TrickTic-CRM Privacy Policy
Effective: November 1, 2026
Effective 2026-11-01. Provider: TrickTic, operated by Daniel Shedrinsky. Questions or requests: support@tricktic.com.
This policy covers TrickTic-CRM at crm.tricktic.com, a workspace for the leads and conversations that businesses receive from their landing pages, Instagram, WhatsApp, phone calls and booking page. Access is by invitation.
Some parts of CRM are switched on by TrickTic for each business separately: the assistant, the voice assistant, contracts and quotes, payment records and the booking page. A part that is off for your business collects nothing for it.
Who is responsible
Your business decides which leads to collect and what to do with them. TrickTic runs TrickTic-CRM for you and processes lead data to provide the service.
Your landing page needs its own privacy notice for visitors. It should say that form submissions go to your business and its service providers.
If you connect an Instagram or WhatsApp account, the people who write to that account are your customers. Their messages reach CRM because you connected the account, and TrickTic handles them only to show them to you and to send the replies you write. Your own privacy notice should say that messages sent to your business are handled by your service providers.
The same applies to the people who call your business when the voice assistant answers, who sign a contract or answer a quote you send, and who book on your booking page: they are your customers, and TrickTic handles their details for your business. If you use the assistant, the voice assistant or the decision model, your privacy notice should also say that messages and calls may be answered by an automated assistant, and messages sorted by AI, using AI service providers.
TrickTic does not sell the data in CRM, does not use it for advertising and does not use it for any purpose other than providing the service to your business.
What CRM stores
| Data | Where it comes from |
|---|---|
| Lead details: name, phone, email, message, requested service, preferred time | Your connected forms and integrations, manual entry or a CSV file you import |
| Source of each submission: site, page, form, time submitted, campaign (UTM) fields if your page sends them | The sending site or the channel used |
| Instagram and WhatsApp conversations, if you connect an account: the text of the messages your customers send and of the messages you send, reactions, the time of each message and whether it was sent, delivered and read | Meta, for the account you connected, and you |
| The sender's details as Meta supplies them: profile name, Instagram username, WhatsApp phone number, the identifiers Meta gives the person and each message, and the ad, post or story a message answers | Meta |
| Pictures, voice messages, video and files that your customers send you or that you send, up to a size limit | Meta and you |
| Earlier WhatsApp chats: when you connect a WhatsApp Business app number and confirm it in WhatsApp, the chats of about the last six months on that number | Meta, after your confirmation in WhatsApp |
| Your Instagram or WhatsApp connection: the account's name and identifier, and the access key Meta issues, stored encrypted | Meta, when you connect |
| Your calendar connection, if you set one up: a private subscription link, or the access key Google issues for one calendar that CRM creates, stored encrypted | You and Google |
| The assistant, if it is on: the knowledge card you write about your business (services, prices, hours, area, frequent questions, tone and your hand-over text), suggested replies, the replies the assistant sends, marked as the assistant's, and a record of each use: when, what for, the outcome and its size, without the text | You and CRM |
| Calls answered by the voice assistant, if it is on: the caller's number, the time and length of the call, the details the assistant collected, a summary and a transcript of the call. CRM does not store the call's audio | The voice-agent provider |
| Contracts and quotes you send: the text, the items and prices, your business details on them, the customer's email address, when the link was opened, and whether it was signed, approved or withdrawn | You |
| The signing record: the name the customer typed, their drawn or typed signature on a contract or their approval or refusal of a quote with any note they add, the wording they agreed to, the time, their IP address and browser, a fingerprint of the text they saw, their ID number if your contract template asks for it (stored encrypted), and a PDF of the signed contract or answered quote, stored encrypted | Your customer, on the signing page |
| Payment records: the amount you agreed with a client, each deposit or payment you record with its date, method and note, and the payment details you save for payment requests (for example a Bit or PayBox number or your bank account) | You |
| Bookings on your booking page: the service, the time, the customer's name and phone, and their email and note if they give them | Your customer, on your booking page |
| Your business details for documents: logo, legal and trade name, business type and number, address and contact details | You or TrickTic, when setting up your business |
| Your work on leads: stages, notes, follow-ups, contact confirmations, outcomes and amounts you declare | You |
| Your login: the email address and account identifier Google returns | Google sign-in |
| History and audit records of changes, exports and deletions | CRM |
CRM records the amounts and payments you enter. It does not take payments, create payment links, store card details or issue invoices or receipts, and a payment record or quote is not a tax document.
CRM sends a message to a customer only in these cases: when you write it and press send, one message to one person; when you press send on a contract or quote, one email to one person, and after they answer it, a copy of the signed contract or answered quote to them; when the assistant is on for that channel, as described below; and the confirmation and change emails of a booking, sent to the customer who booked if they gave an email address. It does not send in bulk or on a schedule, and it does not send paid template messages.
The assistant is an AI feature that TrickTic switches on for a business. It can suggest a reply that you edit and send yourself. If TrickTic also switches on its replies for an Instagram or WhatsApp account, it answers a customer who writes to you, only while the channel's free reply time is open, and passes the conversation to you when it cannot answer. It answers only from your knowledge card and the current conversation. It does not see files, notes, payments, contracts, other clients or other businesses, and it does not write first, book, change records or send anything other than its reply. It stops in a conversation you answer yourself, pause or mark as personal.
If TrickTic switches it on for your business, a decision model, a kind of AI that chooses among fixed answers and writes no text, sorts some of what reaches CRM: whether a customer's message is a complaint, a change or cancellation, a request to stop, or needs no reply; whether it tries to misuse the assistant; whether the assistant's reply promises something its knowledge does not say; whether a comment or a message matches one of your rules or flows; whether an inquiry looks like spam or a test; whether a review is negative or needs a reply soon; whether a recommendation contains contact details or insults; which field a column of a file you import belongs to; whether an Instagram or WhatsApp conversation, for example one brought in with your chat history, looks personal (a friend, family or a supplier) rather than a customer's; and, from a customer's own message, which of your saved services it asks about, whether the customer asked to be contacted later, and whether the customer says they paid and how. With that answer CRM passes the conversation to you, pauses the assistant for that person and tells you, keeps the assistant's reply as a draft for you, sends the reply or starts the flow you set up, or shows you a suggestion. A suggested service, follow-up date or payment only fills in the form you then save yourself; CRM works out the date and the amount itself. It does not mark, hide, approve, delete or reorder anything by itself.
CRM does not use AI to score your leads. The order of the Today list is a fixed rule.
A connected Instagram or WhatsApp account brings every chat on it into CRM, including private chats with friends, family or suppliers. You can mark a conversation as personal. CRM then deletes its stored messages and files and stops keeping later messages from that person, until you undo it. If TrickTic switches it on, CRM suggests which conversations look personal; only your press marks one.
Who else processes data
| Service | Role | What it receives |
|---|---|---|
| A hosting provider | Hosts the CRM server and database | All CRM data, on a server dedicated to CRM |
| A network provider | Network protection and HTTPS for crm.tricktic.com | Traffic to CRM, including submitted forms, signatures and bookings in transit |
| Sign-in, with the openid and email permissions. If you connect Google Calendar: one calendar that CRM creates in your Google account for your follow-ups and bookings. If you also allow it for your booking page: whether times in your main calendar are busy | Your sign-in. If you connect Google Calendar: for each follow-up, the kind of step and the client's name, the date or time and the meeting place. CRM gets no access to your Gmail, Drive, contacts or other calendars, and for the busy check it sees only busy or free, not your events | |
| Meta (Instagram and WhatsApp) | Carries messages between your customers and the Instagram or WhatsApp account you connected | The messages and files you send from CRM and the assistant's replies. Meta delivers your customers' messages to CRM and handles them under its own terms with you and with your customers |
| An AI model provider, chosen by TrickTic | Writes the assistant's suggested replies and replies | For each reply: fixed instructions, your business's name and knowledge card, and the recent messages of that one conversation, with phone numbers, email addresses and ID-like numbers masked. Not names or other details from your records, files, other conversations or identifiers. The provider keeps requests under its own terms, and TrickTic has turned off their use for training its models |
| A decision-model provider, chosen by TrickTic | Sorts messages, comments, inquiries, reviews, recommendations, import columns and personal-looking conversations, and suggests a service, a follow-up date or a payment from a customer's message, as described above, for a business where TrickTic switched it on; and labels the problem reports you send TrickTic. It writes no text | For each question: your business's name and type and one of these: the recent messages of one conversation, with phone numbers, email addresses and ID-like numbers masked; the assistant's reply with the knowledge it was given; a comment, or a message that answers one of your rules or flows, shortened; an inquiry's name, message and questionnaire answers, without its phone or email; a review's or recommendation's words and stars; one column heading of a file you import, without its cells; to suggest whether a conversation looks personal, only its newest messages from both sides, with names, phone numbers, email addresses and ID-like numbers masked; one customer message, with phone numbers, email addresses and ID-like numbers masked, and for a service question the names of your saved services; or the text of a problem report you send TrickTic, or a customer's question that the assistant handed to you, with phone numbers, email addresses and identifying numbers removed. CRM keeps only the labels. The provider keeps requests under its own terms and does not use them to train its models |
| A voice-agent provider, chosen by TrickTic | Answers the calls your business forwards to it, with a voice assistant that uses speech and AI models, and sends CRM the result | The calls: the caller's number and voice, and what is said. It records and transcribes each call and sends CRM the number, the transcript, a summary and the details collected. TrickTic sets it to keep recordings and transcripts for no more than 30 days |
| A file storage provider | Stores the pictures, voice messages, video and files of your conversations, and the PDFs of signed contracts and answered quotes | Those files, encrypted by CRM before they are stored. They are never public and are shown only to you, signed in to CRM |
| An email delivery provider | Sends your new-lead and follow-up emails, the contracts and quotes you send, their PDFs once answered, and booking emails | Your email address and the notice. So that you can act from the email, a notice includes the lead's name, phone, email, source and message. For contracts, quotes and bookings: the customer's email address, the link and, once answered, the PDF, sent to the customer and to you. Open and click tracking are off |
| The calendar app you add CRM's private subscription link to | Shows your open follow-ups in your own calendar | For each follow-up, the kind of step and the client's name, the date or time and the meeting place. Anyone who has the link can read these, so keep it private. You can replace it or turn it off |
| Encrypted backups on a separate TrickTic-operated server | Recovery | Database copies, encrypted before they leave the CRM server |
| Integration services used to deliver submissions | Pass form submissions from your landing page to CRM | The form submission |
| AI tools from external providers | Used by TrickTic when operating, maintaining, securing or supporting the service | Lead data only where needed for those purposes, under the provider's confidentiality terms |
To sort the problem reports you send us, and to group the same problem reported by several businesses, we send the text of a report, with phone numbers, email addresses and identifying numbers removed, to a decision-model provider, which returns labels only. To show a business which questions its assistant could not answer, we send a customer's question that the assistant handed to the business, with the same details removed, and keep only its topic.
Providers may change as the service develops, and they may process data outside your country. A current list is available from support.
Server logs keep request status and timing only, not form contents.
Access to your data
Authorized TrickTic personnel and service providers may access lead data where necessary to operate, maintain, secure or support the service. Access is limited to what is needed for those purposes and is subject to confidentiality obligations.
How long data is kept
| Data | Kept |
|---|---|
| Leads and your work on them | Until you delete them or your account is deleted |
| Instagram and WhatsApp messages and their files | With the lead they belong to: until you delete that lead, mark the conversation as personal, or your account is deleted |
| A message its sender withdraws | Its stored text and file are deleted when Meta reports the withdrawal |
| A conversation you mark as personal | Its stored messages and files are deleted immediately, and later messages from that person are not kept |
| When you disconnect an account, or remove CRM's access at Instagram or WhatsApp | CRM stops receiving for that account immediately and deletes its access key. When Meta sends its data deletion request for the account, CRM deletes the stored message text, the senders' identifiers and the connection's details. Leads you already have stay until you delete them |
| The assistant's suggested replies | Deleted when you use them, or after 24 hours. A reply the assistant sends is kept as a message of that conversation |
| The knowledge card, the record of each use of the assistant, and the decision model's answers | The card until you change it or your account is deleted; the records of use and the answers with the lead they concern. The text sent to the AI model provider or the decision-model provider is not kept in CRM |
| Calls answered by the voice assistant | In CRM: with the lead they belong to. At the voice-agent provider: recordings and transcripts for no more than 30 days |
| Contracts, quotes, signing records and their PDFs | With the lead they belong to. A signing or approval link works for 30 days, or until the end of the quote's validity, unless you withdraw it earlier |
| Payment records and bookings | With the lead they belong to. Your payment details until you change them or your account is deleted |
| After you delete a lead or your account | Removed from the live database immediately, together with the stored files and PDFs |
| Encrypted backups | All copies for 48 hours, one a day for 14 days, one a week for 8 weeks. A deleted lead can stay inside older backups for up to about 8 weeks |
| Restoring from a backup | Deletions are applied again before anyone gets access, so deleted data does not come back |
| Deletion record | A record that a deletion happened is kept indefinitely, without names, phones or messages, so a restore or a repeated old submission cannot bring the lead back |
| Your account after access ends | You may request an export through support for 30 days, unless you request earlier deletion. After 30 days the account is deleted |
Deleting data from CRM does not delete copies held in other systems, downloaded exports or previously delivered emails, including contracts, quotes and their PDFs already emailed to you or your customer. It does not delete the messages in Instagram, in WhatsApp or on your customers' phones, or follow-ups already written to your calendar. When you delete a lead, CRM asks the voice-agent provider to delete that lead's calls where the provider allows it; otherwise they are removed within its 30 days. Copies in systems you control must be deleted separately.
Exports and deletion
In the app's privacy screen you can:
- download all your data (JSON), including conversations and their files, the assistant's replies and knowledge card, calls, contracts, quotes and their PDFs, payment records and bookings, and your lead list (CSV),
- delete one lead (including leads merged into it, their conversations, files, calls, contracts, quotes and their PDFs, payment records and bookings),
- delete your whole account.
Each deletion asks you to type a confirmation. If a lead asks you to see or delete their details, you can do it in the app, or ask support to help.
If you contacted a business that uses CRM
If you filled in a form, sent an Instagram or WhatsApp message, called, signed a contract, answered a quote or booked a time with a business that uses TrickTic-CRM, that business decides what is done with your details. To see them or have them deleted, ask the business. You can also write to support@tricktic.com and name the business: we pass your request to it and help it carry the request out.
When a business's voice assistant answers your call, it says at the start that it is a digital assistant and that the call is recorded and transcribed. When you sign a contract online, the business keeps the signing record described above as evidence of who signed and what.
Security incidents
We will notify you without undue delay after becoming aware of a security incident affecting your personal data, and no later than 72 hours after becoming aware. We will share the information available and provide further updates as our investigation progresses. Where applicable law requires earlier notification or reporting, we will comply with that requirement.
Contact
Questions or requests: support@tricktic.com