Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how QREW CRM handles personal and business information when authorized users access the CRM application at crm.qr-oo.com. QREW CRM is operated as part of the QREW/QROO business application environment.

QREW CRM is designed primarily for authorized business users. It manages customer relationships, services, quotations, orders, service-level agreements, invoices and related commercial records where enabled, tasks, follow-up work, reporting and formal business documents.

2. Information QREW CRM processes

The categories of information processed depend on how your organization uses the CRM and the permissions assigned to you. They may include account and identity information, client and contact information, service records, quotations, orders, SLAs, invoices and related commercial records, tasks, notes, ownership and assignment information, document and print records, audit or activity history, and technical security/session information.

Business users may enter information about their customers, contacts, prospects, staff, suppliers or service activity. The organization using QREW CRM is responsible for ensuring that it has an appropriate legal and business basis to enter and process that information.

3. Google user data used for Sign-In

QREW CRM uses Google OpenID Connect to authenticate approved users. The application requests the Google identity scopes openid, email and profile for sign-in. These scopes are used to receive and verify identity information such as a Google account identifier, verified email address, basic profile/display information and, for Google Workspace accounts, the hosted-domain claim when Google provides it.

QREW CRM uses this Google user data to confirm the identity of the person signing in, apply approved Workspace or exact-email access policy, match the verified email to an authorized CRM user, prevent unauthorized access, establish and protect the CRM session, and bind the Google account identity to the approved CRM actor where required for secure repeat sign-in.

The standard QREW CRM Google sign-in flow does not request Gmail, Google Drive, Google Calendar or other Google content scopes. Google user data obtained for sign-in is not used for advertising, profiling for advertising, or sale to third parties.

Google access tokens are not stored in normal browser storage for day-to-day CRM use. Authentication is converted into a QREW CRM application session after identity and CRM authorization checks succeed.

4. How information is used

QREW CRM uses information to provide CRM functionality, authenticate and authorize users, maintain client and service records, support commercial and operational workflows, generate formal business documents, assign and track tasks, provide reporting and management visibility, maintain security and auditability, diagnose service issues, and comply with legitimate operational or legal requirements.

Access to CRM information is controlled by company-scoped user permissions and roles. A successful Google authentication does not automatically grant unrestricted access to CRM records.

5. Cookies, sessions and security data

QREW CRM uses secure session and authentication cookies to maintain sign-in state, protect the authorization flow, prevent replay or tampering, and keep users authenticated for the permitted session period. These cookies are required for the secure operation of the application and are not intended for advertising tracking.

Technical information such as request identifiers, security events, authentication status, IP/network metadata made available by hosting infrastructure, browser information and error categories may be processed to operate, secure, monitor and troubleshoot the service. Security logging is designed to avoid intentionally recording OAuth authorization codes, access tokens, client secrets or raw session-cookie values.

6. Storage and retention

CRM business information is retained for as long as required by the organization using QREW CRM for its customer, operational, financial, audit, contractual or legal purposes, subject to applicable policies and law.

Authentication/session information is retained only for the period required to operate and secure the session or to maintain authorized identity binding and security audit history. Records may be retained for a longer period where needed for legal claims, security investigation, regulatory compliance, accounting obligations or backup integrity.

7. Sharing and service providers

QREW CRM may process information through infrastructure and service providers that support hosting, databases, security, authentication, networking, deployment, backups or related application operations. These providers process information only as necessary to provide the relevant infrastructure or service and are not granted permission by QREW CRM to sell CRM user data.

Google processes the Google authentication interaction under Google's own terms and privacy practices. QREW CRM receives only the identity information required by the configured sign-in scopes and the resulting authentication protocol.

Information may also be disclosed when required by law, valid legal process, regulatory obligation, or when reasonably necessary to protect users, the service, QREW/QROO business operations or the rights and security of others.

8. Google API Services User Data Policy

QREW CRM's use and transfer of information received from Google APIs is limited to providing and improving the authentication and user-authorized functionality described in this policy. Google user data obtained through the sign-in scopes is not sold, used for targeted advertising, or transferred for unrelated purposes.

Access to Google user data is limited to the minimum identity information required to authenticate and authorize users. If QREW CRM's use of Google user data changes, this Privacy Policy and the application's Google authorization configuration will be updated accordingly.

9. Security safeguards

QREW CRM uses security measures appropriate to a business CRM, including HTTPS, secure cookies, authenticated sessions, role- and permission-based access, server-side identity verification, controlled OAuth/OIDC flows, request validation, and separation between Google authentication and CRM authorization.

No online system can guarantee absolute security. Users are responsible for protecting their Google accounts, devices and authorized CRM access, and for reporting suspected compromise promptly through the organization's established support or administration channel.

10. User and data-subject requests

Depending on applicable law and your relationship with the organization using QREW CRM, you may have rights to request access, correction, deletion, restriction or other action relating to personal information. Requests concerning customer or employee data stored by an organization should normally be directed first to that organization, because it determines why the relevant CRM information is processed.

Requests concerning QREW CRM account access, authentication or platform privacy may be submitted through the existing QREW/QROO support or company administration channel used to provide your access to the application.

11. Account deactivation and session termination

An organization may disable a CRM actor, disable Google OIDC access, change permissions, revoke sessions or otherwise remove access when a user no longer requires the application. Deactivation prevents further authorized use but does not necessarily delete business records that must be retained for operational, contractual, accounting, audit or legal purposes.

12. International processing

The hosting, networking, authentication and database providers used by QREW CRM may process information in more than one country. Where information is transferred internationally, QREW CRM and its operators use the relevant service-provider safeguards and access controls available for the deployment environment.

13. Children

QREW CRM is a business application intended for authorized company users and is not directed to children. Organizations should not provide CRM accounts to persons who are not legally permitted to use the service in their jurisdiction or workplace context.

14. Changes to this policy

This policy may be updated when the application, data practices, service providers, legal requirements or Google authorization scopes change. The current version will be published on this page with an updated effective date. Material changes to Google user-data handling will be reflected in the policy before or when the changed processing begins.

15. Contact

For privacy, account or data-handling questions, contact QREW/QROO through the existing support, administrator or company contact channel through which your organization received access to QREW CRM. This page intentionally does not publish an unverified legal address or registration detail that is not established in the application record.