Privacy Policy

Effective date: 30 October 2026 · Version 3.13

This Privacy Policy explains how personal data is collected, used, shared and protected in connection with Propel (“Propel”, “we”, “us”, “our”), an AI-native, multi-tenant B2B CRM provided as a fully managed online service (the “Service”) at propeltech.io. It is written to comply with the EU General Data Protection Regulation (Reg. 2016/679, the “GDPR”), the Spanish Organic Law 3/2018 (“LOPDGDD”), Law 34/2002 (“LSSI-CE”) and the ePrivacy rules for cookies and commercial communications.

Propel is a B2B product intended for professional and business use only. If you use the Service as a member of a customer organization, that organization is your primary point of contact for how your data is handled within the CRM, see Controller and processor roles below.

Questions or concerns? Reading this Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use the Service. If you still have questions, contact us at team@clvlabs.tech.

Summary of key points

This summary gives the key points of our Privacy Policy. Follow the link after each point for the full detail.

• What personal data do we process? Account and identity data, subscription data, security and usage records, and your communications with us; Plausible’s visit statistics and Cloudflare’s page-speed measurement unless you refuse them; Propel’s own analytics and, on our website, Google Analytics only if you accept them; and, on our website, advertising with Google Ads and LinkedIn Ads only if you accept it. What information do we collect?
• Do we process sensitive personal data? No. We do not intentionally collect special categories of data under Art. 9 GDPR. What information do we collect?
• Do we receive data from third parties? From services you choose to connect, such as Google, Microsoft or a telephony provider, and from Propel partners, who may register with us a company they are talking to, with a contact’s name and work email. We do not buy personal data. Who we share with
• What about my Google account? Connecting it is optional. What Propel reads from Gmail, Google Calendar and Google Contacts is used only for the features you use in Propel, under the Limited Use requirements of Google’s API Services User Data Policy; it is never sold, used for advertising or used to train AI models, and disconnecting deletes our copy of your mailbox. Google user data
• Is the data in the CRM covered by this Policy? Not as controller. The contacts, leads, deals and emails your team works with belong to your organization, which is their controller; we process them on its behalf. Controller and processor roles
• How do we process your information? To provide, secure, support and improve the Service, to manage trials and subscriptions, to communicate with you, and to comply with the law. How do we process your information?
• What happens with AI features? By default they run on an open-weight model that CLV LABS hosts on its own servers, so no outside AI company receives your data; if your organization connects its own provider key, its requests go to that provider instead. Propel trains no model on your data. How do we use AI?
• Do we sell your personal data? No. We never have and we do not intend to. Who we share with
• Where is the data held? The Service and its database are hosted in the European Union. Some providers you may connect are established outside the EEA. International transfers
• What are your rights? Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Your privacy rights
• How do you exercise them? Email team@clvlabs.tech. We respond within one month. Your privacy rights

Table of contents

1. Who we are
2. Controller and processor roles
3. What information do we collect?
4. How do we process your information?
5. What legal bases do we rely on?
6. How do we use AI?
7. When and with whom do we share your information?
8. Do we use cookies and other tracking technologies?
9. How long do we keep your information?
10. Do we transfer information internationally?
11. How do we keep your information safe?
12. Do we collect information from minors?
13. What are your privacy rights?
14. Controls for Do-Not-Track features
15. Automated decision-making and profiling
16. Do we update this Policy?
17. How can you contact us about this Policy?
18. How can you review, update or delete your data?
19. How do we handle Google user data?

1. Who we are

In short: Propel is a CRM provided by a company established in Spain, and we are the controller of the account data described in this Policy.

The controller of the personal data described in this Policy is:

• Provider: CLV LABS SL, a company incorporated in Spain.
• Registered office: Calle Guerau de Liost 8, 08017 Barcelona, Spain.
• Tax ID (CIF/NIF): B05632997.
• Website: propeltech.io.

All privacy and data-protection matters are handled at team@clvlabs.tech. We have not appointed a Data Protection Officer, as our processing does not currently require one under Art. 37 GDPR. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es.

2. Controller and processor roles

In short: we are the controller of your account data. For the records your team keeps in the CRM, your organization is the controller and we act on its instructions.

Propel handles two distinct kinds of personal data, and our legal role differs for each. For account, subscription, website, security and usage data, the details you provide to create and administer an account and how you interact with the Service, Propel is the data controller, and this Privacy Policy governs that processing.

When a customer’s users put personal data into the CRM, their contacts, leads, deals, activities, notes, emails, calls, messages, quotes and form or booking submissions (“Customer Data”), Propel processes it on behalf of and under the instructions of the customer. The customer is the controller of Customer Data and Propel is the processor, under the data-processing terms in our Terms of Service. If your data appears inside a customer’s CRM, for example because you received an email, filled in a form, booked a meeting or opened a quote link, please contact that customer to exercise your rights; Propel will assist them as processor.

3. What information do we collect?

In short: what you give us when you create and use an account, records the Service keeps to run and secure itself, and analytics: Plausible’s visit statistics and Cloudflare’s page-speed measurement unless you refuse them, Propel’s own and, on our website, Google Analytics only if you accept them; and, on our website, Google Ads and LinkedIn Ads only if you accept advertising.

Personal data you disclose to us. As controller, Propel collects and processes the following categories:

• Account and identity data: name, business email and, where provided, phone number; organization name, role and team membership; sign-in data (a hashed password managed by our self-hosted authentication service, sign-in with Google or Microsoft if you use it, or through your organization’s single sign-on provider, which can also create, update and deactivate your account automatically; and whether two-factor authentication is enabled); profile settings, preferences and language.
• Subscription data: the plan you chose, trial dates, number of users, your organization’s AI-credit balance and usage, and the billing details an administrator enters for invoices (legal name, address, country, VAT number and billing email). Payments are handled by our payment provider (Stripe): the card is entered on Stripe’s pages and kept by Stripe to charge the renewals, and Propel receives only the payment status, Stripe’s references for the customer, the subscription and its invoices, and the card’s brand and last four digits to show them in Settings → Plan & usage, never the card number. Stripe also receives the billing details above, because it calculates the tax and issues the invoices on CLV LABS’ behalf.
• Communications data: support requests, emails and messages you send us; correspondence about your account, security and legal matters; your marketing preferences.
• Acceptance records: when and which version of the Terms of Service you accepted when you created your account.
• Newsletter: if you subscribe to the Propel newsletter on our website, your email address, your first name if you give it, your language, and when and how you confirmed. Nothing is sent until you confirm from the link we email you (double opt-in).
• Partner program: if you apply to become a Propel partner or work for one, the Partner Privacy Notice explains what we process and why. It also covers a person whose company a partner registered with us as a prospect, and a visitor who writes to a partner through our partner directory.

Information recorded automatically.

• Security and audit records: sign-ins, failed sign-ins and other security events with the IP address and browser used, and an audit log of administrative actions, with secrets redacted.
• Technical data: IP address, browser and device type, operating system and language, processed to deliver pages and protect the Service against abuse. We do not derive your location from your IP address.
• Analytics: only if you accept it, which screens are opened and which actions are used, recorded by screen name and never by record; and, unless you refuse it, through Plausible, visits to the site, the help center and the app (the page, never a record or a search, the referring site, browser, operating system, type of device and country), with no cookie and without keeping your IP address; and, unless you refuse it, through Cloudflare Web Analytics, how fast the pages of propeltech.io load (the page and the referring page without their parameters, load timings, browser and operating system), with no cookie either; and, only if you accept it, through Google Analytics, which Google Tag Manager loads on propeltech.io only (not in the app), the pages you open on the website and, where Propel’s Google Analytics property measures them, your interactions on those pages, the referring site, your browser, device and approximate location, with cookies (_ga, _ga_<id>) that recognise your browser on later visits. See the Cookie Policy.
• Advertising: only if you accept advertising in the cookie banner, and only on propeltech.io (not in the app), Google Ads and LinkedIn Ads, loaded by Google Tag Manager, measure which of Propel’s ads lead to a demo request or a booked demo, and may show you Propel’s ads on other sites and on LinkedIn (remarketing). When you send a demo request, the email you typed is hashed (SHA-256) in your browser by Google’s tag and sent to Google, to match the conversion to a Google account (enhanced conversions). Google also receives the conversion (demo request or demo booked), Propel’s identifier for that request (so that it is not counted twice), the page, the identifier of the ad click and your browser and device details. Their cookies keep the identifier of the ad click (_gcl_au, _gcl_aw and _gcl_ls for up to 90 days, li_fat_id for up to 30 days), and LinkedIn also uses its own cookies on linkedin.com. See the Cookie Policy.
• Notifications: if you turn on browser notifications, the subscription your browser gives us (an endpoint address and keys) so we can deliver them.

Data from services you connect. If you connect an integration, we receive data from it strictly to run that feature: for example mail and calendar events when you connect Google or Microsoft, contacts and contact photos when you connect Google Contacts (a Microsoft Outlook connection reads neither your Outlook contacts nor contact photos), call records when you connect a telephony provider, or messages when you connect WhatsApp Business. When you send email from Propel through a connected Gmail or Outlook mailbox, the message is sent by that provider from your own account and kept in its Sent folder. You control these connections and can disconnect them at any time in Settings. What Propel accesses from a Google account, and what it does with it, is set out in section 19.

Customer Data (processed as processor). Listed here for transparency. It includes the people your team contacts and the records about them, and some data the Service records about those people for your organization: whether and when an email your team sent was opened or a link in it clicked (with the browser and a hashed, never plain, IP address), unsubscribe and suppression status, and the answers people give in your forms, booking pages and quote links. When a form or a lead source records the advertising click a lead came from (Google Ads’ click identifier), it is kept with the lead; for that, a lead form embedded on your organization’s website reads the Google Ads click cookie (_gcl_aw) in the visitor’s browser when there is one, and your organization is responsible for asking its visitors’ consent for it.

We do not intentionally collect special categories of personal data (Art. 9 GDPR). Please do not enter such data into free-text fields unless strictly necessary and lawful.

4. How do we process your information?

In short: to provide, secure, support and improve the Service, to manage trials and subscriptions, to communicate with you, and to comply with the law.

• To provide and operate the Service: create your account, authenticate you and enforce roles and permissions.
• To manage trials, plans and subscriptions: apply plan limits and AI credits, warn owners before a trial ends, lock, and later delete, a workspace whose trial ended without billing or whose paid plan ended (section 9), and invoice.
• To provide support: answer your requests and resolve problems. With your organization’s request or for security reasons, authorized Propel staff may access a workspace to help; every such access is recorded in the audit log.
• To secure the Service: prevent abuse and fraud, isolate organizations from each other, keep security and audit records and apply rate limits.
• To maintain and improve the product and our website: fix errors and learn from analytics which parts of the Service and of propeltech.io are used (from Propel’s own analytics and Google Analytics only where you consented).
• To measure and run our advertising: learn which of Propel’s ads on Google and LinkedIn lead to a demo request or a booked demo, including through enhanced conversions, and show Propel’s ads to visitors of propeltech.io on other sites and on LinkedIn (remarketing), only where you accepted advertising.
• To provide the AI features you invoke, see How do we use AI?.
• To send service messages, such as security alerts, trial and billing notices and changes to our terms.
• To send marketing about Propel, including the newsletter you subscribed to, where you have opted in or where permitted for existing business customers. You can opt out at any time.
• To produce aggregated statistics about how the Service is used, for example how many workspaces use a feature. They identify no one, are never drawn from the content of Customer Data and are never used to train AI models.
• To comply with legal obligations and to establish, exercise or defend legal claims.
• To credit a workspace to the Propel partner that brought it, and to tell that partner what it needs to be paid (section 7).

5. What legal bases do we rely on?

In short: we process your personal data only when we have a valid legal basis to do so under the GDPR.

Each purpose above rests on a legal basis under Art. 6 GDPR:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may object at any time. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

6. How do we use AI?

In short: AI requests are answered by an open-weight model CLV LABS runs on its own servers, or by the provider your organization connected with its own key. Propel trains no model on your data.

Propel includes an AI sales assistant and AI features such as drafting, summaries, scoring and suggested field values. To answer, the assistant can use tools that read CRM records and mail your organization holds and, when you ask it to, create or update records; if an administrator turns on the background agent, it also reads new emails, calls and meetings on its own to fill empty fields and add a short summary, never replacing a value someone entered; it works within your own permissions, and every change it makes is recorded. When asked to research a company, it can read public web pages: a page you link to, or the website of a company already in your CRM. It only reads them, never fills in forms, and keeps nothing from them unless it is saved to a record. By default, requests go through an AI gateway operated by CLV LABS and hosted in the EU to an open-weight model (currently from the Qwen family) that CLV LABS runs on its own servers, so no outside AI company receives them. If your organization connects its own key for a provider (for example OpenAI, Anthropic, Google Gemini or Mistral), its requests go to that provider under your organization’s own agreement with it, and never fall back to ours. Unless an owner or administrator turns it off, when a member opens a conversation linked to a deal that has a new reply, the AI also fills that deal’s and that contact’s empty fields and adds follow-up tasks and a note at once, and only proposes a change that would replace an existing value. If an administrator has every AI change reviewed, each change the AI would make waits for a person’s approval instead.

AI apps outside Propel. A user can connect an AI assistant of their choice, such as Claude, ChatGPT or Microsoft Copilot, to Propel. It signs in as that user and can read and change only what that user can, in their workspace; it cannot delete records, make bulk changes or send emails. It also cannot search or read a connected Gmail or Outlook mailbox, or save drafts in it. What it reads is then processed by that assistant’s provider under the user’s or the organization’s own agreement with it. Every change it makes is recorded and can be undone, the user can disconnect it at any time in Settings → AI apps, and an administrator can turn off every outside AI app for the workspace. It can also ask for free meeting times, which Propel works out from the busy times of the calendar events synced to Propel, without passing on the events themselves.

Propel does not train any model on your prompts, context or Customer Data. When your organization connects its own key, what that provider may do with what it receives is governed by your organization’s agreement with it. AI conversations are deleted 90 days after their last activity. AI use is limited by your plan’s AI credits and by per-organization controls an administrator can switch off. AI output is advisory: it does not, by itself, make decisions with legal or similarly significant effects.

7. When and with whom do we share your information?

In short: only with providers that help us run the Service, and with the services you choose to connect. We do not sell personal data.

We share personal data only with parties that help us provide the Service, under appropriate contracts and safeguards:

• Hosting: the infrastructure provider that runs the application, database and backups, in the European Union.
• Email delivery: Resend, which delivers the sign-in, notification and outbound messages the Service sends, from its EU region.
• Website delivery and sign-in protection: Cloudflare, which serves propeltech.io and its subdomains (the app, the help center and the administration console) from its network, passes on the links and images in emails sent from Propel, and checks on the sign-in and account forms that a request comes from a person and not an automated script (Turnstile); unless you refuse analytics, it also measures how fast propeltech.io loads (Web Analytics), from the page and the referring page without their parameters, the load timings and the browser’s details. It sees the IP address and the technical details of each request. Turnstile also protects the site’s public forms, such as demo requests, the partner application and messages to a partner in the directory.
• AI: none by default, because the platform’s model runs on CLV LABS’ own servers; if your organization connects its own key, that provider, see How do we use AI?.
• Payments, tax and invoicing: Stripe Payments Europe, Ltd. (Ireland), through the account CLV LABS holds with Stripe, for Plans and AI credits: it takes the payment, keeps the card for renewals, calculates the tax and issues the invoices. Stripe, Inc. (United States) may process this data on its behalf (section 10).
• Website and app statistics: Plausible Insights OÜ (Estonia), on servers in the EU, for every visitor who has not refused analytics; it receives the page address, cleaned of anything that could name a person, the referring site and browser details.
• Website statistics with cookies: Google Ireland Limited, with Google LLC (United States), through Google Analytics, only for visitors to propeltech.io who accept analytics in the cookie banner; it receives the pages they open on the website and, where Propel’s Google Analytics property measures them, their interactions on those pages, the referring site, browser and device details and the identifiers its cookies keep, and processes them for us. Unless the visitor also accepts advertising, Google’s consent mode tells it that advertising storage, ad user data and ad personalisation are not allowed. The transfer to the United States relies on the EU–US Data Privacy Framework (section 10).
• Advertising: Google Ireland Limited, with Google LLC (United States), through Google Ads, only for visitors to propeltech.io who accept advertising in the cookie banner, to measure which of Propel’s ads lead to a demo request or a booked demo and to show Propel’s ads on other sites (remarketing). It receives the conversion (demo request or demo booked), Propel’s identifier for that request, the page, the identifier of the ad click and browser and device details and, when the visitor sends a demo request, the email they typed, hashed (SHA-256) in their browser (enhanced conversions); it sees their IP address. Google’s consent mode allows advertising storage, ad user data and ad personalisation only with that yes. The transfer to the United States relies on the EU–US Data Privacy Framework (section 10).
• Advertising on LinkedIn: LinkedIn Ireland Unlimited Company, through the LinkedIn Insight Tag, only for visitors to propeltech.io who accept advertising in the cookie banner, to measure which of Propel’s LinkedIn ads lead to a demo request and to show Propel’s ads on LinkedIn (retargeting); it sets li_fat_id on propeltech.io and uses its own cookies on linkedin.com. Transfers to LinkedIn Corporation in the United States rely on the EU–US Data Privacy Framework (section 10).
• VAT number validation: the European Commission’s VIES service, which receives an EU VAT number entered in the billing details, to confirm it for invoicing.
• Browser push services (for example Google, Mozilla or Apple), only if you turn on notifications.
• Services you choose to connect, only while the connection is active: Google (Gmail, Calendar, Contacts, sign-in), Microsoft (Outlook, sign-in), Yousign (e-signature), WhatsApp Business (Meta), Aircall and Ringover (telephony), Zoom, Calendly, HubSpot, Salesforce, Pipedrive, Mailchimp, Klaviyo, Brevo, Notion, Holded, Odoo, Sage, Microsoft Dynamics 365 Business Central, SAP Business One, Stripe (importing your own account’s data), lead sources such as Typeform, Google Ads or Meta Lead Ads, chat and automation destinations such as Slack, Microsoft Teams, Discord, Telegram, Zapier, Make, n8n or a webhook address you enter, AI assistants a user connects to their own account (for example Claude, ChatGPT, Microsoft Copilot, Cursor or VS Code), and AI agents on the N0 platform that a user authorizes to read, on their behalf, the CRM data that user can see (and, once that user connects them in Propel, change records on their behalf one at a time: every change is recorded and can be undone, and they cannot delete anything). A lead source can also receive results back when your organization sets it up: Meta receives, for a lead from Meta Lead Ads, Meta’s own lead identifier and each stage the lead reaches; Google Ads receives, in a file it fetches, the click identifier, the conversion, its time and, for a won deal, its value. No name, email address or phone number is sent to either. A data feed your organization publishes (for example for Google Sheets) can be read by whoever has its secret address.
• Professional advisers, auditors and authorities, where legally required or to establish or defend legal claims.
• A successor entity, in connection with a merger, financing, acquisition or sale of assets, subject to this Policy continuing to apply.
• Propel partners: if a partner brought your organization’s workspace (through its link, its code or a deal it registered) or your organization asked us to credit one, that partner sees the workspace’s name, plan, number of users, subscription status and the amounts paid for Propel, so its commission can be calculated. It does not see your Customer Data: no contacts, deals or emails. How we handle partners’ own data is in the Partner Privacy Notice. A workspace may also be credited to a partner by Propel’s team, which records why. If the partner asks Propel to change something in the workspace’s setup, an owner or admin approves or declines the request, and the partner is told the outcome and Propel’s answer. A partner’s person has access to the workspace only if your organization invites them as a user, with the role it chooses.

Which of them are our sub-processors. Hosting, email delivery, Cloudflare and the browser push services also process Customer Data for our customers: they are the sub-processors that section 8 of the Terms of Service refers to. The statistics providers (Plausible, Cloudflare Web Analytics and Google Analytics), Google Ads, LinkedIn Ads, Stripe and VIES receive only data we process for ourselves, as controller; Google and LinkedIn also use the advertising data for their own purposes as controllers, under their own privacy policies (Google, LinkedIn). The services your organization chooses to connect, including an AI provider it connects with its own key, act under its own relationship with them.

We do not sell personal data. Only if you accept advertising on propeltech.io, Google and LinkedIn use data from your visit to measure our ads and to show you Propel’s ads on other sites and on LinkedIn (section 3); refusing advertising stops it. More detail on any provider, including its location and the safeguard used, is available from team@clvlabs.tech.

8. Do we use cookies and other tracking technologies?

In short: strictly necessary storage; Plausible’s visit statistics and Cloudflare’s page-speed measurement, which store nothing on your device, unless you refuse them in the banner; and Propel’s own analytics and, on our website, Google Analytics, which uses cookies, only if you accept them there; and, on our website, Google Ads and LinkedIn Ads, which also use cookies, only if you accept advertising. You can change your choice at any time.

The Service uses strictly necessary cookies and browser storage (for example the sign-in session) that do not need consent, and analytics of three kinds: Plausible’s visit statistics and, on propeltech.io, Cloudflare’s page-speed measurement, which store nothing on your device and run unless you refuse them in the cookie banner; Propel’s own product analytics; and, on propeltech.io only, Google Analytics, loaded through Google Tag Manager, which sets cookies (_ga, _ga_<id>). The last two stay off until you accept analytics there, and refusing it later deletes Google Analytics’ cookies. On propeltech.io only, a third optional category, advertising, lets Google Tag Manager run Google Ads and the LinkedIn Insight Tag, which set cookies (_gcl_au and _gcl_aw for up to 90 days, li_fat_id for up to 30 days; LinkedIn also uses its own cookies on linkedin.com) to measure which of our ads lead to a demo request or a booked demo and to show you Propel’s ads on other sites and on LinkedIn; with it, the email you type in a demo request reaches Google hashed. It stays off until you accept advertising, and refusing it later stops both tags and deletes the cookies on propeltech.io at once. Google Tag Manager loads with a yes to analytics or to advertising, and each tag in it waits for its own: Google Analytics runs only with the yes to analytics, and Google Ads and LinkedIn’s tag only with the yes to advertising. You can change your choice at any time. Emails your organization sends through Propel can carry open and click tracking for your organization’s records, described in section 3. Every cookie and storage item is listed in the Cookie Policy. If you arrive through a Propel partner’s link and accept “Partner link” in the cookie banner, the partner’s code is kept in your browser for up to 90 days; without that consent nothing is stored, and the code is kept with your account only if you sign up.

9. How long do we keep your information?

In short: only as long as we need it for the purposes in this Policy, plus any period the law requires.

• Account data and Customer Data: for the life of the organization. When an owner deletes the organization, its data and its members’ accounts are deleted at once.
• Workspaces whose free trial ends without billing ever being activated: locked when the trial ends and deleted with their Customer Data 90 days later. Owners and admins are warned by email two weeks before and again the day before, and can export their data until then. A workspace owned by a member of a Propel partner is not deleted while they remain a member.
• Workspaces whose paid plan ends without being renewed: locked when the plan ends and deleted, with their Customer Data and their members’ accounts, 90 days later. Owners and admins are warned by email two weeks before and again the day before, and can export their data until then; the same exception applies to a workspace owned by a member of a Propel partner. Invoices already issued are kept for the period tax law requires.
• AI conversations: deleted 90 days after their last activity.
• Product analytics (with consent): 180 days.
• Plausible visit statistics (unless you refuse them): kept only as aggregated counts, which hold no IP address and no identifier.
• Cloudflare page-speed measurements (unless you refuse them): shown to us only as aggregated figures, which hold no IP address and no identifier.
• Google Analytics (only if you accept it): Google keeps the data tied to your browser for the data-retention period set in Propel’s Google Analytics property; its cookies last up to two years from your last visit, unless you refuse analytics, which deletes them.
• Google Ads and LinkedIn Ads (only if you accept advertising): their cookies on propeltech.io last up to 90 days (_gcl_au, _gcl_aw, _gcl_ls) and 30 days (li_fat_id), unless you refuse advertising, which deletes them at once; LinkedIn’s own cookies on linkedin.com last as long as LinkedIn sets them, up to one year. Google and LinkedIn keep what they use for their own purposes under their own policies.
• Email open and click records: the hashed IP address and browser are removed after 90 days and the records deleted after 400 days.
• Webhook delivery and AI error logs: 30 days.
• Security logs (sign-ins and failed sign-ins with the IP address and browser used, password and email changes, and the other security events): 12 months, then deleted.
• The audit log of administrative actions and changes to records: for as long as the workspace exists, because it is the record of who did what in it, and deleted with the workspace.
• Billing and invoicing records: for the period required by Spanish tax and accounting law.
• Newsletter subscriptions: until you unsubscribe. We then keep the address with its consent and unsubscribe dates, so that you are not emailed again and we can show you consented while you were subscribed.
• Marketing and consent records: until consent is withdrawn or the relationship ends, plus the period needed to prove consent.

Deleted data can remain in infrastructure backups until those backups expire in their normal rotation; it is not restored into the Service except to recover from an incident.

10. Do we transfer information internationally?

In short: the Service is hosted in the EU. Some providers you may connect are established outside the EEA, under recognized safeguards.

The Service, its database, its backups and our AI gateway are hosted in the European Union. Some providers listed in section 7 are established outside the European Economic Area, mostly in the United States (for example Google, Microsoft, Resend, Stripe or the AI provider your organization connects). Where personal data reaches them, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework for certified providers, or on the European Commission’s Standard Contractual Clauses. On propeltech.io, Google Analytics, Google Ads and LinkedIn Ads, each only with your consent, send data to the United States, to Google LLC and LinkedIn Corporation, both certified under the EU–US Data Privacy Framework. You may ask which safeguard applies to a specific provider at team@clvlabs.tech.

11. How do we keep your information safe?

In short: we apply technical and organizational measures appropriate to the risk. No system can be guaranteed perfectly secure.

Our measures include TLS encryption in transit; AES-256-GCM encryption at rest for stored integration credentials; database row-level security that isolates each organization, with role-based permissions; two-factor authentication, which workspace owners and admins must use unless they sign in through their organization’s single sign-on; security-event and audit logging that no user can modify or delete; hardened outbound webhooks; least-privilege access; support access that is recorded in the audit log and cannot erase data or mint credentials; and automated security checks before every release. Any backup copies of the Service stay on infrastructure in the EU. We recommend that Customers keep their own regular exports.

Despite these measures, transmission over the internet can never be guaranteed to be completely secure. You should only access the Service from a secure environment. If you discover a vulnerability, please contact team@clvlabs.tech.

12. Do we collect information from minors?

In short: no. The Service is a business tool for users aged 18 or over.

The Service is not directed to children and we do not knowingly collect personal data from minors. By using the Service you represent that you are at least 18 years old. If we learn that we have collected personal data from a user under 18, we will deactivate the account and take reasonable steps to delete that data promptly. If you believe a minor has provided us with personal data, contact team@clvlabs.tech.

13. What are your privacy rights?

In short: you can access, correct, delete, restrict, port and object. Email us and we will respond within one month.

Subject to the conditions and exceptions in the GDPR and LOPDGDD, you have the right to:

• Access your personal data and obtain a copy of it.
• Rectify data that is inaccurate or incomplete.
• Erase your data, where one of the grounds in Art. 17 GDPR applies.
• Restrict processing in the circumstances set out in Art. 18 GDPR.
• Port the data you provided to us, in a structured, machine-readable format.
• Object to processing based on legitimate interests, and at any time to direct marketing.
• Withdraw consent at any time, where processing is based on consent. This does not affect processing carried out before withdrawal.

To exercise these rights, contact team@clvlabs.tech. We may need to verify your identity, and will use anything you send for that verification and nothing else. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need that extension.

Opting out of marketing. You can unsubscribe from marketing email at any time using the link in the message or by emailing us. You will still receive service messages that are necessary to administer your account, respond to support requests, or meet a legal obligation.

If your data is inside a customer’s CRM, the customer is the controller, please direct your request to that organization, and we will support them as processor. To help customers meet these obligations, Propel provides admin-only tools: full organization export, per-person data export, and erasure of a contact, lead or team-member profile. You may also lodge a complaint with the AEPD (www.aepd.es) or the supervisory authority in your country of residence, though we would appreciate the chance to address your concern first.

14. Controls for Do-Not-Track features

In short: we do not respond to browser Do-Not-Track signals. The cookie banner is the control that actually works.

Most browsers include a Do-Not-Track (“DNT”) setting that signals you do not want your browsing monitored. No uniform standard for honouring DNT has been finalized, and Propel does not currently respond to DNT or Global Privacy Control signals. We say so plainly rather than imply a protection we do not provide.

What does work is the cookie banner: Propel’s own analytics is not recorded at all, and Google Analytics is not loaded at all, until you accept analytics; Google Ads and LinkedIn Ads do not run until you accept advertising; Plausible and Cloudflare Web Analytics stop as soon as you refuse analytics; and you can change those choices at any time from Cookie settings. See the Cookie Policy.

15. Automated decision-making and profiling

In short: our scoring features rank records to help a human decide. They do not make decisions about you on their own.

Propel offers lead scoring, lead routing and analytics that rank, prioritize or assign records to help sales teams focus their effort, which involves a form of profiling. These are decision-support tools: a person reviews and decides on any action, and they do not produce decisions based solely on automated processing that have legal or similarly significant effects, so the Art. 22 GDPR safeguards are not triggered. They operate on Customer Data, for which the customer is the controller; questions about a specific score should be directed to that organization.

16. Do we update this Policy?

In short: yes, as the Service and the law change. Material changes are notified.

We may update this Policy to reflect changes in the Service, our practices or the law. When we make material changes, we will revise the date above and, where appropriate, notify you by email or in the app. The current version is always available at propeltech.io.

17. How can you contact us about this Policy?

In short: email us, or write to our registered office.

Email team@clvlabs.tech, or visit our contact page. By post: CLV LABS SL, Calle Guerau de Liost 8, 08017 Barcelona, Spain.

18. How can you review, update or delete your data?

In short: most of it from your account settings; the rest by emailing us.

You can review and update much of your account and profile data directly in the Service, under Settings, and an owner can export or delete the whole organization there. To request a copy of everything we hold about you, to correct it, or to have it deleted, email team@clvlabs.tech and we will handle it as a data-subject request under section 13.

Related documents: the Terms of Service, the Legal Notice and the Cookie Policy.

19. How do we handle Google user data?

In short: connecting a Google account is optional. Propel uses what it reads from Google only to show your own mail, calendar and contacts inside Propel and to act on them when you ask or as your workspace is set up to do. It never sells that data, never uses it for advertising and never uses it to train AI models, and you can disconnect at any time.

This section describes how Propel accesses, uses, stores, shares and deletes data from a Google account (“Google user data”) when a user signs in with Google or connects Gmail, Google Calendar or Google Contacts. It applies together with the rest of this Policy.

Limited Use. Propel’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Propel accesses, and why. Propel asks only for the permissions of the features you turn on:

How Propel uses it. Only to provide the user-facing features above, at your request or as your organization’s settings direct, and to keep them working and secure. That includes Propel’s AI features, described in How do we use AI?: the assistant reads a conversation when you ask it about one or ask it to draft a reply; when you open a conversation linked to a deal that has a new reply, it fills that deal’s empty fields and adds follow-up tasks and a note, which can be undone, unless an owner or administrator turns this off, and it only proposes a change that would replace a value (every change, if your workspace reviews AI changes); and if an administrator turns on the background agent, it reads the new emails filed onto CRM records to fill empty fields on those records and add a short summary to their timeline; it never sends anything, and an owner or administrator can undo every change it makes.

• Propel does not sell Google user data, does not use it for advertising, including personalized, retargeted or interest-based advertising, and does not use it to determine creditworthiness or for any purpose unrelated to the features above.
• Propel does not use Google user data, including data obtained through Google Workspace APIs such as Gmail, Google Calendar and Google Contacts, to develop, improve or train generalized (non-personalized) artificial-intelligence (AI) or machine-learning (ML) models, and does not retain that data for that purpose. Propel trains no AI model of any kind on it. By default Propel’s AI features run on an open-weight model that CLV LABS hosts on its own servers, so the Google user data they process is not sent to any outside AI company. If your organization connects its own AI provider key, its members’ requests go to that provider instead, under your organization’s agreement with it.
• No person at Propel reads your Google user data, except with your explicit agreement or your organization’s (for example when you ask support to look at a specific message), when it is necessary for security purposes such as investigating abuse, to comply with applicable law, or in aggregated and anonymized form for internal operations.

Where it is kept, and how it is protected. To keep the inbox quick and in step, Propel keeps a copy of the threads in your connected mailbox in its database in the European Union, refreshed about once a minute. Only you can see your mailbox’s copy, not other members of your workspace. Messages exchanged with people in your CRM are filed onto their records, for example on a contact’s timeline, when you open or send them in Propel, and, while your inbox is open in Propel, when you send them from Gmail itself; they then become part of your organization’s CRM records and are visible to the colleagues who can see those records. Events from the calendars you choose are kept in Propel’s calendar, contacts you import become CRM contacts, and a photo found in your Google Contacts becomes the photo of the CRM contact it belongs to. Google access and refresh tokens are encrypted at rest with AES-256-GCM, and all data travels over TLS. Your own browser also keeps the first page of your inbox (the sender, subject and opening lines of the newest conversations) so that it opens at once; it is deleted when you sign out or your session ends, as the Cookie Policy describes.

Who receives it. Google user data is shared only with the providers that host and run the Service for us, listed in section 7; with the AI provider your organization connects with its own key, if it does, as described above; with the people and services you direct it to, for example when you send an email or connect another integration that reads your CRM; where the law requires it; or, with your prior consent, as part of a merger, acquisition or sale of assets. AI apps that a user connects to Propel from outside (see How do we use AI?) get no access to your mailbox: through Propel they cannot search or read your Gmail conversations, save drafts or send email. Like any integration that reads your CRM, they can read the CRM records that the user they act for can see, including the messages already filed onto those records. They can also ask for free meeting times, which Propel works out from the busy times of your synced calendar events, without passing on the events.

How to stop access and delete it.

• Disconnect Google at any time in Propel, under Settings → Email or Connections. Propel then revokes its access at Google, deletes its tokens and deletes its copy of your mailbox straight away.
• You can also remove Propel’s access from your Google Account at myaccount.google.com/permissions. Propel can then no longer read or send anything, and it stops showing the copy of your mailbox; it deletes that copy when you disconnect in Settings, when your account is deleted, or when you ask us to.
• If your organization deactivates your account, Propel stops using your Google connection at once: nothing more is sent from your mailbox and its copy stops updating. If you come back, connecting it again is up to you.
• Messages filed onto CRM records, calendar events kept in Propel and contacts you imported stay part of your organization’s CRM data after you disconnect, until you or your organization delete them; deleting your account or your organization deletes them as described in How long do we keep your information?.
• To have any Google user data deleted, or to ask what we hold, email team@clvlabs.tech.

Published and in force as of the date above. It describes the processing this Service actually performs.