so it appears in your Sent folder. Fifi keeps a copy with the conversation, like the email it syncs.
• You can disconnect Gmail at any time in Settings → Email. Disconnecting stops syncing, deletes the stored refresh token and asks Google to revoke Fifi’s access, unless the same Google account is still connected to Fifi elsewhere (another workspace), since revoking would cut that connection off too. Email already stored stays in the workspace unless you also choose Delete synced email, which removes every conversation synced from your mailbox into that workspace. You can also remove Fifi’s access in your Google Account settings, which stops syncing the same way. If you leave a workspace, are removed from it, or delete your account, Fifi deletes your stored Gmail token there too; when you delete your account, Fifi also asks Google to revoke its access.

See Google API Services: Limited Use for the commitments we make about data from Google.

Microsoft 365 / Outlook data, if you connect it

Instead of Gmail, each person can choose to connect a Microsoft 365 or Outlook mailbox (a work or school account, or a personal Outlook.com or Hotmail one) to a workspace, in Settings → Email. You can connect one mailbox in each workspace. Microsoft asks for your consent, and some organizations need their administrator to approve Fifi first. If you connect one:

• Fifi asks Microsoft for permission to read your email (Mail.Read) and to send email as you (Mail.Send), to keep that access without asking you again (offline_access), and to read your basic profile (User.Read, with openid, email and profile) so it knows your mailbox’s address. Fifi sends only when you send an email from Fifi.
• Fifi looks at the last 90 days of your Inbox and Sent Items when you first connect, and then at new mail in them as it arrives. Microsoft tells Fifi about new mail through Microsoft Graph change notifications, which carry identifiers and a secret code Fifi gave Microsoft, no email content; Fifi also checks every few minutes in case a notification is missed.
• Fifi decides what to store exactly as it does for Gmail: only messages with a matching contact or company, never mail only among members of the workspace, and never mail involving a contact marked “do not track”. For each stored message it keeps the same details, with Microsoft’s message and conversation IDs. Drafts, junk email, deleted items and other folders are never read.
• Your Microsoft refresh token is encrypted the same way as a Google one. Microsoft gives Fifi a new refresh token each time Fifi renews its access, and Fifi stores each new one encrypted and discards the old one.
• Email you send from Fifi is sent through your Microsoft account and appears in your Sent Items. Fifi keeps a copy with the conversation, like the email it syncs. If Microsoft doesn’t confirm that a campaign email went out, Fifi looks for it in your Sent Items, and sends it again only if it isn’t there.
• You can disconnect at any time in Settings → Email. Disconnecting stops syncing, ends Microsoft’s notifications to Fifi and deletes the stored refresh token. Microsoft doesn’t let an app hand back its own access, so Fifi then links you to your Microsoft account’s app permissions, where you can remove Fifi. Delete synced email works as it does for Gmail. If you leave a workspace, are removed from it, or delete your account, Fifi deletes your stored Microsoft token there too.

Email open tracking

Emails sent from Fifi include a tiny 1×1 image with a random, unguessable code for that message, unless the workspace has turned open tracking off. When the recipient’s mail app loads the image, Fifi records an open: when it happened, and the general kind of app that loaded it (for example Apple Mail’s privacy proxy, Google’s image proxy, Outlook or another app). Fifi doesn’t keep the IP address or the full browser details. Opens through Apple Mail Privacy Protection or Google’s image proxy are marked as uncertain, because those services can load images without anyone reading the email (Gmail also loads them when the sender looks at their own copy). Fifi records at most 50 opens a message. Email sent directly from Gmail or Outlook has no tracking image. Owners and admins can turn open tracking off in Settings → Workspace.

Marketing campaigns

A workspace can send one campaign email to many of its contacts, from a member’s connected Gmail or Microsoft 365 / Outlook account, a few at a time. For each recipient Fifi keeps the address it went to, whether it was sent, skipped or failed, and when it was opened, clicked, replied to or unsubscribed from. Links in campaign emails go through Fifi so a click can be recorded (when it happened, the address of the link, and whether it was probably an automatic link scanner), then straight on to the link. Contacts marked “do not track” get the same email with no tracking image and ordinary links. If a campaign’s design uses one of the web fonts offered in the designer, the recipient’s mail app loads that font from Google Fonts, so Google receives the recipient’s IP address and browser details when the email is opened; designs that use only the standard fonts don’t do this.

Every campaign email has an unsubscribe link and a one-click unsubscribe header, and shows the workspace’s postal address. Unsubscribing adds the email address to that workspace’s suppression list, which Fifi keeps for as long as the workspace exists so that no campaign from it reaches the address again. It doesn’t affect personal email from the same people, or other workspaces.

Ask Fifi, if your workspace turns it on

Ask Fifi answers members’ questions about their workspace’s data. It’s off until an owner or admin turns it on in Settings → Workspace. Fifi answers by running reports with the asking member’s own access, and uses Claude, an AI model provided by Anthropic, to write those reports and the answer. To do that, Fifi sends Anthropic:

• the question, and up to 6 earlier questions and answers from the same conversation;
• the names of the fields Fifi can report on, today’s date and the asker’s timezone;
• teammates’ display names (never their email addresses);
• the results of the reports Fifi runs to answer, at most 50 rows each. Results can include record details such as contact, company and deal names, contact email addresses, deal values, and email activity (when emails were sent, and whether they were opened or replied to).

Fifi never sends Anthropic email bodies and snippets, email subjects, notes and comment text, task notes, task and timeline titles, files and photos, or anything from other workspaces, and Claude can only run read-only reports: it can’t change records or send email. Anthropic does not use this data to train its models, and keeps it only as long as its commercial terms allow. Anthropic may process Ask Fifi requests in the United States or in other countries where it runs its service. Fifi doesn’t store questions or answers; the conversation stays in the browser until the page is reloaded or you switch workspace. Fifi’s activity log records who asked and when, with how much of the AI model it used, never the question or the answer. Each person can ask 30 questions an hour and 100 a day, and each workspace 300 a day.

If the workspace also has Campaigns and AI for marketing on (Settings → Marketing), members can ask Ask Fifi to draft a marketing email campaign. To do that, Fifi also sends Anthropic the workspace’s name, business type, brand voice, the names of its tags and booking types, its booking page link, today’s date and the owner’s timezone, and, for each audience Fifi tries, how many people it reaches, how many are left out and why (no email address, unsubscribed, sharing an address) and a sentence describing the filters. It never sends who is in an audience: no names, email addresses, phone numbers or addresses of contacts or companies, nothing from email, notes, comments, files, custom fields, service records, loads or invoices, and not the text of campaigns that people wrote or edited. Claude can only count audiences and save a draft campaign as the person asking; it can’t send, schedule or delete anything, and a draft is sent only when an owner or admin starts it, with the unsubscribe link and postal address that every campaign email has. Fifi checks what Claude writes before keeping it. A draft campaign is kept like any other campaign; the request itself isn’t stored, and the activity log records that a draft was made and how many people it reaches, never its text. Each person can have 20 drafts written a day, each workspace 60, and a workspace can have 50 of Ask Fifi’s drafts waiting at once.

Online booking, if a workspace uses it

A workspace can publish booking pages where people pick a time with its team. When you book, Fifi collects your name, email address, the phone number and answers the page asks for, and your time zone, and passes them to the workspace that runs the page: Fifi adds you to its contacts (or matches you by email address, without changing what it already holds about you) and records the meeting on your record, with your answers in its notes. The person who takes the booking is emailed your details.

Fifi emails you a confirmation with a calendar file and a private link to reschedule or cancel, which stops working once the meeting starts, and a reminder 24 hours before. Fifi stores only a scrambled form of that link (a hash), never the link itself. Cancelling keeps the booking on the workspace’s records, marked cancelled. The booking form is checked by Cloudflare Turnstile, and each email address can be used for at most 5 bookings a day with a workspace and gets at most 8 booking emails a day from it (20 from all workspaces together), so the form can’t be used to send email to people who didn’t book. Booking pages set no cookies.

Pets and boarding, if a workspace uses them

A pet business can keep records of its clients’ pets in Fifi (name, species, breed, size, birth date, notes and vaccination dates) and book their stays. That information belongs to the workspace, like the rest of its records. When a workspace confirms a stay and chooses to tell you, Fifi emails you the pets’ names, where they’re staying and the check-in and check-out times, from Fifi’s address and in the workspace’s name: at most 3 emails a day about one stay, 8 a day from one workspace and 20 a day from all of them together (5 from workspaces less than a day old). The team’s notes about a stay (feeding, medication, prices) stay inside Fifi and aren’t in that email.

Forms, if a workspace uses them

A workspace can publish forms, on their own page or embedded in its website, for people to get in touch. When you send one, Fifi collects your name, email address and the answers the form asks for, and passes them to the workspace that runs it: Fifi adds you to its contacts (or matches you by email address, without changing what it already holds about you), may add a tag and, if the workspace chose to, link you to your company by your work email’s domain (never a free email provider’s), and keeps your answers on your record. The workspace’s team can see and export them.

Forms are checked by Cloudflare Turnstile, each email address can be used for at most 5 submissions a day to a workspace, and Fifi doesn’t store your IP address with your answers. Forms never email you, and set no cookies. A workspace may set up automations that act on your record when you send a form (such as creating a follow-up task for its team or emailing a team member); automations never email you either.

Texting, if a workspace uses it

A workspace can get its own phone number through Fifi to text its contacts. When a workspace texts you, or you text its number, Fifi keeps the messages (what was said, the numbers, when, and whether a text was delivered) on your record in that workspace, where its team can see them. If you text a workspace’s number it doesn’t have yet, Fifi adds your number to its contacts. Texts are sent and received through Twilio, which carries them to and from the phone networks.

Reply STOP (or UNSUBSCRIBE, CANCEL, END or QUIT) to a workspace’s number and it won’t text you again until you reply START; Fifi keeps a record of that choice, even if the workspace later deletes your record, so it’s honored. Reply HELP for who’s texting you. If you ask for a text reminder when you book a time on a workspace’s booking page, Fifi texts you once before the appointment, never between 9 pm and 8 am in your time zone. Message and data rates from your carrier may apply. Fifi doesn’t use your number or your texts for anything else, and never sells them. Mobile phone numbers, and people’s agreement to receive texts, are not shared with third parties or affiliates for their marketing or promotional purposes; they’re shared only with Twilio and the phone networks, to deliver the texts.

Texting registration

This applies once Fifi offers texting registration to a workspace (it isn’t available yet everywhere). US mobile carriers require a business that texts from an ordinary US number to be registered (A2P 10DLC). When an owner or admin registers their business in Settings → Texting, we collect the business’s legal name, its tax ID (EIN) if it has one, address, website, industry and how its customers agree to texts, and a contact person’s name, title, job position, email and phone number (for a sole proprietor: their name, an optional business name, email, mailing address and mobile number). We use it only to register the business’s texting with the carriers and to keep the registration working. Fifi checks the business’s own website to see that it mentions the business, and keeps only the result.

We share it with Twilio, our telecommunications provider, and through Twilio with The Campaign Registry and the mobile carriers, who use it to verify the business and approve its texting program. They keep the registration under their own policies, and Fifi can’t delete their copies; a registered business (brand) stays with Twilio even after the registration is cancelled.

We store the legal name, tax ID, address and the contact person’s or sole proprietor’s details encrypted, and delete them as soon as the business is verified, when the registration is cancelled or rejected, after 30 days if registration is left unfinished, or when the workspace is deleted, whichever comes first. To stop the same tax ID being registered twice by mistake we keep a keyed one-way hash of it (not the number) with the registration. Our team may review a registration before it’s submitted, seeing only the business’s public name, website and industry, the workspace’s age and the domain of the owner’s email address, never the encrypted details. Fifi publishes a public page for each submitted registration (its web address is /sms/ followed by the workspace’s address), saying what the business texts, how people agree, and how to opt out; it’s removed when the registration is cancelled or rejected. We keep the registration’s status, the fees and the owner’s agreement to them for as long as the workspace exists. We don’t use registration details for marketing.

Paying an invoice online

When a business lets you pay an invoice online, the Pay button takes you to a payment page run by Stripe. Your card or bank details go straight to Stripe; Fifi never sees or stores them. Fifi gives Stripe the invoice number, the amount, the business’s name and the email address on the invoice. Stripe tells Fifi whether the payment succeeded, Stripe’s fee, and the card’s brand and last 4 digits (or a bank account’s last 4), which Fifi shows on the invoice to the business. Stripe handles the payment for the business under Stripe’s privacy policy and may send you a receipt. Fifi’s pages still set only essential cookies; Stripe’s payment page is on stripe.com.

QuickBooks Online, if your workspace connects it

An owner or admin can connect the workspace’s own QuickBooks Online company in Settings → Integrations. Intuit asks them to sign in and approve access to the company’s accounting data (the Accounting permission). Fifi keeps Intuit’s refresh token encrypted, renews it as Intuit requires, and deletes it when the workspace disconnects.

What Fifi sends Intuit:

• for each invoice issued from the sync’s start date on (the day the workspace connects, or an earlier day its owner or admin chooses), and each correction or void of one: its number, dates, the bill-to name, email and address, the lines, sales tax, total and notes, and the customer’s purchase order (PO) reference;
• for each payment recorded in Fifi: the amount, date, reference and payment method (cash, check, card and so on);
• for each invoice and payment, Fifi’s own invoice or payment id, in the private note of the record in QuickBooks, so Fifi can recognize its own records;
• for each bill-to, a QuickBooks customer record (display name, email and address). Fifi creates one with the bill-to name, or finds the one that already has it.

What Fifi reads from QuickBooks: the company’s name, country and settings; its products, accounts and tax codes (for the settings lists); and payments recorded in QuickBooks against invoices Fifi sent there, which Fifi adds to the invoice. Intuit tells Fifi when something changes, with identifiers only.

What Fifi stores: only the identifiers that link Fifi’s records to QuickBooks’, and the sync status. Disconnecting stops all of this and deletes the token. “Also forget QuickBooks links” deletes the identifiers too. Data already in QuickBooks is governed by the workspace’s agreement with Intuit.

Media and AI for social posts, if a workspace uses them

A workspace can keep photos and videos in Fifi’s media library, with notes on what’s in them, labels for the people and pets shown, and its own record of whether each person (or pet’s owner) agreed to their use in marketing. That record is the workspace’s: Fifi doesn’t collect consent from the people shown, but it stops media marked “declined” from being used in posts, graphics, campaigns or AI, and asks for a confirmation each time media with unknown consent is used. The files are stored by Tigris (through Fly.io) in the United States, encrypted at rest. Before a file is usable, Fifi removes its hidden details, such as a photo’s GPS location, camera details and dates (keeping only which way up it goes) and a video’s location and metadata. Files are private to the workspace’s members and are never public unless a member copies one into a campaign email.

AI for marketing is off until an owner or admin turns it on (Settings → Marketing). While it’s on, members can have Claude, by Anthropic, look at media they pick, write captions and suggest notes. For that, Fifi sends Anthropic only the media the member picks (a reduced preview image, or a video’s still frame), its notes, tags and the labels of who’s shown, the workspace’s name, business type and brand voice, and the member’s choices and brief. Fifi never sends contact records, email or other CRM data, and Anthropic does not use it to train its models. Fifi keeps the written suggestions for 30 days for the member who asked, then deletes them; the activity log records only that a generation happened and how much of the AI model it used. Each workspace can generate up to 20 times a day (10 on Pro), and each person 15 times a day.

Photos on timelines

A workspace’s members can add photos to a contact’s, company’s or deal’s timeline, and to a pet, visit, stay or service record, from a phone’s camera or photo library or from a computer, with a caption if they like. A photo is workspace content: the workspace decides what to photograph and why, and is responsible for having the right to take it and keep it (see our Terms). Photos can show people, including children, homes, vehicles and licence plates, so workspaces must get any consent the law requires before photographing people.

What Fifi does with them. Fifi stores them for the workspace and shows them to the workspace’s signed-in members, and does nothing else with them. We don’t look at timeline photos, and neither Fifi nor the AI services it uses analyse, describe, label or scan them. Fifi doesn’t use facial recognition and doesn’t create face templates or any other biometric information from them. Timeline photos and their captions are never sent to Anthropic or any other third party, never appear in Ask Fifi, search, reports, the API, webhooks, email or texts, and are never public. (The media library is different: a member can choose to have Claude look at media they pick, as Media and AI describes.) The activity log records who added and removed each photo, with its size and type, and never a file name or a caption.

Where they are kept. In Tigris (billed through Fly.io), in the United States, encrypted at rest, in a private bucket. A member sees a photo through a link that works for 5 minutes and only after Fifi has checked they’re signed in to the workspace. Before a photo is stored, the browser and our servers remove hidden details such as the location, camera details and dates (keeping only which way up it goes).

How long we keep them. A photo removed from a timeline is deleted from storage at once (our storage keeps deleted files recoverable for a short time, as protection against mistakes; see How long we keep information). If an owner or admin has downloaded all the workspace’s photos, the ZIP Fifi makes for them is kept for up to about three days and then deleted (its emailed link works for 24 hours); it still holds the pictures that were there when it was made, even if one is removed in the meantime. A deleted photo entry can be restored by an owner or admin for 30 days, and then its photos are deleted. Deleting a contact, company or deal hides its photos, and they’re deleted when it is permanently deleted after 30 days. When a workspace is deleted, its photos are deleted with it. Deleting your account doesn’t delete photos you added to a workspace’s timeline; they belong to the workspace, like your notes. Photos aren’t part of our database backups.

Support

When you ask for help in Fifi, we keep what you tell us so we can help you and so you can see your tickets.

What we collect. If you chat with Fifi’s AI assistant, the words you type. If you open a ticket, its subject and messages, any phone number you add, screenshots you attach, the plan, business type and name of your workspace, your name, email address and role, the app version, and a short list of technical details you can see before you send it (the kind of page you were on, your browser type, recent error references, which features are on). We never read your CRM records to answer a ticket, and our support tools can’t show them to our support staff. If solving a problem ever needs an engineer to look at your workspace’s records, we’ll ask an owner or admin first, unless it’s needed to keep Fifi secure or to meet a legal obligation (see CorporateMutt staff).

The AI assistant. The chat is answered by Claude, a model from Anthropic, which we use as a service provider (a sub-processor). Before your words reach Claude we remove email addresses, phone numbers and other long numbers, card numbers, US Social Security numbers, passwords and keys, and the extra details of links. Other identity numbers, such as a tax ID or a passport number, may not be recognized. This removal is not perfect: it cannot recognize names or other free-text personal information, so please don’t type your customers’ personal details. Claude also receives a short list of technical facts about your workspace and session (your plan, business type and enabled features, whether a mailbox and texting are set up, your role, the kind of page, your browser type, the app version and recent error references) and excerpts of our public help articles. It does not receive your name, your email address, your workspace’s name, any contact, deal, email, text, note or file, or any screenshot. Anthropic does not use this information to train its models. Fifi asks Anthropic to process support chat requests in the United States. Requests that we recognize as billing, security, privacy, legal or lost-data requests are handed to a person without being sent to the assistant (the recognition is by keywords and is not perfect, so please don’t put such details into the chat). The assistant is on by default; an owner or admin can turn it off for a workspace in Settings → Workspace, and nothing is sent to Anthropic when it is off.

Who can read a ticket. You, the owners and admins of your workspace, and Fifi’s support staff. Other members of your workspace cannot.

Email updates. We email the address you sign in with when we open, answer or resolve a ticket.

How long we keep it. Chats that never became a ticket: the messages for 30 days after the last one, and a record with no personal information for 13 months. Tickets: screenshots for 90 days after the ticket closes, messages and the personal details on the ticket for 180 days after it closes, and a basic record (ticket number, category, status, priority, plan and dates) for 2 years after it closes. When you delete your account, your name, email and phone are removed from your tickets, your messages are replaced, and your screenshots are deleted. When a workspace is deleted, all of its tickets are deleted with it.

When you contact us

If you email us, we receive your email address and whatever you include in your message, and use them to answer you and keep a record of the conversation.

Usage and security logs

Our servers write operational logs, such as events, timings and errors, tagged with request and workspace identifiers. Our logging is designed to leave out personal information such as email addresses, names and message contents, but log lines can include IP addresses and the host names of websites Fifi contacts. Our hosting provider also records technical information about requests, such as IP addresses, to run and protect its network.

We don’t use any third-party analytics, advertising or tracking tools.

Images, task notes and website lookups

• Logos you upload (your workspace’s, and companies’) are stored with your workspace. We remove hidden information such as camera details and location from them first, keep a file name, size and who added it, and delete them 30 days after they’re removed. A workspace logo is public: it appears in campaign emails, at a web address only that logo uses.
• “Fill in from website” reads the public home page of a company’s saved website, once, when a member asks, to suggest its name, description, contact details and logo. Our servers fetch it, so the site doesn’t see the member’s address. The suggested logo is kept for a day or two, visible only to that member, so they can apply it; the other suggestions aren’t saved unless the member applies them. We log which site was read (its host name), not what it said.
• Images and notes on tasks are workspace content, visible only to the workspace’s members. Images get the same treatment as logos (hidden information removed, deleted 30 days after they’re removed) but are never public. Notes are kept with the task and deleted 30 days after they or the task are deleted.
• Task reminders are emailed to the person the task is assigned to, at the time a member set, with the task’s title, due date and what it’s linked to. Each member gets at most 50 a day; beyond that, reminders show only in the app.

Cookies and local storage

Fifi uses only cookies that are essential to sign you in and keep you signed in, so we don’t show a cookie banner. They’re all our own (first-party), scripts on the page can’t read them, and on our sites they’re only sent over HTTPS:

• fifi_session keeps you signed in. It holds a random token for your session, which ends after 12 hours without activity, after 30 days at most, or when you sign out.
• fifi_login_email remembers the address we sent your sign-in code to, until you enter the code (up to 15 minutes).
• fifi_after_login remembers which page to open after you sign in (up to 15 minutes).
• google_oauth_state, google_code_verifier and apple_oauth_state protect Sign in with Google and Sign in with Apple against forgery (up to 10 minutes).
• gmail_oauth_state and gmail_code_verifier do the same when you connect Gmail, and remember which workspace you’re connecting it to (up to 10 minutes).
• microsoft_oauth_state and microsoft_code_verifier do the same when you connect a Microsoft 365 / Outlook mailbox (up to 10 minutes).
• stripe_oauth_state protects connecting a Stripe account against forgery. It holds a random code tied to the person and workspace that started the connection, is used only to complete that connection (up to 10 minutes), and is cleared as soon as the connection finishes.
• quickbooks_oauth_state does the same when you connect QuickBooks Online: a random code tied to the person and workspace that started the connection, used only to complete it (up to 10 minutes) and cleared as soon as it finishes.

On secure connections these names start with “__Host-”, which stops other sites from setting them.

Your browser’s local storage also keeps three preferences that are never sent to us: your light, dark or system theme choice (“theme”), whether the app’s sidebar is collapsed (“fifi.sidebar.collapsed”) and which social networks you last chose when writing posts (“fifi.social.platforms”).

When a page in Fifi shows an error, your browser keeps the error’s reference code, the kind of page and the time in session storage (“fifi.support.errors”, at most the last 5, for that browser tab only, until you close it). It’s sent to us only if you use Fifi’s support chat or open a support ticket (see Support).

Cloudflare Turnstile runs on the sign-in page, on booking forms and on workspaces’ forms to check for bots. Cloudflare handles that check under its own privacy terms.

4. How we use information

• To provide Fifi: sign you in, show your workspaces, store and display your team’s content, and run imports and exports. For people who connect Gmail or Microsoft 365 / Outlook, we also sync, link and send email.
• To keep Fifi and your account secure: recognize new devices and tell you about them, block bots and abuse, enforce rate limits and keep audit trails.
• To run the features a workspace turns on, such as texting and texting registration, online payments, QuickBooks Online, Ask Fifi and AI for marketing, as described above.
• To send the email the service needs: sign-in codes, invitations, new-device notices and the daily digest. Each morning around 7:00 in your timezone, if you have tasks that are overdue or due that day, the digest lists them (and, for owners and admins, says how many upcoming bookings are with someone who has left): one email per workspace, for at most 5 workspaces a day (the ones you joined first that have the digest on). It’s on by default; you can turn it off for each workspace in Settings → Profile, or with the one-click unsubscribe link at the bottom of each digest.
• To help you when you contact us, and to fix problems.
• To meet legal obligations and enforce our Terms of Service.

We don’t sell personal information or show ads, and we don’t use your information or your workspace’s content for advertising. We don’t use workspace content, Gmail data or Microsoft mailbox data to train AI models.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Our reasons for using account information

We use account information only when we have one of these reasons (some privacy laws call them “legal bases”):

• Contract: to provide Fifi under our Terms of Service, including sign-in, workspaces and the email the service needs.
• Legitimate interests: to keep Fifi secure and reliable (bot checks, rate limits, sign-in history, new-device notices, logs and audit trails), to help you, and to establish or defend legal claims. We’ve weighed these interests against your privacy, and you can object (see Your rights and choices).
• Consent: for optional features you choose to turn on, such as connecting Gmail or Microsoft 365 / Outlook. You can withdraw it at any time by disconnecting.
• Legitimate interests also cover the support assistant, which is on unless your workspace turns it off, and which receives only scrubbed text (see Support).
• Legal obligation: where the law requires us to keep or disclose information.

For workspace content, the customer that controls the workspace decides why it’s used, and we process it on their instructions.

6. How we share information

We never sell personal information. We share it only in these cases.

Service providers (subprocessors)

These companies process data for us so we can run Fifi:

• Fly.io hosts the app and our Postgres database, in the United States (Virginia).
• Resend sends Fifi’s email, such as sign-in codes, invitations, notices and digests.
• Cloudflare runs the Turnstile bot check on the sign-in page, on booking forms and on workspaces’ forms.
• Google provides Sign in with Google, and Gmail for people who connect it. Google Fonts serves the web fonts a campaign design can use, to the mail apps of the people who receive it (see Marketing campaigns).
• Apple provides Sign in with Apple.
• Google Cloud Pub/Sub tells Fifi when new mail arrives in a connected Gmail account. The notification holds only the mailbox’s address and a change number, no email content.
• Microsoft provides Microsoft 365 / Outlook mailboxes for people who connect one, and tells Fifi through Microsoft Graph when new mail arrives in them. Those notifications hold no email content.
• Anthropic provides Claude, the AI model behind Ask Fifi, the social post writer and the support assistant, for workspaces that use them. It receives only what Ask Fifi, Media and AI and Support describe, to answer the question asked, write the posts or answer the support chat.
• Tigris (billed through Fly.io) stores the media library’s photos and videos (see Media and AI), the photos added to timelines (see Photos on timelines), the ZIP files owners and admins download, and our encrypted database backups, in the United States.
• Twilio carries texts to and from the phone numbers workspaces get for texting (see Texting), and receives the information a workspace gives to register its business for texting (see Texting registration), in the United States.
• The Campaign Registry and the mobile carriers receive a workspace’s texting registration through Twilio, to verify the business and approve its texting, once registration is available.
• Stripe processes online invoice payments for workspaces that connect a Stripe account (see Paying an invoice online), in the United States. Fifi sends it the invoice number, amount, the business’s name and the customer’s email address, and, when a member connects Stripe, that member’s email and the workspace’s name.
• Intuit (QuickBooks Online) receives invoice and payment data only for workspaces that connect their own QuickBooks company, on that workspace’s instruction (see QuickBooks Online).

Inside your workspace

Members of a workspace can see its content and who added or changed it. Owners and admins can also see the workspace’s activity log.

Apps a workspace connects with an API key can read and change its contacts, companies, deals, tasks, notes, calls and meetings, within the access its owners and admins give the key. Connecting them is the workspace’s choice, and their own terms and privacy policies cover what they do with that information.

Webhooks a workspace’s owners and admins add send changes to its contacts, companies, deals, tasks, notes, calls and meetings to the web addresses they choose, as they happen. The text of notes, email content and files are never sent. The services at those addresses are the workspace’s choice, and their own terms and privacy policies cover what they do with that information.

CorporateMutt staff

Our operator console shows staff each workspace’s name and web address, its owner’s email address, member count, creation date, status, plan, business type and any scheduled deletion date, and how much it used Ask Fifi and AI for marketing, but none of its content. Our support console shows support staff the tickets they’re answering and, to diagnose a problem, facts about the workspace’s setup (such as its modules and AI settings, how many mailboxes are connected and whether they’re syncing, and whether texting is set up), never its records. Each time support staff open a ticket or a workspace’s diagnostics, it’s recorded in that workspace’s activity log.

A small number of engineers have access to our production systems, which technically lets them reach any data in Fifi, including by signing in as a user to reproduce a problem. They use that access only when it’s needed: to give support you ask for, to keep Fifi secure, or to meet legal obligations. A sign-in by an engineer as a user needs a stated reason, is recorded with that reason in the activity log of each workspace the user belongs to, and is emailed to the user.

Legal requests and safety

We may disclose information if we believe in good faith that the law, a court order or another valid legal request requires it, or to protect the rights, safety or property of our users, the public or CorporateMutt. Where we’re allowed to, we’ll tell the affected customer first.

Business transfers

If CorporateMutt is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. This policy will keep protecting it, and we’ll tell you before it becomes subject to a different policy. For data we receive from Google APIs, including Gmail, we’ll ask for your explicit consent before any such transfer.

When you ask us to

When you export data or invite someone (or send email from Fifi), we share information as you’ve asked.

7. International transfers

Fifi stores its data only in the United States: its database in Fly.io’s Virginia region, and files (including backups) in Tigris, restricted to the United States. If you use Fifi from outside the US, your information is transferred to and processed in the US, where privacy laws may differ from those where you live. Some of our other service providers may also process data in other countries: for example Cloudflare’s bot check runs on its global network, and Anthropic may process Ask Fifi and AI for marketing requests outside the US.

Fifi is offered to customers in the United States. It isn’t offered in the European Economic Area, the United Kingdom or Switzerland yet, so we don’t currently put in place the transfer arrangements (such as the European Commission’s Standard Contractual Clauses) that data from there would need. If that changes, we’ll update this policy first.

8. How long we keep information

• Account information is kept while your account exists.
• Sessions stop working after 12 hours without activity or 30 days at most. A session’s record (IP address, browser details and times) is deleted within two days after it stops working, or straight away when you sign out of it, remove it in Settings → Sessions, or delete your account.
• Sign-in history (times, device labels and, for 90 days, IP addresses) is kept while your account exists, and deleted when you delete it.
• Email code records (the address, the hashed code and attempt counts) are deleted within two days after the code expires, used or not.
• Rate-limit counters are deleted within about two days.
• API keys are kept while the workspace exists; revoking one clears the IP address it was last used from. Records the API keeps so a retried request isn’t done twice (a hash of the request and a copy of Fifi’s response) are kept for 24 hours, then deleted within the hour.
• Webhooks are kept until an owner or admin deletes them, or the workspace is deleted. The record of each event sent (a copy of it, and each attempt’s status code and timing) is kept for 30 days, then deleted within the hour; deleting a webhook deletes its records at once.
• Workspace content is kept until the workspace’s members delete it, or the workspace is deleted, except for the invoices and service records below. Form submissions, bookings and texts stay with the contact they belong to, and are deleted with it. Email open and click records, and campaign recipients’ statuses, are kept with the email or campaign they belong to.
• Issued invoices (and void ones) and their payments are kept for at least 7 years after the invoice was issued, as tax record-keeping requires, even if the contact or company they were for is deleted: the invoice then keeps the bill-to name, email address and postal address it was written for. Nobody can delete them before then; after that, owners and admins can. Draft invoices can be deleted at any time.
• Completed or voided service records are kept for at least 3 years after the service, as pesticide record-keeping rules require, even if the contact or visit is deleted: the record then keeps the customer’s name and service address, and the technician’s name and applicator licence number, even if the technician deletes their account. Nobody can delete them before then; after that, owners and admins can.
• Automation run logs (what ran, for which record, and whether it worked) are deleted 30 days after the run, the next time the workspace’s automations run, and otherwise with the workspace.
• Deleted contacts, companies and deals can be restored by an owner or admin for 30 days. Deleted tasks and timeline entries can’t be restored, except photo entries, which an owner or admin can restore for 30 days. Thirty days after deletion, a nightly job permanently deletes all of them, along with the timeline entries and photos of deleted records. A deleted company that a deal still uses keeps only its name, domain and industry.
• Photos on timelines are kept until a member removes them or the record or workspace they’re on is deleted, as Photos on timelines describes. They aren’t part of the 3-year service record; they go with their customer.
• Text messages are kept with the contact they belong to. A phone number’s opt-out (STOP) is kept for as long as the workspace exists, even if the contact is deleted, so it’s honored.
• Texting registration details are kept as Texting registration describes: the encrypted identity details until the business is verified (at most 30 days for an unfinished registration), and the registration’s status, fees and agreement while the workspace exists.
• Deleted workspaces become unavailable to everyone at once. An owner can cancel the deletion for 30 days. After that, a nightly job permanently deletes the workspace and everything in it, including its activity log, its invoices and service records, its photos and files, and any stored email. We keep only a minimal record that the workspace was deleted.
• Activity logs are kept for as long as the workspace exists. The IP address on each entry is cleared after 90 days, and straight away for everything you did when you delete your account.
• Support emails are kept for 2 years after the conversation ends, so we keep a record of what we agreed.
• Support chats and tickets are kept for the periods stated in Support. Records that our staff opened a ticket or a workspace’s diagnostics are kept for as long as we need them for security.
• Server logs are kept for a limited period, for troubleshooting and security.
• Backups: we keep encrypted backups of our database to recover from failures: one for each of the last 14 days, 8 weeks and 6 months. Data you delete is removed from Fifi straight away (or when its waiting period ends) and from these backups as they expire, so it can remain in a backup for up to about 6 months; our hosting provider’s disk snapshots also keep it for up to 14 days. Files (such as photos, media and logos stored in Tigris) that are deleted stay recoverable by us for a short time after deletion, as protection against mistakes, and are then gone. Backups are used only to restore Fifi; if we ever restore one, we delete again anything that had been deleted since it was taken.

When you delete your account

You can delete your account in Settings → Profile. When you do:

• You’re signed out everywhere, and your linked Google and Apple sign-ins, email codes and sign-in history are deleted.
• Your name and photo are removed, and your email address is released, so it could be used to sign up again.
• Invitations you sent that haven’t been accepted stop working.
• Workspaces where you’re the only member are deleted with your account. They close at once and are permanently deleted after 30 days. Once your account is gone nobody can cancel this, so export anything you want to keep first. If you’re the only owner of a workspace that others still use, you’ll need to hand over ownership, or remove the other members, first.
• Content you added to other workspaces stays with them, because it belongs to the workspace, and you appear there as “Deleted user”. So do the activity log entries for what you did there. Service records you completed keep your name and applicator licence number for their 3-year period.
• Your name, email address and phone number are removed from your support tickets, your messages in them are replaced, and your screenshots are deleted.
• We keep a placeholder with no name, email address or photo, so that workspace history still makes sense, and a record that the account was deleted.

9. Security

We protect your information with measures including:

• HTTPS (TLS) for every connection to Fifi, with browsers told to always use it (HSTS).
• Workspace isolation in the app and again in the database itself (row-level security), so one workspace can’t read another’s data.
• Least-privilege database access: the app connects with a restricted role that can’t bypass those rules.
• No passwords to steal. Session tokens, sign-in codes, invitation links and API keys are stored only as one-way hashes. Gmail, Microsoft and QuickBooks refresh tokens, webhook signing secrets and texting registration details are encrypted in the app (AES-256-GCM) with a key kept apart from the database.
• Nightly database backups, encrypted with their own key, and a tested way to restore them.
• An audit log of sign-ins, exports, membership changes, changes to records and our support staff’s access.
• Strict browser security headers, protection against cross-site request forgery, input validation and rate limits. Uploaded pictures are checked and stripped of hidden details, and email from outside is cleaned and shown in a sandbox.

No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the authorities as the law requires. If a breach affects a workspace’s content, we’ll tell the workspace’s owners without undue delay, with what we know, so they can meet their own obligations to the people in it.

To report a security issue, email support@fetchfifi.com with “Security” in the subject. Please give us a reasonable time to fix it before telling anyone else, and don’t access or change other people’s data while testing; we won’t take legal action against good-faith research that follows these rules and our Terms.

10. Your rights and choices

Wherever you live, you can:

• See and export your data. Your profile and sessions are in Settings. Owners can export a whole workspace as a ZIP of CSV files, and members can export the lists they can see. You can also ask us for a copy of your account information.
• Correct it. Change your name and timezone in your profile, and edit workspace content directly in Fifi.
• Delete it. Delete records, delete a workspace if you’re its owner, or delete your account in Settings → Profile.
• Object or ask us to restrict how we use your account information, or ask for it in a portable format.
• Turn things off. Sign out of any session, or of all other sessions at once, and turn off the daily digest. Disconnect Gmail or Microsoft 365 / Outlook, and delete the email synced from it. Owners and admins can turn off open tracking for a workspace.

To make a request, email support@fetchfifi.com from the address on your account, with “Privacy request” in the subject. We may need to confirm it’s you before we act. We’ll respond within the time the law requires, which for most US state privacy laws is 45 days, extendable where the law allows; if we need more time, we’ll tell you why. We won’t treat you differently for using your rights.

For workspace content, we’ll pass your request to the workspace’s owners promptly, because they control it, tell you we’ve done so, and help them respond. We don’t answer for them, because only they can decide what to keep (for example, invoices they must keep for tax purposes).

Outside the United States

Fifi is offered to customers in the United States. If a privacy law outside the US (such as the GDPR or the UK GDPR) gives you rights over information we hold about you anyway, for example because you’re a contact in a US customer’s workspace, email us and we’ll honor them as that law requires.

US state privacy rights

Depending on where you live (for example, California under the CCPA), you may have the right to know what personal information we collect and how we use and disclose it, to get a copy, and to correct or delete it. You can use an authorized agent, and if we decline your request, you can appeal by replying to our decision.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We haven’t done either in the last 12 months. We don’t use or disclose sensitive personal information except to provide Fifi, so there’s no need for a “limit” request. The content of email from a connected mailbox, and a sole proprietor’s details given for texting registration, may count as sensitive under some state laws; we use them only to provide the features you asked for.

The categories of personal information we collect, and have collected in the last 12 months, are described in What we collect: identifiers (such as names, email addresses, phone numbers and IP addresses), customer records and commercial information (such as invoices and payments, and texting registration details), internet activity (such as sessions and sign-in history), visual information (photos), and the professional information teams keep in Fifi. We collect them from you, from your workspace’s members and from the services you connect, for the purposes in How we use information; we disclose them for business purposes only to the recipients in How we share information; and we keep them for the periods in How long we keep information.

Do Not Track and Global Privacy Control

Fifi doesn’t respond to “Do Not Track” or Global Privacy Control browser signals. We don’t track you across other sites, and we don’t sell or share your information for advertising, so there’s no cross-site tracking for those signals to stop.

11. Children

Fifi is a business product for people 18 and older. It isn’t directed at children, and we don’t knowingly collect personal information from anyone under 18 through Fifi accounts. If you think a child has given us personal information, contact us and we’ll delete it.

A workspace may keep information about children in its records, for example a family’s contact details or a photo taken on a job. That information is the workspace’s, and the workspace is responsible for any consent the law requires. Workspaces must not use Fifi’s forms or booking pages to collect information directly from children under 13.

12. If you’re in a Fifi workspace

Our customers use Fifi to keep track of the people they work with. If you’re one of their contacts, your information may be in their workspace: for example your name, email address, phone number and job title, and notes about your conversations. It may also hold email you exchanged with someone who has connected Gmail to that workspace. If they mark you “do not track”, Fifi stops storing new email with you; email stored before then stays until they delete it.

The organization that uses that workspace controls this information and decides how it’s used. Please contact them first: they can show you, correct or delete it, or mark you “do not track” so Fifi won’t store their email with you.

Emails from Fifi users may include open tracking, and campaign emails also track link clicks; Fifi records when they’re opened or clicked (see Email open tracking and Marketing campaigns). Every campaign email has an unsubscribe link that works straight away. Most mail apps let you turn off loading remote images, which also stops open tracking.

If you book a time on a workspace’s booking page, your booking and answers go to that workspace (see Online booking). Use the link in your confirmation email to reschedule or cancel.

If you send a workspace’s form, your answers go to that workspace (see Forms).

If a workspace texts you, reply STOP to stop its texts (see Texting).

A workspace may also keep photos that show you or your property (see Photos on timelines), and invoices or service records about you that it must keep for a period even if you ask it to delete your other details (see How long we keep information).

If you can’t reach the organization, or need help, email support@fetchfifi.com. We’ll pass your request on to the right customer and help them respond.

13. Google API Services: Limited Use

Fifi CRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Gmail:

• We use it only to provide and improve the Gmail features you see in Fifi: syncing your email with your contacts, companies and deals and showing it on their pages, letting your workspace search it, tracking replies, and sending email you write. It’s kept in our encrypted database backups like the rest of Fifi’s data.
• We don’t transfer it to anyone else, except as needed to provide or improve those features, to comply with the law, for security purposes such as investigating abuse, or as part of a merger, acquisition or sale of assets, and then only with your explicit prior consent.
• We don’t use it for advertising, including retargeting and personalized or interest-based ads, and we never sell it.
• We don’t use it, or let anyone use it, to decide creditworthiness or for lending.
• If your workspace turns on Ask Fifi, a member’s question can be answered with a report on email activity: when emails were sent, and whether they were opened or replied to, never their subjects or content. Those results go to Anthropic only to answer that member’s question.
• No one at CorporateMutt reads it unless you’ve asked us to for specific messages, it’s needed for security (such as investigating abuse), it’s needed to comply with the law, or it has been aggregated and anonymized for internal operations.
• We don’t use it to develop, improve or train generalized AI or machine learning models.

Data from Sign in with Google (your name, email address and profile photo link) is used only to sign you in, set up your Fifi profile and send you the account email described in How we use information.

14. Changes to this policy

We’ll update this policy as Fifi changes. If a change is material, we’ll tell you by email or in the app before it takes effect. The date at the top shows when the policy was last updated.

15. Contact us

For privacy questions or requests, contact our Privacy Lead, CorporateMutt, LLC, at support@fetchfifi.com.

Fifi CRM is operated by CorporateMutt, LLC, 740 Tutor Lane, Williamstown, NJ 08094, United States.