Privacy Policy

Introduction

Soulful CRM ("we," "us," or "our") is operated by James Rodney Petty, doing business as Soulful CRM, based in Carson, CA, United States. We are committed to protecting your personal information and your right to privacy.

This Privacy Policy describes how we collect, use, store, and share information when you use our platform at soulfulcrm.com, including all features: client management, session tracking, AI-generated recaps, direct booking, practitioner-to-client email, automated email triggers, webhook integrations, SMS notifications, outbound event dispatching, and onboarding tools.

By using the Services, you agree to the collection and use of information in accordance with this policy.

1. Categories of Personal Information We Collect

We collect the following categories of personal information, as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

A. Identifiers

Name, email address, IP address, and account identifiers. Collected when you create an account, update your profile, or use the platform.

B. Account and Profile Information

Password (stored as a one-way secure hash and never readable by us), display name, practice modalities, tone preferences, and phrases you choose to exclude from AI outputs. We also record the date and time you accepted our Terms of Service.

C. Client and Session Data (Practitioner-Entered)

You may enter client profiles for your own clients, including their names, email addresses, phone numbers, pronouns, intake notes, and session histories. You may also enter raw session notes which are processed by our AI system to generate summaries and follow-up suggestions. This data is associated with your practitioner account and visible only to you.

D. Sensitive Personal Information — Health and Wellness Data

Session notes, intake notes, and client summaries entered by practitioners may contain health-adjacent or wellness-related information about their clients — for example, notes from Reiki sessions, energy work, or intuitive coaching. Under the CPRA, this type of information may qualify as sensitive personal information.

We process this information solely to provide the Service — specifically, to generate AI-powered session recaps and client summaries at the practitioner's explicit request. We do not use this information for advertising, profiling, or any purpose beyond the immediate service delivery. We do not sell or share this information with third parties for cross-context behavioral advertising. Practitioners retain full control over this data and may delete it at any time.

California residents have the right to limit our use of sensitive personal information to what is necessary to perform the requested Service. See Section 6 (Your CPRA/CCPA Privacy Rights) for instructions on how to exercise this right.

E. Booking System Data

If you enable your public booking page, we collect the name, email address, phone number (optional), requested appointment time, and any optional notes submitted by individuals who book sessions through your page. This information is stored within your practitioner account as a client record and session entry. Booking data is not used by Soulful CRM for any purpose beyond facilitating the booking and populating your CRM.

Individuals who submit a booking are not required to create a Soulful CRM account. Their data is retained as part of your client records and is subject to your own data practices as the practitioner. Individuals wishing to request deletion of their booking data should contact the practitioner directly. Practitioners may also delete client records from within their account at any time.

F. Client Email Data

Paid plan subscribers may send emails to their clients through Soulful CRM. When you use this feature, we store the email templates you create, the automated trigger configurations you set up, and a log of every email sent — including the recipient's email address, subject line, message body, send timestamp, delivery status, and any error messages. This data is associated with your account and the relevant client record.

Client email send logs are stored for up to 12 months and are visible to you within the client's email history tab. These logs are accessible only to you as the practitioner and to Soulful CRM administrators for operational and support purposes.

All client emails are sent through Resend, our third-party email delivery provider. The content of emails and recipient addresses are transmitted to Resend for delivery. Resend operates under its own privacy policy. Client email content is never used by Soulful CRM for advertising, AI training, or any purpose other than facilitating delivery and maintaining your send history.

G. Webhook Integration Data

Soulful CRM supports inbound webhook integrations that allow external services such as Zapier and Squarespace to submit client intake data directly to your account. When an inbound webhook request is received, the submitted data — including name, email address, phone number, notes, and source identifier — is stored as a client record and intake session note within your practitioner account. This data is processed identically to data you enter manually and is subject to the same retention and deletion policies.

Each practitioner may generate a unique webhook secret token to secure their inbound endpoint. This token is stored in encrypted form in our database and is used solely to authenticate incoming webhook requests to your account. You may revoke or regenerate this token at any time from your Settings page.

Soulful CRM also supports outbound webhooks, allowing you to configure a URL to which we will send event notifications when key actions occur in your account — such as a client being created, a session being logged, a booking being confirmed, or a billing event occurring. When outbound webhooks are enabled, data associated with these events — including client names, email addresses, session metadata, and subscription status — is transmitted to the URL you specify. You are solely responsible for the security and privacy compliance of any endpoint you configure to receive this data. Soulful CRM is not responsible for the handling of data by third-party services you connect via outbound webhooks.

H. SMS Notification Data

If a practitioner has enabled SMS notifications, Soulful CRM will send a booking confirmation SMS to clients who provide a phone number when booking a session through your public booking page. The client's phone number and the content of the SMS message are transmitted to Twilio, our SMS delivery provider, solely for the purpose of delivering the message. Twilio operates under its own privacy policy.

Phone numbers collected through the booking form are stored within your client records and are not used for any marketing or communications purpose beyond the booking confirmation SMS you have enabled. Practitioners who provide their own Twilio credentials are responsible for ensuring their use of Twilio complies with applicable telecommunications laws, including TCPA consent requirements.

I. Onboarding and Activity Events

We track certain in-app milestone actions to power your onboarding checklist, measure product activation, and send contextually relevant automated emails. Specifically, we record the following named funnel events in our database, linked to your user account, when they occur for the first time:

• signup_complete — recorded when your account is created
• terms_accepted — recorded when you accept the Terms of Service
• onboarding_wizard_complete — recorded when you finish the onboarding setup wizard
• checklist_viewed — recorded when you view the Quick Start checklist on your dashboard
• first_client_created — recorded when you add your first client
• first_session_logged — recorded when you log your first session
• first_ai_used — recorded the first time you generate an AI recap or client summary
• booking_page_enabled — recorded when you first enable your public booking page

Each of these events is recorded at most once per user account in our database. They are used to determine your position in the onboarding flow, display your progress in the Quick Start guide on your dashboard, and trigger relevant automated guidance emails described in Section 1(J).

These same eight milestone events are also transmitted to PostHog, our product analytics provider, server-side at the time they are recorded. PostHog receives your account identifier and the event name. This data is used solely to measure product activation rates and improve the onboarding experience. It is never used to build behavioral profiles for advertising and is never sold or shared with third parties for marketing purposes. See Section 3 for details on PostHog as a subprocessor.

In addition, we track general activity events on an ongoing basis — such as creating a client, logging a session, generating an AI recap, or upgrading your subscription — to fire the automated email trigger system and power the onboarding flow. These ongoing events are distinct from the first-occurrence milestone events described above and serve the same operational purpose: helping you get value from the product faster.

We also write a browser-local storage key (soulful_happypath_dismissed) to your device when you dismiss the Quick Start guide on your dashboard. This value is stored locally in your browser only, is never transmitted to our servers, and controls whether the Quick Start guide is shown on subsequent visits. It contains no personal information.

J. System Email Communications Data

Soulful CRM sends automated system emails through Resend. We track whether these emails are opened using a standard 1×1 pixel image embedded in emails. If you open an email, we record the timestamp. This data is used solely to understand whether our communications are useful and to improve the product. We do not share email engagement data with third parties for marketing purposes.

System email send logs — including the recipient address, subject line, send time, and delivery status — are stored in our database and accessible only to Soulful CRM administrators.

Based on the onboarding milestone events described in Section 1(I), we send the following behavioral trigger emails to registered users (practitioners) during the trial period:

• Welcome email — sent immediately upon account creation, with guidance on getting started
• First client nudge — sent approximately 24 hours after signup if no client has been created yet
• First session nudge — sent approximately 48 hours after a first client is added if no session has been logged yet
• AI recap nudge — sent approximately 24 hours after a first session is logged if the AI recap feature has not yet been used
• Re-engagement email — sent approximately 5 days after signup if the AI recap feature has not been used and you have not yet received this email
• Trial expiration notice — sent approximately 2 days before your 14-day trial expires if you have not yet upgraded, to remind you of pending access changes

Each behavioral trigger email is sent at most once per user. Deduplication is enforced server-side; you will not receive repeated nudges for the same step. All behavioral trigger emails include an unsubscribe link. You may opt out of non-essential automated emails at any time. Strictly transactional emails — including password reset and billing notifications — cannot be opted out of as they are necessary to operate your account.

K. Payment Information

All payments are processed by Stripe. We do not store your full credit card number, CVV, or billing address. We receive and store a Stripe customer ID and subscription status to manage your access level. Billing events — such as successful payments, subscription changes, and payment failures — are processed via Stripe webhooks and may be transmitted to any outbound webhook URL you have configured. For details on how Stripe handles your payment data, see stripe.com/privacy.

L. Usage and Technical Data

We collect standard technical data including IP address, browser type, device type, pages visited, and timestamps through our hosting provider Vercel. This data is used to maintain platform security, diagnose errors, and understand general usage patterns.

We also use PostHog, a product analytics provider, to collect client-side usage data including page views, navigation paths, and session recordings. PostHog session recordings capture your interactions with the dashboard — including mouse movements, clicks, and scrolling — to help us identify usability issues and improve the product. All form inputs are masked in session recordings; passwords, client notes, and other typed content are never captured. PostHog also collects your IP address and browser identifiers as part of standard analytics instrumentation.

When you are logged in, PostHog associates analytics data with your account identifier so that usage patterns can be linked to a specific user session. When you sign out, your PostHog identity is reset, and subsequent activity is not linked to your account until you sign in again. PostHog analytics data is used solely for product improvement and is never sold or shared with third parties for advertising.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Authenticate your account and protect against unauthorized access
• Process subscription payments and manage billing
• Generate AI-powered session recaps and client summaries using your notes
• Populate your client and session records when bookings are made through your public booking page
• Populate your client and session records when inbound webhook submissions are received from external services such as Zapier or Squarespace
• Facilitate the sending of emails from practitioners to their clients
• Store and display client email history within the relevant client profile
• Fire automated client email triggers based on events you configure
• Send SMS booking confirmation messages to clients when you have enabled SMS notifications
• Transmit event data to outbound webhook URLs you configure, including client events and billing events
• Send transactional and onboarding system emails based on your account activity
• Send behavioral trigger emails during your trial period based on your onboarding milestone progress, as described in Section 1(J)
• Power your Quick Start onboarding guide with your in-app milestone progress
• Monitor system email open rates to improve our communications
• Measure product activation rates and onboarding funnel performance using PostHog analytics
• Identify usability issues and improve the platform using PostHog session recordings and page view data
• Respond to support requests and inquiries
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your data to train AI models. Your client notes and session data are sent to AI providers solely for the purpose of generating the output you requested and are not retained by those providers for model training under our agreements with them.

AI-generated outputs are not used to make consequential decisions about you or your clients. All AI outputs — session recaps, client summaries, follow-up suggestions — are informational tools presented to you for review and use at your discretion. No automated decision with legal or significant effect is made on the basis of these outputs.

3. Third-Party Service Providers (Subprocessors)

We do not sell your personal information. We share limited data only with the following service providers, each acting as a data processor on our behalf:

All subprocessors are contractually required to process data only as directed by us and in accordance with applicable privacy law. We do not authorize any subprocessor to sell or use your data for their own purposes beyond service delivery.

Note on outbound webhooks: When you configure an outbound webhook URL, data is transmitted to a third-party endpoint of your choosing. Soulful CRM does not control or take responsibility for how data is handled by external services you connect via this feature. You are responsible for ensuring that any third-party service receiving your webhook data complies with applicable privacy law.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, to protect the rights and safety of our users or the public, or to enforce our Terms of Service.

4. Data Retention

We retain different categories of data for the following periods:

• Account and profile data: Retained for the life of your account. Deleted upon account deletion, with residual copies removed from encrypted backups within 90 days.
• Client records and session notes: Retained for the life of your account. Deleted upon account deletion or when you manually delete a client record.
• Booking records: Retained for the life of the associated client record.
• Webhook intake records: Data submitted via inbound webhook is stored as client and session records and follows the same retention policy as manually entered client data.
• Webhook secret tokens: Retained until revoked or account is deleted. Tokens may be regenerated at any time from Settings.
• Outbound webhook configuration: The outbound webhook URL you configure is retained until removed by you or until account deletion.
• Client email send logs: Retained for up to 12 months from the date of send, then automatically deleted.
• System email send logs: Retained for up to 12 months for delivery monitoring purposes, then deleted.
• Onboarding milestone event records: The named funnel milestone events described in Section 1(I) are retained for the life of your account and deleted upon account deletion. Because each event fires at most once, the complete set of these records for any user is small in size.
• PostHog analytics data: Page view events, funnel milestone events, and session recording data transmitted to PostHog are retained by PostHog in accordance with their data retention policy. Session recordings are retained for up to 3 months by default. To request deletion of your PostHog analytics data, contact us at hello@soulfulcrm.com and we will submit a deletion request on your behalf.
• Payment records: Stripe customer and subscription IDs retained for the life of the account for billing management. Cleared upon account deletion except where retention is required by law.
• Technical and usage data (server logs): Retained by Vercel per their data retention policy, typically 30–90 days.
• Browser local storage: The Quick Start guide dismissed state (soulful_happypath_dismissed) is stored only in your browser and is never transmitted to our servers. It persists until you clear your browser storage or use a different browser or device.
• Unsubscribe token: A unique unsubscribe token is generated for your account at signup and stored in our database for the life of your account. It is used solely to process one-click unsubscribe requests from system emails and is never shared with third parties.
• Email opt-out preference: If you unsubscribe from system emails, your opt-out preference is stored in our database and honored immediately on all subsequent sends. This preference is retained for the life of your account so that it is not lost if you later log back in.

Certain residual data may remain in encrypted backups for up to 90 days before being permanently deleted following an account deletion request.

5. Practitioner Role as Data Controller

When you use Soulful CRM to store and manage data about your own clients — including names, contact information, session notes, booking records, webhook intake submissions, SMS communications, and email communications — you act as the data controller for that client data, and Soulful CRM acts as the data processor on your behalf.

As the data controller, you are responsible for:

• Having a lawful basis to collect and store your clients' personal information
• Informing your clients that their data is being stored in a CRM system
• Obtaining appropriate consent before sending your clients emails or SMS messages through the platform
• Ensuring that any third-party services you connect via inbound or outbound webhooks handle client data in compliance with applicable privacy law
• Honoring your clients' requests to access, correct, or delete their data
• Complying with any privacy laws applicable to your practice and your clients' jurisdiction

Soulful CRM processes your clients' data only as instructed by you through your use of the Service. We do not use your clients' data for any independent purpose and do not share it with third parties except as described in Section 3 (subprocessors necessary to deliver the Service).

PostHog does not receive any client data. Analytics instrumentation is scoped to practitioner account activity only — page views, navigation, and the named milestone events listed in Section 1(I). Client names, contact details, session notes, and health-adjacent data are never transmitted to PostHog.

If one of your clients contacts us directly to request access to or deletion of their data, we will direct them to you as the responsible data controller.

6. Your CPRA / CCPA Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights with respect to your personal information:

Right to Know

You have the right to request that we disclose: the categories of personal information we have collected about you; the categories of sources from which we collected it; the business or commercial purpose for collecting it; the categories of third parties with whom we share it; and the specific pieces of personal information we have collected about you.

Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (e.g., where retention is required to complete a transaction, detect security incidents, or comply with a legal obligation). You may also delete your account directly from the Account Settings page within the dashboard. Account deletion is permanent and cannot be undone.

Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you. You may update most of your account information directly within the Account Settings page. For data you cannot update yourself, contact us at hello@soulfulcrm.com.

Right to Opt-Out of Sale or Sharing

We do not sell your personal information and we do not share your personal information with third parties for cross-context behavioral advertising. You therefore have no need to opt out of a sale or sharing of personal information, as neither activity occurs. If this practice ever changes, we will update this policy and provide a clear opt-out mechanism before any such activity begins.

Right to Limit Use of Sensitive Personal Information

You have the right to limit our use of sensitive personal information (as defined by the CPRA) to what is necessary to perform the Service you requested. As described in Section 1(D), session notes and health-adjacent data are used solely to generate AI recaps at your explicit request. If you do not want this data processed by AI, you may simply not use the AI recap or client summary features. If you wish to formally exercise a limit on sensitive PI use, contact us at hello@soulfulcrm.com.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CPRA/CCPA rights. We will not deny you goods or services, charge you different prices, or provide you with a lesser quality of service because you exercised a privacy right.

Right to Data Portability

You have the right to receive a copy of your personal information in a portable, usable format. To request a data export, contact us at hello@soulfulcrm.com.

How to Submit a Request

To exercise any of your CPRA/CCPA rights, submit a verifiable consumer request to:

We will respond to a verifiable consumer request within 45 days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing. We may need to verify your identity before processing your request by confirming your account email address.

You may designate an authorized agent to make a request on your behalf. We may require written proof of authorization before honoring such a request.

For Clients of Practitioners

If you are a client of a practitioner using Soulful CRM — for example, someone who booked an appointment, received an email or SMS through the platform, or had your information submitted via a third-party form integration — and you wish to request access to or deletion of your data, please contact the practitioner directly. As described in Section 5, practitioners control their own client records. If you are unable to reach the practitioner and need assistance, contact us at hello@soulfulcrm.com and we will do our best to assist.

7. Email Communications and Opt-Out

By creating an account, you consent to receiving transactional and onboarding system emails from Soulful CRM. These may include welcome messages, feature guidance, inactivity reminders, trial expiration notices, and behavioral trigger emails sent based on your onboarding milestone progress as described in Section 1(J).

You may opt out of non-essential automated system emails at any time by clicking the unsubscribe link included at the bottom of every system email. Unsubscribing is immediate and requires no account login. You cannot opt out of strictly transactional emails such as password reset emails or billing notifications, as these are necessary to operate your account. To re-enable system emails after unsubscribing, contact us at hello@soulfulcrm.com.

If you receive an email sent through Soulful CRM by a practitioner, that email was sent by the practitioner using our platform. To opt out of emails from a specific practitioner, contact them directly using the reply-to address on the email.

We use email open tracking (a standard 1×1 pixel image) on system emails to measure whether our communications are being received and read. Open tracking is not applied to practitioner-to-client emails. If you prefer not to be tracked on system emails, you can disable image loading in your email client.

8. SMS Communications

If a practitioner has enabled SMS notifications, Soulful CRM will send an automated booking confirmation SMS to clients who provide a phone number when booking a session. SMS messages are sent via Twilio and contain booking confirmation details only. By providing a phone number on a practitioner's booking page, you consent to receiving this single transactional SMS confirmation.

Soulful CRM does not send marketing SMS messages. Phone numbers are not shared with third parties for marketing purposes. If you have questions about SMS communications from a specific practitioner, contact them directly.

Practitioners who enable SMS are responsible for ensuring their use of this feature complies with the Telephone Consumer Protection Act (TCPA) and any other applicable telecommunications regulations in their jurisdiction.

9. Cookies and Tracking

Soulful CRM uses session cookies and JWT tokens to authenticate your account and maintain your login state. We do not use third-party advertising cookies or tracking pixels for advertising purposes. We do not display ads and do not share your data with advertising networks.

Our hosting provider Vercel may set analytics cookies to measure platform performance. These are limited to technical performance data and do not identify you personally.

We use PostHog for product analytics. PostHog sets cookies in your browser to associate page views and navigation events with a session and, when you are logged in, with your account identifier. PostHog cookies do not track you across unrelated websites and are used solely to improve the Soulful CRM product. PostHog also performs session recordings of logged-in dashboard activity. All form inputs — including passwords, client names, and session notes — are masked and are never captured in recordings. You can learn more about PostHog's data practices at posthog.com/privacy.

10. Security

We implement reasonable technical and organizational measures to protect your data, including TLS encryption in transit, hashed password storage, JWT-based authentication, row-level security on database tables, and role-based access controls. Webhook secrets are stored securely and are unique per user. However, no system is completely secure. We cannot guarantee absolute security of information transmitted over the internet or to third-party webhook endpoints you configure.

If you believe your account has been compromised, please contact us immediately at hello@soulfulcrm.com.

11. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete that information promptly.

12. International Users

The Services are hosted and operated in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Services, you acknowledge and consent to this transfer. We take steps to ensure data is handled securely and in accordance with this Privacy Policy regardless of where it is processed.

13. Do Not Sell or Share My Personal Information

Soulful CRM does not sell your personal information. Soulful CRM does not share your personal information with third parties for cross-context behavioral advertising. This applies to all categories of personal information described in this policy, including sensitive personal information.

We share personal information only with service providers (subprocessors) acting on our behalf to deliver the Service, as described in Section 3. These sharing relationships do not constitute a "sale" or "sharing" under the CCPA/CPRA.

If this practice ever changes in the future, we will update this Privacy Policy, notify you in advance, and provide a clear and accessible mechanism to opt out before any such activity begins.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email. Continued use of the Services after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data — including CPRA/CCPA requests — contact us at: