Who this policy covers

This policy covers RAFID CRM at rafid-crm.app, including its account, workspace, company email and WhatsApp features. Mircado LLC operates RAFID and handles information needed to administer the service. A company using RAFID decides what customer, employee and business information to put in its workspace and which employees may access it.

For information entered by a company, contact that company about its business decisions and privacy practices. You may also contact us at [email protected] for requests concerning RAFID or help identifying the responsible workspace.

Information we process

• Account and membership: email address, display name, account identifier, verification state, company memberships, assigned roles and invitations. Firebase Authentication manages account authentication; CRM records do not contain your Firebase account password.
• Workspace records: contacts, companies, opportunities, tasks, meetings, conversations, service requests, reports, products, quotes, workflow settings and company preferences. HR-enabled workspaces may contain employee and leave information entered by authorized members.
• Company email: verified domains, DNS verification results, mailbox addresses and assignments, email messages, attachments, folders, drafts and delivery-related information for mailboxes connected through RAFID.
• WhatsApp and Meta: authorized business account and phone identifiers, number status, business profile details, templates, connection credentials, inbox access assignments, participant phone numbers, message content, supported attachments, timestamps, delivery/read events and recorded message statistics. Connection data comes from the business owner's Meta authorization. RAFID receives new message events after connection; it does not automatically import earlier WhatsApp history.
• Operational information: request and error records needed to run the service, such as IP addresses, request paths, timestamps and response status. Your browser may store authentication state and workspace preferences.

How we use information

We use this information to authenticate accounts, verify email addresses, isolate company workspaces, enforce roles and inbox access, save and display business records, deliver enabled email and WhatsApp functionality, process requested exports or deletion, provide support and protect the service against misuse.

Owners authorize WhatsApp connections through Meta's Embedded Signup. Authorized teammates can read or reply only to assigned numbers. Free-form WhatsApp replies follow the customer-service window; initiating a conversation outside that window requires an approved supported template and recorded customer permission. RAFID does not use WhatsApp message content for advertising profiles or sell it.

Service providers and disclosure

RAFID uses Google Firebase for authentication and database services, Cloudflare for website delivery and domain infrastructure, Contabo for the server hosting RAFID's integration and mail services, and Meta/WhatsApp for authorized WhatsApp Business functionality. Company email runs on the mail infrastructure used by RAFID. These providers process information required for their respective functions and may operate in countries different from yours.

Data is available to members of your company according to their role and explicit inbox assignments. We may access information when necessary to provide requested support, investigate security or operational problems, or comply with applicable legal obligations. We do not sell personal information. A new optional integration may introduce another provider; its connection information and applicable privacy disclosures should be reviewed before it is enabled.

Meta and WhatsApp operate their own services under their own terms and privacy notices. See WhatsApp's privacy policy and Meta's privacy policy.

Retention and deletion

Workspace records and saved inbox history remain available while the workspace exists unless removed through a supported feature or a verified deletion request. Disconnecting a WhatsApp number stops that RAFID connection and removes its stored connection credential; it retains saved conversation history. It does not delete the business assets held in Meta.

Complete workspace deletion removes its RAFID records, nested WhatsApp data, stored connection credentials, invitations and member links, and its approved company mail accounts and mail storage. It does not delete other workspaces, users' separate login accounts, Meta-owned accounts or numbers, or copies already delivered to recipients. A limited deletion-completion record is retained to report cleanup status. Security records or information subject to a legal retention obligation may be retained where necessary.

Individual account deletion and requests concerning a specific person's records are handled through verified support requests. See our data-deletion instructions for the available actions and their scope. We explain any applicable retention limitations when responding.

Security

RAFID enforces workspace and role access in its database and server APIs. WhatsApp connection credentials and company mailbox passwords are encrypted on the server and are not included in the browser application. Public app traffic uses HTTPS. We verify signed WhatsApp webhooks before storing their events.

You are responsible for safeguarding your account, assigning appropriate roles and inbox permissions, and providing company data only when you have authority to do so. No service can guarantee absolute security.

Your choices and requests

You can update supported account and workspace settings, export permitted records, ask the owner to change your access, disconnect an authorized integration or request deletion. Privacy rights depend on your location and circumstances; contact [email protected] to request access, correction, export or deletion, or raise a concern.

Include your RAFID account email and enough detail to identify the relevant company or connection. We may verify your identity and authority before acting. Do not send account passwords, access tokens, app secrets or confidential message content in an initial request.

Browser storage and intended users

RAFID uses browser storage needed for authentication, session continuity and saved interface preferences. Its Meta SDK supports the owner's connection flow; automatic Meta app event logging is disabled in RAFID's SDK initialization. These public information pages do not initialize Firebase or the Meta SDK.

RAFID is a business service intended for authorized company users, not for children. If you believe a child has provided personal information to RAFID, contact us.

Changes and contact

We may update this policy as RAFID or its integrations change. The date at the top identifies the current version. Material changes will be communicated through an appropriate service notice. For privacy questions, contact Mircado LLC at [email protected].