How Ownly handles your data.

Who this notice covers

Ownly is a CRM for Australian small businesses. This notice describes how we handle personal information when you run a business on Ownly, when your team uses it with you, and when someone uses the public site to chat or book a call.

Information we collect

What we hold depends on how you use Ownly:

• Account and sign-in. Your name, email, password, and optional two-factor authentication. Passwords are stored for authentication, not as plain text.
• Business records you add. Contacts, companies, deals, notes, reminders, files, quotes, invoices, forms, boards, and anything else you enter for your work.
• Team access. Invites, roles, and module access you set for people in your business.
• Ownly billing. Subscription and payment details are processed by Stripe on our behalf. We keep enough billing state in Ownly to run your plan, modules, and dunning.
• Public site. Messages you send in the pricing chat, and your name, email, and note when you book a call. We may also store a recommended module list from that chat.
• Connected modules. If you turn on SMS, email, payments, or accounting modules, we store the messages, logs, and sync records needed to run those features with the accounts you connect.

How we use information

We use personal information to:

• Provide, maintain, and secure the CRM you pay for.
• Bill for the base product and modules, and respond to failed payments without deleting your data.
• Send service email such as password resets and booking confirmations.
• Run the public chat and booking flows, including rate limits to reduce abuse.
• Support your account when you ask for help, including a time-limited support view that is shown clearly in the app.
• Keep an audit trail of important account actions for security and troubleshooting.

We do not sell personal information.

Service providers and integrations

We use infrastructure and specialist providers to run Ownly, including hosting, databases, file storage, email delivery, and payment processing. When the public chat is enabled with AI, your messages may be sent to that provider to suggest modules from our catalog.

You can also connect your own Stripe, Twilio, and Xero accounts. API keys and tokens for those integrations are encrypted at rest. After you save them, they are not sent back to the browser. Data then flows between Ownly and those services according to the features you use, such as pay links, SMS, or accounting sync.

Booking a call may create a calendar event and Google Meet link when calendar integration is connected. That uses the name, email, and note you provide.

Who can see data in your account

People you invite can see and work with CRM data according to their role and module access. Account owners can manage billing, exports, and deletion. Only the owner can request account deletion or download exports from settings.

Ownly support staff with platform access can enter a limited support session to help you. That session shows a banner in the app and expires automatically.

Security

• Sessions expire after a period of inactivity, and password reset revokes existing sessions.
• Two-factor authentication is available on your account and is required for platform administration access.
• Integration secrets are encrypted with a server key and are kept out of API responses and the browser after save.

Export, retention, and deletion

Account owners can export contacts and deals from settings. Exports include names, emails, phones, companies, deal titles, values, stages, and status.

You can request deletion of your business account from settings. Deletion waits 30 days, and you can cancel during that time. A failed payment does not delete your data. When the waiting period ends, contacts, deals, files, and team access for that account are removed.

We keep information for as long as needed to run the service, meet legal obligations, and resolve disputes. Public chat and booking records may be kept to follow up on sales conversations unless you ask us to remove them.

Australian privacy rights

We handle personal information in line with the Australian Privacy Principles. Depending on what applies, you may ask for access to or correction of personal information we hold about you, or raise a concern about how we handle it.

Some of our service providers may process or store information outside Australia. When that happens, we take reasonable steps to ensure those providers handle information in a way that is consistent with this notice and applicable law.

Updates and contact

We may update this page when Ownly changes. The current version is always published here.

Questions about privacy or a request relating to your information: book a call.