1. Who we are
Interface365 ("we," "us," "our") is a B2B customer relationship management (CRM) platform. The Service is operated by iface LLC, the parent company behind the Interface365 product.
This Privacy Policy explains how we handle two distinct categories of data:
- Account data — information about you and your team as customers of Interface365
- Customer Content — the records you store inside the CRM (leads, contacts, companies, deals, etc.)
These categories are governed differently. Skip to §4 if you're a privacy officer evaluating us as a data processor under GDPR.
2. Information we collect
2.1 Information you give us directly
When you create an account, sign in, or use the Service, you provide:
- Account info — name, email, role, workspace name
- Authentication — managed by Firebase Authentication; we don't see or store your password (Firebase does)
- Payment info — handled by Stripe; we never see your full card number, only the last 4 digits and brand
- Communication preferences — language, timezone, notification settings
- Support requests — emails you send to us
2.2 Information collected automatically
When you use the Service, we collect:
- Usage data — pages visited, features used, actions taken (with timestamps)
- Device info — browser, OS, IP address, screen resolution
- Login history — IP, geo-IP city/country, user-agent (visible to you in
Settings → Security) - Webhook delivery logs — for outbound webhooks you configure
We do not currently use third-party analytics services like Google Analytics or Mixpanel. If we add them, this section will be updated and customers notified.
3. How we use information
We use your information only to:
- Provide and operate the Service (authentication, store records, send webhooks, etc.)
- Process payments through Stripe
- Send transactional emails (account confirmation, billing, security alerts) via MSG91
- Respond to support requests
- Enforce our Terms of Service
- Comply with legal obligations
- Improve the product (using aggregated, non-identifying usage patterns — never specific Customer Content)
We do not:
- Sell your data
- Share your data for advertising
- Use Customer Content to train AI models
- Read or analyze your CRM records for any purpose other than providing the Service
4. Customer Content (the data inside your CRM)
The records you create in Interface365 (leads, contacts, companies, deals, projects, quotes, tasks, files, notes, activities) are your property. We store them on your behalf to provide the Service.
Customer Content is:
- Treated as confidential under our Terms of Service
- Encrypted at rest and in transit (TLS 1.2+)
- Isolated per tenant — never mixed with another customer's data
- Exportable at any time in CSV / JSON / via REST API
- Used only to provide the Service to you — never for our own purposes
For Customer Content that contains personal data of your end-users (e.g., your contact's email), you are the Data Controller and we are the Data Processor under GDPR Article 28. A Data Processing Agreement is available on request from hello@interface365.ai.
5. Subprocessors
We rely on the following third parties to operate the Service. Each is bound by data processing agreements consistent with the protection of your data.
We will notify you at least 30 days before adding new subprocessors via email and an updated version of this list.
6. Data retention
- Active account data: retained as long as your account is active
- Customer Content: retained while your account is active. After account closure, retained for 90 days for legal/tax/dispute purposes, then permanently deleted
- Payment records: retained 7 years for tax compliance
- Login + access logs: 90 days (used for security investigations)
- Webhook delivery logs: 30 days
- Stripe webhook event records: 30 days (for idempotency)
- Support emails: 2 years
You can request earlier deletion at any time — see §7.
7. Your rights
If you're in the EU/EEA, UK, or California, you have the following rights regarding your personal data:
- Access — get a copy of your personal data
- Correction — fix inaccurate data
- Deletion — request deletion (subject to retention requirements above)
- Portability — export your data in a standard format (CSV / JSON / via REST API)
- Restriction — limit how we process your data
- Objection — object to processing for legitimate interests
Most of these can be exercised directly in Settings → Profile or Settings → Security. For requests we can't fulfill in-app, email hello@interface365.ai. We respond within 30 days.
8. Security
We follow industry-standard security practices:
- Data encrypted in transit (TLS 1.2+) and at rest
- Access to production systems limited to authorized personnel and audit-logged
- Soft-delete with audit logs for record changes
- Per-tenant data isolation enforced at the SQL layer
- Customer-managed visibility controls (Owner / Team / Everyone) on every record
- Webhook signing with HMAC-SHA256
- API key scoping with revocation + last-used tracking
- Brute-force protection on OTP verification (per-email lockout)
- IP restriction (per-tenant whitelist/blacklist for admins)
- Stripe webhook idempotency to prevent duplicate processing
We are not yet SOC 2 or ISO 27001 certified. Certification is on our roadmap. Customers requiring formal certifications should contact us before signing.
9. International transfers
Customer Content is stored on Google Cloud Platform in the asia-south1 (Mumbai) region. If you're in the EU/EEA, your data may be transferred outside the EU based on Standard Contractual Clauses (SCCs). On request, we'll provide the executed SCCs.
10. Cookies
We use only the cookies necessary to operate the Service:
- Authentication — Firebase auth session cookies
- Tenant context —
i365_current_tenant_idto remember which workspace you're in - Preferences — theme, language, timezone
We don't use advertising cookies, social media tracking pixels, or third-party analytics cookies. If this changes, customers will be notified and a cookie banner will be added.
11. Children's privacy
Interface365 is for businesses. We don't knowingly collect data from children under 16. If we learn we have, we delete it.
12. Changes to this policy
If we make material changes, we'll email all account owners at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.
13. Contact
Privacy questions, data subject requests, or any other concerns:
If you're in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.