Privacy Policy

Mizu CRM, Inc. ("Mizu CRM", "we", "us", or "our") operates the Mizu CRM platform and related services. This Privacy Policy explains how we collect, use, share, and protect personal data when you use our services, visit our website, or interact with us. If you are a customer using Mizu CRM to manage your own contacts and data, you are the data controller for that data and Mizu CRM is your data processor. Our Data Processing Agreement (DPA) governs that relationship. This policy covers our own use of personal data for example, when you create an account, contact us, or visit our website.

We collect the following categories of personal data: Account data: name, email address, company name, job title, and billing information when you register for or use Mizu CRM. Authentication is provided by Supabase Auth (not a third-party consumer identity product embedded in the browser beyond our hosted auth flows). Usage data: information about how you interact with our platform, including pages visited, features used, and actions taken. This helps us improve the product. Device and technical data: IP address, browser type, operating system, and device identifiers collected automatically when you use our services. Communications: content of emails, support tickets, or other communications you send us. Marketing preferences: whether you have opted in or out of marketing communications. We do not collect sensitive personal data (such as health, financial account, or government ID data) as part of our standard service.

We use your personal data to: - Provide, operate, and improve our services - Process payments and manage your account - Send transactional emails (account notifications, invoices, security alerts) - Send marketing communications where you have given consent - Respond to support requests and inquiries - Monitor for security threats and prevent fraud - Comply with legal obligations - Analyze usage patterns to improve product features We do not sell your personal data to third parties. We do not use your data to train AI or machine learning models.

We share personal data only in the following circumstances: Service providers: we share data with trusted third-party subprocessors who help us deliver our service (hosting, payments, email delivery, monitoring). All subprocessors are bound by Data Processing Agreements. See our full subprocessor list in the Trust Center. Legal requirements: we may disclose data when required by law, court order, or regulatory authority. Business transfers: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity. We will notify you in advance. With your consent: we will share data for any other purpose only with your explicit consent. We never sell personal data. We never share personal data with advertising networks.

We retain personal data for as long as your account is active, plus a 90-day grace period after account deletion. After 90 days, all personal data is permanently deleted from our systems and backups. Some data is retained longer where required by law for example, financial records are kept for 7 years. Audit logs are retained for 12 months. Marketing consent records are retained for 3 years from withdrawal. You can request deletion of your data at any time by emailing privacy@mizucrm.com.

Depending on your location, you have rights including: - Access: request a copy of the personal data we hold about you - Correction: request correction of inaccurate data - Deletion: request deletion of your data - Portability: receive your data in a machine-readable format - Objection: object to processing based on legitimate interests - Restriction: request that we limit how we process your data - Withdraw consent: withdraw marketing consent at any time To exercise any of these rights, email privacy@mizucrm.com. We respond within 30 days. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.

We use cookies and similar tracking technologies to operate our website and services. Essential cookies: required for authentication, security, and core functionality. These cannot be disabled. Analytics cookies: help us understand how visitors use our website. We use privacy-friendly analytics that do not track individuals across sites. Marketing cookies: used only where you have given explicit consent. You can withdraw consent at any time via our cookie settings. See our Cookie Policy for full details.

Mizu CRM is headquartered in the United States. If you are in the EU, EEA, or UK, your data may be transferred to and processed in the US or other countries when you choose a US data region or when required subprocessors operate globally. We use Standard Contractual Clauses (SCCs) approved by the European Commission, and UK International Data Transfer Addendum mechanisms where applicable, to ensure adequate protection for international transfers. Self-serve data residency (Enterprise and eligible plans): select your primary data region at organization creation or request a post-create region migration from Settings -> Data residency. Supported regions: • United States (us-east-1 (N. Virginia)) • European Union (Ireland) - GDPR (eu-west-1 (Ireland)) • United Kingdom (London) - UK GDPR (eu-west-2 (London)) • Asia Pacific (Singapore) (ap-southeast-1 (Singapore)) Standard (non-Enterprise) plans default to United States (us-east-1). UK organizations should select United Kingdom (eu-west-2); EU/EEA organizations should select European Union (eu-west-1). Contact privacy@mizucrm.com for migration assistance.

We implement technical and organizational measures including application-layer encryption for sensitive fields, TLS in transit, role-based access controls, multi-factor authentication, and org-scoped audit logging. SOC 2 Type II and ISO 27001 independent attestations are in progress - see our Trust Center (/trust) for implemented controls. Despite these measures, no system is completely secure. If you suspect a security issue, please email security@mizucrm.com immediately.

Mizu CRM is not directed at children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe we have done so, contact us at privacy@mizucrm.com.

We may update this policy from time to time. When we make material changes, we will notify you by email and display a notice on our website at least 30 days before the change takes effect. The date at the bottom of this page shows when this policy was last updated. Continued use of our services after the effective date constitutes acceptance of the updated policy.

For privacy questions, data subject requests, or complaints: Privacy team: privacy@mizucrm.com Data Protection Officer: dpo@mizucrm.com Mailing address: Mizu CRM, Inc., [Address], United States For EU/EEA users, our EU representative can be reached at eu-rep@mizucrm.com. We respond to all privacy inquiries within 72 hours.