Privacy policy

Effective 24 October 2026

DayThree CRM (crm.daythree-studio.com) is a lead management system built and operated by DayThree Studio, a marketing studio in Singapore. This policy explains what the CRM stores, why, who can see it, and how to have it corrected or deleted. It is written to satisfy Singapore's Personal Data Protection Act (PDPA) and the requirements of the platforms the CRM connects to. The studio's own marketing website has a separate policy at daythree-studio.com.

1. Two kinds of people, two roles

The CRM is organised into workspaces. DayThree Studio has one for its own enquiries, and each client business has its own.

• Workspace users are the staff who sign in: DayThree Studio's team and the client businesses' teams. For them, DayThree Studio is the organisation collecting and using the data.
• Leads are the people who contact a business through a form on its website, by WhatsApp, or by other channels the business connects. For a client's workspace, the client business is responsible for its leads' data and decides how it is used; DayThree Studio processes it on that business's behalf to run the CRM. For DayThree Studio's own workspace, DayThree Studio is responsible.

If you contacted a business and want to know what it holds about you, the fastest route is that business. You can also write to us and we will locate the workspace and either act on the request or pass it on, whichever the law requires.

2. What the CRM stores

About workspace users

• Name, email address, and a password (stored only as a hash by our authentication provider).
• Workspace membership and role, and which leads are assigned to you.
• Notes and actions you record on leads, with a timestamp and your name.
• Sign-in session cookies, and the time of recent sign-ins.

About leads

• What the person gave in the form or message: typically name, phone number, email, and their message or answers to the form's questions.
• Where the enquiry came from: which website form or channel, the page and button used, and, when the business runs advertising, campaign attribution such as UTM parameters or a Google click identifier (gclid).
• The lead's progress through the business's pipeline, notes staff write, and the timeline of follow-ups.
• When a business connects WhatsApp or Telegram to its workspace: the messages exchanged with the business on that number, the sender's number and display name, timestamps, and delivery status. Photos, documents and voice notes are recorded as their type and caption; the file itself is not copied into the CRM.
• Read marks: emails a business sends to its leads through the CRM carry a tiny invisible picture. When the lead's mail app loads it, the CRM records the time and a rough kind of mail app (such as Gmail or Outlook), and shows the email as read. No IP address or location is kept, and these records are deleted after 12 months. Read marks are on for every workspace, and a business can turn them off in its email settings.

About connected accounts

• Access tokens for services a workspace connects (Google Calendar, Google Ads, Gmail, Microsoft Outlook, Telegram, WhatsApp, Meta), and the app password of a mailbox a workspace connects to send email from, stored encrypted with a key held outside the database. What the Google connections read and write is set out in section 5.
• Campaign-level advertising performance figures: spend, impressions, clicks and conversions per campaign per day. No audience or individual-level advertising data.

Technical

• On the public form endpoints, the sender's IP address is hashed and kept for up to six hours, only to limit abuse. The raw address is not stored with the lead.
• A count of how often each hosted form is viewed. No cookies are set by hosted forms.
• Standard request logs at our hosting provider, kept on their retention schedule.

3. Where the data comes from

From the person themselves (a form they submit, a message they send), from workspace staff (notes, manual entry, CSV imports of the business's existing contacts), and from advertising and messaging platforms through connections a workspace owner authorises.

4. How it is used

• To run the CRM: show enquiries to the business that received them, let staff follow up, and keep the history.
• To send the messages that staff write or that the business's own workflow rules trigger, such as an acknowledgement when an enquiry arrives.
• To report to the business on its own enquiries: response times, conversion, and cost per lead when advertising data is connected.
• To keep the service secure, prevent abuse, and meet legal obligations.

We do not sell personal data, build advertising profiles, or use the content of enquiries or messages to train machine learning models.

5. Google user data

Three features connect to a Google account, each with its own permission request. This section says, for each, exactly what Google user data the CRM accesses, what it does with it, how it is protected, and how to take the access away.

5.1 Google Calendar: what is accessed

A workspace member who takes bookings can connect their own Google Calendar from Calendar, then Connections. The CRM asks for three things and nothing more:

5.2 Google Calendar: how it is used

• Busy times are used at the moment a booking page is drawn, to hide slots the member already has taken. They are not stored: each request is answered from a fresh free/busy lookup and discarded.
• Events are written so that a booking made in the CRM appears on the member's calendar, and disappears from it when cancelled.
• The account email is shown to the member and used for nothing else.

That is the whole use. Google Calendar data is not used for advertising, profiling, analytics, or to train machine learning models; it is not sold; and it is not shared with anyone outside the service providers that host the CRM (section 7). Bookings themselves are CRM records the workspace already holds; the calendar connection adds nothing to what other members can see.

5.3 Google Calendar: how it is protected

• The CRM stores a refresh token and a short-lived access token for the connected account. Both are encrypted at rest with AES-256-GCM using a key held in the hosting platform's configuration, not in the database. A copy of the database alone cannot read them.
• The columns holding those tokens are never readable through the browser or by any workspace member. They are read only by the server, only to make the calendar calls described above. Every row is isolated by workspace with row-level security.
• All traffic between the browser, the CRM, and Google is encrypted in transit (TLS).
• The database runs in Singapore (Supabase, AWS ap-southeast-1). Administrative access is limited to DayThree Studio's operator accounts, which use two-step verification.
• No person at DayThree Studio reads calendar data in the normal running of the service. Access to production systems is logged.

5.4 Google Calendar: keeping it, and taking it away

• Tokens are kept only while the connection exists. Disconnect, on Calendar then Connections, deletes them at once and the CRM stops reading busy times and writing events.
• Access can also be revoked from the Google account permissions page, after which the stored token no longer works and is removed the next time the CRM tries to use it.
• The id of an event the CRM created stays with its booking for the life of that booking, so the event can still be updated or removed. Deleting the booking, or the workspace, deletes the id.
• Events the CRM wrote to the calendar are the member's own and stay on the calendar unless the booking is cancelled or the member deletes them.
• To have everything the CRM holds from a Google account deleted, write to privacy@daythree-studio.com; it is done within 30 days, as section 10 describes.

5.5 Google Ads

Separately, a workspace owner or admin can connect Google Ads, either by signing in with the Google account they use for Google Ads, or by having DayThree Studio connect it through DayThree Studio's own manager account once they have accepted its link request. Either connection asks for the Google Ads permission (https://www.googleapis.com/auth/adwords), and openid and email to show which account is connected. The CRM uses it to list the advertising accounts the signed-in account can open, so the owner or admin can choose which feed the workspace, and to read campaign-level performance figures for the chosen accounts only: spend, impressions, clicks and conversions per campaign per day, and, for a lead who arrived with a Google click identifier, which campaign and keyword the click came from. It does not create, change, or pause campaigns, and it reads no audience or individual-level advertising data. The token is stored and protected in the same way as the calendar token, and Disconnect under Settings, then Integrations deletes it.

5.6 Gmail: sending only

A workspace owner or admin can connect the business's Gmail account from Settings, then Integrations, then Email, so that email to the business's own leads comes from its own address. That connection asks for gmail.send (send email on your behalf), and openid and email to show which account is connected. Nothing else.

• The CRM uses it only to send the emails the workspace's staff write or its own workflow rules trigger, to that workspace's own leads. Each email goes to the lead it is addressed to, and a copy sits in the account's Sent folder as with any email sent from Gmail.
• The CRM cannot read the mailbox: it does not see, list, or search received or sent mail, drafts, labels, or contacts. Replies arrive in the Gmail inbox as normal and stay there.
• The CRM keeps a record of the emails it sent (recipient, subject, and text) on the lead's timeline, as it does for every message it sends. That record is the workspace's own CRM data, not data read from Gmail.
• How the Gmail tokens are protected: the refresh token and the short-lived access token are encrypted at rest with AES-256-GCM, using a key held in the hosting platform's configuration rather than in the database, and sealed to the one workspace that connected them. They are never readable through the browser or by any workspace member; only the server reads them, only to send the emails described above. All traffic is encrypted in transit (TLS), the database runs in Singapore, and operator accounts use two-step verification, as in 5.3.
• Keeping it, and taking it away: the tokens are kept only while the connection exists. Disconnect on the Email card deletes them at once and withdraws the grant at Google; the access can also be revoked from the Google account permissions page.

A workspace can instead connect Microsoft Outlook, which asks Microsoft for the same single right (Mail.Send) and is used and protected in the same way, or any other mailbox with an app password, which is sealed in the same way and used only to send.

5.7 Limited Use

DayThree CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google user data is used only to provide the features described in this section, is never sold, is never used for advertising, and is never used to train machine learning models. Humans do not read it except with the user's consent, for security, or where the law requires.

6. Messaging channels

When a business connects a WhatsApp number to its workspace, messages to and from that number are stored in the CRM so the business can read and reply to them from one place. Where the number is connected through Meta's WhatsApp Business Platform, the CRM also receives the account and phone number details the business chose to share, its approved message templates, and delivery statuses. Where a business connects a Facebook Page or ad account, the CRM receives the lead form submissions and ad performance figures for the assets it shared. Messages sent to a business's Facebook Page or Instagram account through Meta's messaging platform are stored the same way, so the business can read and reply to them from the CRM. Data received from Meta is used only to provide these features to the business it belongs to. It is never sold, never used for advertising by DayThree Studio, and is deleted when the business disconnects or asks. Telegram is used only to notify a business's own staff group about new enquiries. Each business is responsible for having a lawful basis to message the people it messages, including Singapore's Do Not Call rules and the Spam Control Act.

7. Who else handles the data

The CRM runs on a small number of service providers, each bound by their own terms and security commitments:

Beyond these, data is shared only with the workspace it belongs to, or when the law requires it. Workspaces are isolated from each other in the database.

8. How long it is kept

• Workspace data is kept while the workspace is active. Contacts a business archives stay restorable until the business deletes them.
• Hashed IP addresses on form endpoints: up to six hours.
• Connected-account tokens, including Google tokens: until disconnected, then deleted at once.
• After a workspace closes or a deletion request is confirmed: deleted within 30 days. Copies in provider backups expire on the provider's schedule, at most 30 days after that.

9. Security

All traffic is encrypted in transit. Each workspace's rows are isolated by row-level security in the database, so one business can never read another's. Connected-account tokens are encrypted at rest with a key that is not stored in the database. Accounts that DayThree Studio controls use two-step verification. No system is perfectly secure; if we learn of a breach affecting you, we will tell you and the relevant authorities as the PDPA requires.

10. Your rights

You can ask for a copy of the personal data held about you, ask for it to be corrected, ask for it to be deleted, and withdraw consent you gave earlier. Write to privacy@daythree-studio.com. We respond within 30 days. If the request concerns a client business's workspace, we will coordinate with that business, which may need to make the final decision. Deletion steps are set out on the data deletion page.

11. Cookies

The CRM sets only the cookies needed to keep a signed-in user signed in. There are no advertising or analytics cookies, and the hosted forms that businesses embed on their websites set none at all.

12. Other points

• The CRM is a business tool and is not intended for use by anyone under 18.
• Data is primarily stored in Singapore. Email delivery and the connected platforms may process data elsewhere, as noted above.
• We may update this policy. The effective date at the top changes when we do, and material changes are notified to workspace owners by email.

13. Contact

DayThree Studio, Singapore. privacy@daythree-studio.com for anything in this policy. The person responsible for data protection can be reached at the same address.