Ironbull CRM Privacy Policy
Effective date: October 26, 2026
Last updated: October 26, 2026
Contents
- Who we are
- What this policy covers
- Customer Data: information businesses put in the Service
- What we collect and where it comes from
- How we use it
- Cookies
- Who we share it with
- How long we keep it
- How we protect it
- Where it's stored
- Your choices and rights
- Children
- If something goes wrong
- Changes to this policy
- How to reach us
1. Who we are
Ironbull CRM is operated by BP Tech LLC, a Michigan limited liability company in Howell, Michigan. In this policy, "BP Tech," "we," "us" and "our" mean BP Tech LLC.
Ironbull CRM (the "Service") is web software at https://crm.ironbullcrm.com, with Android apps for the office and for crews, and a website at https://ironbullcrm.com. It helps small trades businesses (lawn care, electrical, plumbing, low-voltage and similar) run customers, quotes, jobs, time, invoices, payments and simple books.
Words we use:
- Customer: a business with an account on the Service.
- User: a person who signs in to a Customer's account, such as the owner, office staff, a field tech or a time-clock worker.
- Client: a Customer's own customer.
2. What this policy covers
This policy explains what BP Tech does with personal information about Users and Customers: what we need to set up accounts, sign people in, bill Customers, support them and keep the Service safe. It also explains how we handle Customer Data on a Customer's behalf (Section 3).
"Personal information" means information that identifies a person or could reasonably be linked to them, such as a name, email address or IP address.
3. Customer Data: information businesses put in the Service
Most of what's in the Service is information a Customer enters about its own clients, employees and vendors. We call this Customer Data. It can include:
- Clients: names, emails, phone numbers, addresses, job-site addresses and map locations, notes, quotes, invoices, payments, and e-signatures (signature image, name, time, IP address and a fingerprint of the signed quote)
- Employees: pay rates or salary, W-4 withholding choices, new-hire forms (such as the W-4, I-9 and direct-deposit form), benefit and retirement amounts, hire dates, time-off requests, certifications, job applicants and résumés, onboarding documents, termination records, timesheets, breaks, clock photos, mileage and expense claims
- Location: if a worker allows it on their phone, the GPS location at the moment they clock in and clock out only, never in between
- Vendors: names, addresses, and for 1099 vendors the tax ID type and last 4 digits only (never the full number)
- Money records: bank and card account names with the last 4 digits only (direct-deposit details on new-hire forms are covered below), imported bank statement lines, expenses, bills and receipts
- Files and photos the Customer uploads
Social Security numbers and other sensitive numbers. If a Customer uses the Service's online new-hire forms (such as the W-4 and I-9), the employee enters their Social Security number on those forms, and may also enter bank account and ID numbers. These answers, and the completed forms, are encrypted (AES-256-GCM) before they are stored. Only admins of that business and the employee themselves can open them, screens show at most the last 4 digits, and every time a completed form is opened, it is recorded in the business's activity log. Outside these forms, the Service has no field for Social Security numbers. A Customer could still upload a document that contains one, so we ask Customers not to upload those unless they truly need to.
Customer Data belongs to the Customer. The Customer decides what goes in and how it's used. We handle it only to run the Service for that Customer, as its service provider, under our Terms of Service. If you are a client or employee of one of our Customers and have a question about your information, please contact that business. If you contact us instead, we will point you to them and help them as needed.
4. What we collect and where it comes from
You give it to us.
- Sign-in details. You can sign in with Google or with an email and password.
- Google sign-in: Google shares your name, email address and profile picture. We keep your name and email but don't store the picture. We never see your Google password, and we don't ask for access to your Gmail, Drive, calendar or contacts. We don't sell or share Google user data. Ironbull CRM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Email and password: your password is stored only as a one-way hash, never as readable text. If you turn on two-step verification, the secret that checks your codes is stored encrypted.
- Account and business details. Business name, address, logo, the owner's email, the Users you invite and their roles, your settings and your plan.
- Terms acceptance. Which version of our Terms and this policy each User accepted, and when.
- Messages to us. If you email us or ask for help, we keep the message and your contact details so we can answer.
- Early-access form. If you fill in the early-access form on our marketing site, we keep your name, company, email, phone, trade, company size, current software, the plan you're interested in, your message, IP address and browser type.
Stripe gives it to us (payments).
- Your subscription. Ironbull CRM subscriptions are paid by card through Stripe. A card is required to start the free trial. You enter it on Stripe's own page, and we never receive or store your full card number. The trial turns into a paid subscription automatically unless you cancel before it ends. Stripe tells us things like whether a payment went through and your subscription status.
- Your clients' payments. If your business turns on online payments, you connect your own Stripe account. Your clients pay your invoices on Stripe's page, and the money goes to your Stripe account. Stripe sends us the payment status and amount so we can mark the invoice paid. We don't receive card numbers.
It's recorded automatically.
- Sign-in records. Each sign-in attempt (email entered, IP address, time and result), so we can spot and block break-in attempts.
- Sessions. While you're signed in, we keep a session record with your IP address, browser type and when you were last active.
- Activity log. Each Customer account keeps a record of important actions (for example invoices, payments, user changes, password and two-step resets, time approvals and support access), with who did it, when, and from which IP address. Entries can't be edited or deleted.
- Server logs. Our server and Cloudflare record technical details such as IP address, pages requested, times and errors, to run, secure and fix the Service. Our server's logs are kept for 14 days, then deleted. Cloudflare keeps its own records under its own policies.
5. How we use it
We use personal information to:
- Run the Service: create accounts, sign people in, and do what you ask (for example create an invoice or send an email you start)
- Bill Customers: manage trials and subscriptions through Stripe
- Talk to you about the Service: account and security notices, billing messages, support replies, and changes to our terms or this policy
- Keep things safe: detect and stop fraud, abuse and break-in attempts
- Fix and improve the Service
- Follow the law and enforce our terms
We don't use Customer Data for advertising or for anything other than providing the Service to that Customer.
Product update and add-on emails. We may email Customers about product updates and add-ons. Every one of these emails has a simple unsubscribe link. Each Customer's choices are saved for its account, and the account can change them at any time in its account settings. Unsubscribing doesn't stop account, security and billing notices.
We don't sell personal information, and we don't share it for cross-context behavioral advertising.
6. Cookies
We use only the cookies needed to sign you in, keep you signed in and keep the Service secure. Cloudflare may set cookies it needs for security, and Google may set cookies while you sign in with Google.
We don't use analytics, advertising or tracking cookies or tools. If that ever changes, we will update this policy first and ask for consent where the law requires it.
7. Who we share it with
Service providers. These providers handle information for us only as needed to provide their service:
| Provider | What they do for us | What they receive |
|---|---|---|
| Cloudflare | The secure front door to the Service: encrypted (HTTPS) connections, a private tunnel to our server, and protection from attacks. Also file storage (Cloudflare R2) for uploaded files and photos | All traffic between your browser and the Service passes through Cloudflare. Files and photos uploaded to the Service, and documents the Service saves, are stored in Cloudflare R2. Completed new-hire forms are encrypted by us before they are stored there |
| Optional "Sign in with Google" | Your Google sign-in only (name, email, picture) | |
| Google Drive | Off-site storage for our encrypted backups | Encrypted backup files that can't be read without our key |
| Brevo | Sends the emails the Service sends, including quotes and invoices with their PDF attachments, payment and quote reminders, and sign-up and password emails | Recipient addresses, subject, message and attachments |
| Stripe | Subscription billing for Ironbull CRM; card payments for Customers who connect their own Stripe account | Billing email and subscription details; for client payments, the client's email, the invoice name and the amount |
| Tailscale | A private, encrypted network our administrators use to reach the server | Encrypted administrator connections. It does not store Service data |
| Development tools and contractors | Software development and server administration tools, including AI-assisted tools, that build, test, update and maintain the Service | Administrator access to the server and to encrypted backups, used only to operate, maintain, secure and fix the Service. Testing is done on copies with made-up data |
We will keep this list current, and update it here before a new provider starts receiving Customer Data.
Connections you choose. If you connect these, we send data to them on your instructions, under your own agreement with them:
| Service | What is sent |
|---|---|
| Gusto (payroll, needs the payroll add-on) | We read your Gusto employee and contractor names and IDs. We send approved hours per employee per day, and contractor payment amounts you choose to pay through Gusto |
| Xero (accounting) | Client names and contact details used on invoices, the invoices with tax, and payments |
| Your Stripe account | Payment requests for your invoices, as described in Section 4 |
A QuickBooks export is a file you download and import yourself. Nothing is sent to QuickBooks.
People in your own account. Other Users in your Customer account can see information according to their roles. Pay, payroll, HR, bank, finance, settings and the activity log are for admins only.
Ironbull support access. Each Customer's data is kept separate from every other Customer's, and the database itself enforces that separation. BP Tech staff can open a Customer's business in the Service only if an admin of that business turns on support access in Settings, for 24 hours, 7 days, 30 days, or until they turn it off. Every page support opens is recorded in that Customer's activity log.
To run the platform, our administrators can see a short list of details for every Customer (business name, owner email, sign-up date, number of Users, recent activity, and plan and billing status). They can also pause an account: sign-in is turned off and the data is kept.
Server administration. The people and tools that run our server have technical access to the systems where data is stored, including the database and backups. They use it only to operate, maintain, secure, back up and fix the Service, for example during an update or to investigate a problem.
When the law requires it. We may share information if we believe in good faith that the law, a subpoena or a court order requires it, or to protect the rights, property or safety of BP Tech, our Customers or others. Where the law allows, we will tell the affected Customer before handing over its Customer Data, so it can object.
If our business changes hands. If BP Tech is part of a merger, acquisition, financing or sale of assets, information may move as part of that deal. This policy, or one at least as protective, will still apply.
With your OK. We share information in other ways only if you ask us to or agree.
8. How long we keep it
| What | How long |
|---|---|
| Account information and Customer Data | While the account is active. If a free trial ends without a paid subscription, the business becomes read-only and its data is deleted 30 days after the trial ends. If a paid subscription is canceled, the business becomes read-only and its data is deleted 60 days after the cancellation takes effect |
| Viewing and exporting after a trial or subscription ends | Possible until the deletion date above, only if the account is paid up for all past months |
| Deletion on request | The account owner emails ppierce@ironbullcrm.com. We confirm the request, then delete the business's Customer Data and files from the live system within 30 days. We first make a final export as a safety copy, and delete that copy within 30 days unless the Customer asks us to keep it |
| Full export on request | We prepare it within 10 business days of the request, if the account is paid up for all past months |
| Backups | Encrypted, kept on our server and in off-site storage for 30 days, then deleted automatically. We always keep the most recent backup until a newer one replaces it |
| Encrypted copies of the server's settings file | These contain the server's passwords and encryption keys, not Customer Data. They are kept off-site with so we can restore the Service. We keep the 5 most recent copies and delete older ones |
| Sign-in attempt records | 90 days, then deleted automatically |
| Sessions | Sign-ins expire after 30 days; expired sessions are deleted daily |
| Server logs | 14 days, then deleted |
| Activity log | 1 year on our standard plan. Some plans may include a longer history, such as 2 or 5 years |
| Early-access form entries | 12 months, then deleted, unless you become a Customer |
| Things we must keep | Some records may be kept longer when the law requires it or for billing, disputes, fraud prevention or enforcing our terms. Billing and tax records (such as invoices we issue and payment records) are kept for 7 years |
Data that was deleted can stay in an encrypted backup until that backup expires on the schedule above.
9. How we protect it
We use reasonable administrative, technical and physical safeguards, including:
- Separation between Customers enforced by the database itself (row-level security), not only by the app
- Encrypted connections (HTTPS, modern TLS only) through Cloudflare, plus a private tunnel to our server. The server's app and database are not reachable directly from the internet
- Secure sign-in: Google sign-in or hashed passwords, optional two-step codes, and lockout after repeated failed attempts. Each business has one protected owner who other admins can't take over
- Extra encryption for especially sensitive items: new-hire form answers (such as Social Security, bank and ID numbers) and the completed forms (AES-256-GCM), two-step secrets, connection keys for Gusto and Xero, and supplier account numbers
- Support access you control, with a record of every page opened
- An activity log that can't be edited or deleted
- Encrypted backups, kept on our server and off-site. Backups are encrypted before they leave our server
- Testing: our own security tests, including tenant-separation and role tests, run on copies with made-up data
No system is perfectly secure, and we can't promise information will never be accessed without permission. You can help by keeping sign-in details safe, turning on two-step codes, and giving access only to people who need it.
10. Where it's stored
BP Tech is a U.S. company and the Service is built for U.S. businesses. The Service and its database are hosted on a server in Michigan that BP Tech operates. Uploaded files and photos are stored in Cloudflare R2 (some files saved before we moved file storage there may still be on the server's own disk). Encrypted backups are kept on our server and off-site with a cloud storage provider, currently Google Drive. If we move backups to a different cloud storage provider, we will choose one that stores them in the United States, and they will stay encrypted. Our providers may process information in other places under their own safeguards.
11. Your choices and rights
You can see and update much of your information yourself in the Service. You can also ask us to:
- Tell you what personal information we have about you, and give you a copy
- Correct information that's wrong
- Delete your information
- Explain how we use it
Some U.S. states give their residents specific privacy rights. Whether or not those laws apply to BP Tech, we'll honor reasonable requests like these from any User, after confirming it's really you and subject to legal exceptions. We won't treat you differently for asking. Email ppierce@ironbullcrm.com.
If you're a client or employee of one of our Customers, please send requests about Customer Data to that business (see Section 3).
Location stamps. Workers decide on their own phone whether the crew app adds a location stamp at clock-in and clock-out, and can change that at any time in the app.
12. Children
The Service is for businesses and isn't meant for anyone under 18. We don't knowingly collect personal information from children for our own purposes. If you think a child has given us personal information, contact us and we'll delete it.
A Customer's records might sometimes mention a minor (for example, a member of a client's household). That is Customer Data, and the Customer is responsible for it (see Section 3).
13. If something goes wrong
If we confirm a security breach that affects your personal information or Customer Data, we'll work to contain and fix it. We'll tell affected Customers by email within 72 hours of confirming it, and give any other notices the law requires. We'll also help Customers meet their own notice duties to their clients and employees.
14. Changes to this policy
We may update this policy. If we make an important change, we'll tell account owners by email or in the Service at least 30 days before it takes effect, and Users may be asked to accept the new version. The "Last updated" date at the top shows when it last changed.
15. How to reach us
Questions, requests or concerns? We're happy to help.
BP Tech LLC
1408 Fieldview Trail
Howell, MI 48843
Email: ppierce@ironbullcrm.com