Privacy policy

This policy explains what pymso (“we”) collects when you use pymso CRM at ledger.devz.top and its workspace addresses, why, and what you can do about it. Questions: pymsohq@gmail.com.

Who is responsible

For your account and how the service runs, pymso is responsible. For the business records you put in your workspace (your clients, invoices, expenses and their files), you decide what is stored and why; we keep and process them only to provide the service to you.

What we collect

• Account details: your sign-in email, a one-way hash of your password (if you set one), and your two-factor authentication secret, stored encrypted.
• Google sign-in: if you choose “Continue with Google”, we receive only your email address, whether Google has verified it, and Google's account ID for you. We don't request access to your contacts, files, calendar or any other Google data.
• Your business records: everything you enter or upload in your workspace: business details, clients, projects, estimates, invoices, payments, expenses, notes and files (logo, receipts, attachments).
• Security records: for each signed-in session, its IP address, browser description and last-active time; and recent sign-in attempts (IP address, email entered, success or failure) to stop password guessing.
• Usage counts: the number of requests to each workspace per day. These counts don't include pages visited, IP addresses or who made them.

How we use it

• To run your workspace: store your records, produce documents and PDFs, and run the recurring invoices and expenses you set up.
• To keep accounts safe: sign-in, two-factor authentication, rate limiting and session management.
• To operate the service: capacity planning, troubleshooting and backups.

We don't sell your data, show ads, use your data for marketing, or use it to train AI models. pymso CRM never emails your clients or anyone else on your behalf: you decide what to share.

Who can see your data

• Each workspace has its own separate database and file storage. Other customers can't see your data.
• Our administration panel shows us only account-level information (workspace name, owner email, status, counts and storage size), never your clients, documents, amounts or files.
• People with direct server access (us, for maintenance and backups) could technically reach stored data. We look at workspace contents only when you ask us to help, or when the law requires it.
• Anyone with a share link to an invoice or estimate can view that one document until you turn the link off or replace it.

Service providers

• Hosting: Amazon Web Services (Mumbai, India) runs the servers that store the data.
• Cloudflare: DNS for our domain (it doesn't receive your workspace traffic).
• Let's Encrypt: issues the HTTPS certificates for our addresses.
• Google: only if you use “Continue with Google”, as described above.

Google user data

pymso CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google email address and account ID only to sign you in to your own workspace, and we don't transfer them to anyone.

Cookies

We use only cookies that are necessary for signing in: a session cookie while you are signed in, and a short-lived cookie (10 minutes) that protects a Google sign-in in progress. No analytics, advertising or tracking cookies.

How long we keep it

• Business records and account details: while your workspace exists.
• Sessions: until you sign out or they expire (30 days at most). Sign-in attempt records: about one day.
• Backups: kept for up to 30 days, then deleted.
• When a workspace is deleted, its database and files are removed immediately; copies in backups disappear within 30 days.

Security

All traffic uses HTTPS. Passwords are stored with argon2id, two-factor secrets are encrypted, each workspace has its own database and database account, and servers are kept up to date and firewalled. No system is perfectly secure; if a breach affects your data we will tell you without undue delay.

Your choices and rights

• Export all your data at any time from Settings → Data export.
• Correct your details in the app, or ask us to.
• Ask us to delete your workspace and account: pymsohq@gmail.com.
• Disconnect Google sign-in in Settings → Account & security (after setting a password), or remove our access in your Google account settings.

Children

pymso CRM is a business tool and is not meant for people under 18.

Changes

If we change this policy, we'll update the date above, and tell workspace owners in advance about significant changes.

Contact

pymso · pymsohq@gmail.com