Privacy Policy

1. Who we are

TheLight CRM ("TheLight", "we", "us") provides a customer relationship management application for field sales teams, delivered as an iOS app and a web dashboard. This policy explains how we handle personal information on this website, in the app, and in the dashboard.

2. Information we collect

We collect the following categories of information:

• Account information. Name, work email address, company name, and the role assigned to you in your workspace. Created when your workspace owner invites you or when you sign up.
• Enquiry information. If you fill in the contact form on this site, we receive your name, email address, company, team size, and message.
• Content you create. Customer and lead records, notes, comments, messages sent through team chat, appointments, and any images you upload.
• Location information. When you grant permission, the iOS app uses your device location for navigation, territory mapping, and geofence visit check-ins. See section 5.
• Technical information. Device type, operating system version, app version, and IP address, recorded in standard server logs. If you have opted in to sharing diagnostics with developers in iOS Settings, Apple may pass crash reports to us.
• Information from connected services. If your organisation connects a Facebook Page, we receive submissions from its Lead Ad forms. See section 6.

We never receive or store payment card numbers. Payments are handled by Stripe, which collects card details directly.

3. How we use information

• To provide the service — authenticating you, syncing your records across devices, and delivering notifications.
• To respond to sales enquiries and support requests.
• To keep the service secure, diagnose crashes, and prevent abuse.
• To meet legal and accounting obligations.

We do not sell personal information, and we do not share it with advertisers.

4. Customer data you put into the CRM

The records you store in TheLight — your customers, leads, and their contact details — belong to your organisation. Your organisation is the controller of that data and decides what to collect and how long to keep it. We process it on your instructions in order to run the service, and we do not use it for our own purposes.

If you upload information about third parties, you are responsible for having a lawful basis to do so and for honouring their privacy rights. You can export or delete records at any time.

5. Location information

Location access is optional and is requested by the iOS app only when you use a feature that needs it. It powers turn-by-turn navigation to a customer, plotting your territory on the map, and geofence check-ins that record a visit when you arrive at a customer site.

You can revoke location access at any time in iOS Settings. Mapping and navigation features will stop working, but the rest of the app continues to function.

6. Service providers

We rely on a small number of providers to run the service. Each processes data only as needed to deliver their part of it:

Provider	Purpose
Google Firebase (Google LLC)	Authentication, database and file storage, push notifications, server functions, and hosting of this site and the web dashboard
Apple	App distribution and push notification delivery on iOS
Formspree	Delivery of messages submitted through the contact form on this site
Resend / Amazon SES	Email sent from our domain, including emails your organisation sends to its customers through the CRM
Twilio	Delivery of text messages your organisation sends to its customers through the CRM
Stripe	Subscription billing, and invoices and payment links your organisation sends to its customers
Anthropic	Optional AI features: lead scoring and reply drafting (see below)
Meta Platforms	Optional Facebook Lead Ads import (see below)

Data may be processed on servers located in the United States.

Features that send data to a provider

Some features only run when someone in your organisation uses or connects them:

• AI lead scoring sends Anthropic a summary of each lead: deal value, how old the record is, and yes/no signals such as whether a phone number, email, or follow-up date is on file. It does not send names, contact details, or notes.
• AI reply drafting sends Anthropic the recent message thread with a customer, plus that customer's name, city and state, lead status and source, job, product, deal value, and follow-up date, so it can suggest a reply. It does not send their phone number or email address. Drafts are never sent automatically; a person reviews and sends them. Anthropic processes this data to return the draft and does not use it to train its models.
• Text messages are delivered through Twilio. Anyone who receives a message can reply STOP to stop further texts from that organisation, and the opt-out is honoured automatically.
• Facebook Lead Ads. If your organisation connects a Facebook Page, we store an access token for that Page and import the name, contact details, and answers people submit on its Lead Ad forms as new leads. Disconnecting in settings deletes the stored tokens, revokes our app's permissions with Facebook, and stops imports. Leads already imported stay in the CRM until your organisation deletes them.

7. Cookies and analytics

This marketing site does not set advertising or tracking cookies. The application uses cookies and similar local storage strictly to keep you signed in and remember interface preferences. We do not use analytics or advertising trackers in the app, the dashboard, or this site.

8. How long we keep data

Account and content data is retained for as long as your workspace is active. If your organisation cancels, data remains available for a limited wind-down period so you can export it, after which it is deleted from our active systems. Backups age out on their own schedule. Sales enquiries are kept for as long as needed to follow up and to meet record-keeping obligations.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California may request disclosure of the categories of information collected and may opt out of any sale or sharing of personal information — we do not sell or share personal information as those terms are defined under California law.

To exercise a right, email eunitedws@gmail.com. If your data lives in a workspace run by your employer, we will refer your request to that organisation, since they control the records. We will not discriminate against you for exercising a right.

10. Security

Data is encrypted in transit over HTTPS and encrypted at rest by our infrastructure provider. Access requires authentication, and database rules scope each account to its own organisation's records. Administrative access on our side is limited to what is needed to operate and support the service.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

11. Children

TheLight is a business product intended for use by adults in a workplace. It is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product changes. The "last updated" date at the top of the page reflects the current version. If a change materially affects how we handle your information, we will give notice through the app or by email.

13. Contact us

Questions about this policy or about how your data is handled can be sent to eunitedws@gmail.com.