Privacy Policy

The Service is provided by Black Eagle FS — Apopka, FL, United States. Contact: support@blackeaglefs.com.

When we process personal data relating to our own relationship with you — for example, registration, billing, support and account administration data — Black Eagle FS may act as the Controller of that data.

When we process personal data entered by the Customer into the CRM in order to provide the Service, we normally act as Processor, while the Customer remains responsible, as Controller where applicable, for decisions about the purpose and means of that processing.

The terms "Controller", "Processor" and "Data Subject" are used as defined in the applicable data protection law.

The amount and type of data processed depend on how you use the Service.

2.1. Account and registration data

We may collect:

• name;
• company name;
• job title or professional role;
• e-mail address;
• phone number;
• information needed for authentication;
• billing information;
• account identifiers;
• account preferences and settings.

2.2. Data entered by the Customer into the CRM

The Customer and its Authorized Users may enter into the Service information related to their business activities, including:

• names;
• companies;
• addresses;
• phone numbers;
• e-mail addresses;
• leads;
• opportunities;
• customers;
• suppliers;
• contacts;
• relationship history;
• proposals;
• products;
• orders;
• documents;
• communications;
• notes;
• attachments;
• other information the Customer chooses to store in the Service.

This data is processed mainly to provide the Service to the Customer.

The Customer is responsible for deciding which personal data is entered into the Service and for ensuring that it has the legal basis and authorization needed for that processing.

2.3. Communications data

Depending on the integrations enabled by the Customer, the Service may receive or process messages and other communications addressed to the CRM.

This may include:

• sender;
• recipient;
• subject;
• message content;
• date and time;
• attachments;
• technical identifiers;
• metadata related to the communication.

The scope actually processed depends on the permissions granted by the Customer and on the integration used.

2.4. Google and Microsoft data

When a Google or Microsoft integration is connected, we may receive the information needed for authentication and for the integration to work, according to the permissions authorized.

This information may include:

• account identifiers;
• name;
• e-mail address;
• authentication tokens;
• information needed to perform the authorized functions.

Use of data from third-party services is limited to what is needed to provide the authorized features. The specific rules for Google data are in section 6.

2.5. Technical and usage data

We may automatically collect technical information such as:

• IP address;
• browser type;
• operating system;
• device;
• pages or features accessed;
• access times;
• technical events;
• error logs;
• security information;
• technical identifiers;
• information needed to diagnose problems and protect the Service.

This data may be used for the operation, security, maintenance and improvement of the platform.

2.6. Cookies and similar technologies

We may use cookies, local storage and similar technologies to:

• keep authenticated sessions;
• preserve preferences;
• protect accounts;
• detect suspicious activity;
• understand how the Service works;
• improve the user experience.

We do not use cookies to sell personal information to third parties or to carry out third-party behavioral advertising within the CRM.

We may use personal data to:

1. create and administer accounts;
2. authenticate users;
3. provide, maintain and operate the Service;
4. process transactions and billing;
5. provide support;
6. respond to requests;
7. send communications related to the Service;
8. detect, prevent and investigate fraud, abuse and security incidents;
9. diagnose errors and technical problems;
10. comply with legal obligations;
11. exercise or defend rights in administrative, judicial or arbitration proceedings;
12. enforce the Terms of Service;
13. maintain the security and integrity of the platform;
14. develop and improve features of the Service;
15. produce aggregated or de-identified statistical and technical information, where permitted by applicable law.

We do not sell personal data to third parties.

We do not use personal data for third-party behavioral advertising.

When the Customer uses Black Eagle Elite to store and process personal data of its own customers, suppliers, employees or contacts, Black Eagle FS normally processes that data on the Customer's behalf.

In that case:

• the Customer determines the purposes of the processing;
• the Customer determines which data is entered;
• the Customer is responsible for having a legal basis for the processing;
• Black Eagle FS processes the data to provide the Service;
• Black Eagle FS will follow the Customer's documented instructions, within the scope of the Service and applicable law.

Specific data processing obligations between Black Eagle FS and the Customer may be set out in a DPA.

If this Policy conflicts with a signed DPA that specifically applies to the processing of Customer Data, the DPA prevails on the data processing matters it governs.

Where applicable law requires a legal basis for processing, we may rely, depending on the situation, on:

• performance of a contract;
• compliance with a legal or regulatory obligation;
• regular exercise of rights;
• protection of life or physical safety, where applicable;
• legitimate interest, where permitted;
• consent, where required;
• other legal bases provided by applicable law.

An authorization granted for a technical integration, such as OAuth, should not automatically be read as equivalent to the consent required by data protection law. Each situation is assessed according to its purpose and applicable legal basis.

When you connect a Google account to the Service, access is limited to the permissions you authorize. Today the Service requests only:

• "openid" and "email" — to identify which account was connected;
• "gmail.send" — to send, from the connected account, the e-mails that the user or the Customer writes, replies to or schedules in the Service;
• "calendar.events.owned" (Google Calendar, optional, connected by each user for themselves) — to create, reschedule and cancel, in the calendars the user owns, the meetings scheduled in the Service, with the Google Meet link and the invitation sent by Google to the guests.

The Service does not read, search, index or store the contents of the Gmail inbox. Access tokens are stored encrypted and are never exposed to the browser.

Google Calendar: the Service only acts on the events it created itself. It stores only the identifier of each of those events and the Meet link, next to the meeting in the CRM. It does not read, list or store any other event, availability, title, guest or description from the calendars of the user. A meeting in the CRM is visible to whoever can already see the related lead, deal or customer. Only the user who connected the calendar can disconnect it; administrators have no access to it.

Black Eagle Elite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We will not use data obtained from Google services:

• for advertising;
• for sale to third parties;
• to determine credit, insurance or similar decisions;
• to build advertising profiles;
• to develop, improve or train generalized or non-personalized artificial intelligence and/or machine learning models.

We do not use or retain data obtained through Google Workspace APIs (including Gmail and Google Calendar) to develop, improve or train generalized or non-personalized artificial intelligence and/or machine learning models.

Data obtained from Google is used only to provide or improve the authorized user-facing features. We do not transfer it to third parties, except as necessary to provide or improve those features, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets, and in that case only after obtaining the user's explicit prior consent.

No person at Black Eagle FS reads data obtained from Google, except:

• with the user's explicit consent for specific messages;
• when necessary for security purposes, such as investigating abuse;
• to comply with applicable law;
• when the data has been aggregated and anonymized for internal operations.

You can disconnect the Google account at any time in the Service's channel settings (and Google Calendar also in the meeting form), or revoke access on your Google Account permissions page. When you disconnect through the Service, we delete the stored tokens and ask Google to revoke the access. Gmail sending and Google Calendar share one Google authorization: if the same Google account is still connected to the Service for the other feature, or in another workspace, revocation happens when the last of those connections is disconnected; until then the access stays listed on your Google Account permissions page, where you can remove it at any time. To request deletion of data obtained from Google, write to support@blackeaglefs.com. Messages already sent and meetings already logged remain in the CRM history as Customer Data, except for information we must keep for legal obligations, security, fraud prevention, defense of rights or other legally permitted bases.

Microsoft (Outlook Calendar and Teams)

Each user may, optionally, connect their own Microsoft account (Microsoft 365 or Outlook.com) to schedule meetings from the Service. Access is limited to the delegated permissions the user authorizes. The Service requests only:

• "openid", "email" and "User.Read" — to identify which account was connected;
• "offline_access" — to keep the connection active without asking the user to sign in again;
• "Calendars.ReadWrite" — to create, reschedule and cancel, in the user's Outlook calendar, the meetings scheduled in the Service, with the Microsoft Teams link and the invitation sent by Outlook to the guests.

Outlook Calendar: the Service only acts on the events it created itself. It stores only the identifier of each of those events and the Teams link, next to the meeting in the CRM. It does not read, list or store any other event, availability, title, guest or description from the calendars of the user. To decide whether a Teams link can be created, it reads only the list of meeting providers allowed for the calendar. Access tokens are stored encrypted and are never exposed to the browser. A meeting in the CRM is visible to whoever can already see the related lead, deal or customer. Only the user who connected the calendar can disconnect it; administrators have no access to it. Each user keeps one calendar connected at a time (Google Calendar or Outlook Calendar).

Microsoft (Outlook e-mail)

A workspace administrator may, optionally, connect a Microsoft mailbox (Microsoft 365 or Outlook.com) as an e-mail channel of the Service, to send and receive the CRM's e-mails through it. Access is limited to the delegated permissions authorized when connecting. The Service requests only:

• "openid" and "User.Read" — to identify which account was connected;
• "offline_access" — to keep the connection active without asking for a new sign-in;
• "Mail.Send" — to send, from the connected mailbox, the e-mails that the user or the Customer writes, replies to or schedules in the Service;
• "Mail.ReadWrite" — to read the messages that arrive in the Inbox and bring them into the CRM, and to create the draft of each e-mail the Service sends. The draft keeps the reply in the same conversation thread and provides the message identifier before sending.

Reading: periodically (today, every 2 minutes), the Service reads only the messages that arrived in the Inbox after the connection, with their content and attachments, and brings them into the CRM inbox. It does not import messages received before the connection, does not read other folders, does not mark messages as read and does not move or delete messages in the mailbox: in Outlook they stay exactly as they arrived. To confirm that an e-mail sent by the Service went out, it looks up only that message, by its identifier.

Writing: the Service only creates and changes the drafts of the e-mails it sends itself. It creates the draft, fills it in and sends it right away; the sent message stays in the Sent Items folder, like any e-mail sent from Outlook. If sending fails after the draft was created, the Service deletes that draft, and Outlook moves it to Deleted Items. The Service never opens, changes or deletes the user's own drafts. Access tokens are stored encrypted and are never exposed to the browser. Messages brought into the CRM become Customer Data and are visible to the workspace users according to the permissions the Customer sets in the Service. Only workspace administrators can connect and disconnect the mailbox.

Data obtained from Microsoft is used only to provide the scheduling and e-mail features authorized by the user or the Customer. We do not use it for advertising, we do not sell it, and we do not use it to train general-purpose artificial intelligence models.

You can disconnect the Outlook Calendar at any time in the Service's channel settings, and a workspace administrator can disconnect the Outlook mailbox in the same place. When you disconnect, we delete the stored tokens, so the Service can no longer reach the calendar or the mailbox. To also remove the app from your Microsoft account, use the app permissions page for personal accounts or My Apps for work or school accounts. The calendar and the mailbox use the same Microsoft app: removing it from a Microsoft account ends both connections of that account. To request deletion of data obtained from Microsoft, write to support@blackeaglefs.com. Meetings already logged and messages already sent or received remain in the CRM history as Customer Data.

The Service may offer features based on artificial intelligence.

Depending on the feature used, these features may:

• classify information;
• extract data;
• summarize communications;
• suggest information;
• help organize records;
• generate text;
• assist with operational tasks;
• identify patterns or relevant information.

Results produced by artificial intelligence systems may contain errors, omissions or incorrect interpretations and should be reviewed by the user when the nature of the decision calls for human validation.

Black Eagle FS will not use Customer Data to train general-purpose artificial intelligence models without the Customer's express contractual authorization. Data obtained from Google is never used or retained to develop, improve or train artificial intelligence or machine learning models (section 6).

When AI features rely on external providers, those providers may act as subprocessors, as applicable, and are subject to the relevant contractual and data protection obligations.

We may share personal data with:

8.1. Service providers

We may use specialized providers to operate parts of the Service, including infrastructure, hosting, authentication, e-mail delivery, communications processing, security, support and artificial intelligence services.

8.2. Third-party services connected by the Customer

When the Customer chooses to connect external services, such as Google, Microsoft or other providers, data may be shared as needed to perform the authorized integration.

8.3. Legal obligations

We may disclose information when we believe in good faith that disclosure is necessary to:

• comply with a legal obligation;
• comply with a valid judicial or administrative order;
• protect rights or safety;
• investigate fraud or abuse;
• respond to a legitimate request from a competent authority.

8.4. Corporate transactions

Data may be transferred as part of a merger, acquisition, reorganization, sale of assets or similar transaction, subject to applicable law. Data obtained from Google follows section 6 and is only transferred after the user's explicit prior consent.

We may use specialized providers, including, as applicable:

• Supabase;
• Vercel;
• Resend;
• Google;
• Microsoft;
• Meta;
• Geoapify;
• artificial intelligence providers.

The current list of subprocessors and their functions may be made available on a dedicated page or in a supplementary document.

Where required by law or by a signed DPA, appropriate contractual measures will be adopted with respect to subprocessors.

Black Eagle FS is located in the United States and uses providers that may be located in different countries.

As a result, personal data may be transferred internationally.

Where Brazil's LGPD applies, these transfers are carried out under the mechanisms permitted by the law and by the regulations of Brazil's National Data Protection Authority (ANPD).

Where standard contractual clauses approved by the ANPD are used, they are adopted according to the applicable requirements, including their incorporation in full where required.

Additional information about international transfers may be made available in this Policy, in the DPA or in a specific international transfer document.

We adopt reasonable technical and administrative measures, proportionate to the risks involved, to protect personal data against:

• unauthorized access;
• improper alteration;
• loss;
• destruction;
• improper disclosure;
• unauthorized use.

These measures may include access controls, authentication, encryption where applicable, environment segregation, event logging, monitoring, security procedures and infrastructure controls.

No system connected to the Internet can be considered absolutely secure. Therefore, we cannot guarantee that no incident will occur.

When Black Eagle FS acts as Processor and becomes aware of a security incident involving Customer Data that may require action by the Customer, it will notify the Customer without undue delay, following the applicable procedures.

Where appropriate, we will provide reasonably available information to help the Customer meet its legal obligations.

When Black Eagle FS acts as Controller, it will assess and handle the incident in accordance with the legal obligations applicable to its own processing activity.

We keep personal data for as long as needed to:

• provide the Service;
• comply with legal obligations;
• resolve disputes;
• prevent fraud;
• keep business records;
• protect our rights;
• comply with regulatory obligations;
• serve other legitimate purposes permitted by law.

After an account is closed, Customer Data may remain stored for a limited period for recovery, security, operational continuity or export purposes, before being deleted or anonymized, unless retention is legally required.

Backups may remain for an additional period until they are replaced or deleted according to technical retention cycles.

Google access tokens are deleted when the related connection is disconnected, when the user is removed or when the account is closed (section 6).

Where the LGPD or other applicable law grants rights to data subjects, these may include, as applicable:

• confirmation that processing exists;
• access;
• correction;
• anonymization, blocking or deletion;
• portability;
• information about sharing;
• information about the consequences of providing data;
• withdrawal of consent;
• objection to processing where legally applicable;
• review of certain automated decisions, where applicable.

Data subjects may also file a petition with Brazil's National Data Protection Authority (ANPD). To exercise your rights with us, use the channel in section 21.

When Black Eagle FS acts as Processor on behalf of a Customer, requests relating to Customer Data should normally be sent to that Customer, which determines the purposes of the processing.

Where necessary, Black Eagle FS may help the Customer respond to data subject requests, according to the Service and the DPA, when signed.

The Customer is responsible for:

• deciding which data is entered;
• having a legal basis for the processing;
• providing privacy notices where required;
• obtaining consent where required;
• respecting data subject rights;
• using the data lawfully;
• correctly configuring users and permissions.

Black Eagle FS does not determine the business purposes for which the Customer uses the data stored in the CRM.

The Service is intended for companies and professional users.

We do not knowingly collect personal data from children to allow them to use the Service as independent users.

If you believe a child has improperly provided personal data, contact us so we can assess the situation.

Depending on the location of the user or the Customer, other data protection laws may apply.

Black Eagle FS may adapt its practices to meet the legal obligations that apply to the activities actually subject to those laws.

Nothing in this Policy is intended to exclude rights that cannot legally be excluded.

Certain U.S. state laws grant specific privacy rights.

Whether these laws apply depends on, among other factors, the type of entity, data volume, revenue, location and the nature of the activities carried out.

Where a state law applies to Black Eagle FS or to the processing carried out, we will comply with the corresponding requirements.

This Policy does not state that every U.S. state law applies to every user.

Black Eagle FS does not sell personal data to third parties.

Nor does it use Customer Data for third-party behavioral advertising.

We may update this Policy to reflect:

• changes to the Service;
• legal changes;
• new features;
• changes in providers;
• changes in processing practices;
• security improvements.

When a change is material, we may provide additional notice where required by applicable law.

The date of the last update is shown at the top of this Policy.

Privacy requests, questions or complaints can be sent to support@blackeaglefs.com.

Data Protection Officer (encarregado, LGPD art. 41): Black Eagle FS, at support@blackeaglefs.com.

This Policy should be interpreted together with the law applicable to the processing of personal data.

Where applicable law grants mandatory rights to data subjects, nothing in this Policy is intended to remove or reduce them.

Black Eagle FS — Apopka, FL, United States. E-mail: support@blackeaglefs.com.