Privacy
Last updated: November 2, 2026
Your data is stored
The CRM keeps what your team types in. The server stores your contacts, companies, deals and notes in Cloudflare D1: names, email addresses, phone numbers, job titles, tags, amounts, dates and the text of your notes. It also stores the stages of your pipeline.
Only the members of your team can read it. A member of one team can never read the data of another team. An API key can read and write the data of its own team only.
The CRM sends no email and reads no email. The Email button opens your own mail program. No log has an address, a name or a note. Our logs show only that a request came in, with no personal data.
What else the server stores
- Your email, to know whose teams they are. You can own 3 teams.
- For each team: its name, the members (up to 10, with the email addresses of the people you invited) and the API keys. The server keeps only a one-way code of each key. It shows the key once, when you make it.
- For each team: a daily count of the changes made and the rows imported. It has no content. The server deletes it when the next day starts, and with the team.
The server never stores the IP address of a person. Cloudflare counts requests by API key to limit abuse. We do not store or log an IP address.
How long it stays, and how to delete it
Your data stays until you delete it. You can delete a contact, a company, a deal or a note. In the settings of a team, the owner can choose “Delete this team”. That deletes every record, note, API key and member of the team. You can also export your data as CSV files first. Cloudflare D1 keeps point-in-time backups of the database for up to 30 days, so deleted data can stay in a backup for that time.
Delete my account
Sign in and choose “Delete my account”. The server then deletes every team you own, with all its records. You leave the teams of other people, and your name is removed from the records and notes there. It also deletes your sign-in account. This cannot be undone.
Your sign-in is shared with Kevin’s other apps. So you are signed out of them too. A request goes to Kevin automatically. He deletes what those apps keep for your account within 30 days of your request.
Signing in
To sign in you use Google (on Google’s site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on utilarium.app (and on kamadorueda.com when the sign-in goes through it) for 30 days. The start page asks the sign-in service whether you are signed in. That request goes to auth.utilarium.app and carries your sign-in cookie if you have one. It carries none of your data. For details, read the sign-in section of Coro’s privacy page.
A script that uses an API key does not sign in and sets no cookie.
Where it runs
The CRM runs on Cloudflare. The records are in Cloudflare D1. Like any web host, Cloudflare sees your IP address and the page you ask for.
Analytics and error reports
Cloudflare, the host, counts requests to the site. The count has none of your data. Cloudflare also measures visits with Cloudflare Web Analytics. It sets no cookies. Our own code sets no cookie and keeps no profile of you. Only the sign-in service sets a cookie, and only when you sign in.
When you make a team, add a contact, win a deal or import a file, the page sends one anonymous count. It has the tool, which job (for example "team_created"), the page type, and mobile or desktop. No cookie, no IP address, no team name, no name, no email.
The Worker also counts, with no content, how many changes it handles, and how often a limit stops a request. A count of an account that is near a limit uses a one-way code, not your email.
If the page has an error, it sends a report with the error message, page type and browser. It has no record, address or text. Cloudflare keeps technical request logs, with no IP address, for 7 days. For about 1 in 10 requests, Cloudflare also records the browser and operating system, the language, the network and an approximate location. These records hold none of your data.
Your rights, your contact and the law
Who is responsible
I am Kevin Amado, and I am responsible for the data in CRM. I am one person in Alberta, Canada. Write to kamadorueda@gmail.com with any question or request about your data.
Why data is used, and for how long
- Counts, error reports and logs: to run the tool and fix errors. The legal basis is my legitimate interest. Counts stay 90 days. Logs and error reports stay 7 days. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.
- Cloudflare also records about one request in ten in more detail. That record has your browser, operating system, language, network and approximate location (country, region and city). It is deleted after 7 days.
- Features you turn on, such as sign-in, sync, reminders or sharing: to give you that feature. The legal basis is your consent or our contract. This page says how long each kind of data stays.
- Data in your browser: I do not receive it. It stays until you clear it.
Who receives your data, and where it goes
Cloudflare hosts this tool and handles the data for me. It works in the United States and in other countries. For transfers from the EU and the UK, it relies on the EU-US Data Privacy Framework and standard contractual clauses. Cloudflare Web Analytics counts visits to this page with a small script. Cloudflare says that it uses no cookies and does not identify you. If you sign in with Google, Google receives your sign-in request. I do not sell your data. This page names any other service.
Your rights
- You can ask for a copy of your data.
- You can ask me to correct it, delete it or stop using it.
- You can ask me to move it to another service.
- You can object to how I use your data.
- You can take back a consent at any time.
- Write to the address above. I answer within 30 days.
- If the request is about an account, write from the email address of that account. This shows me it is you.
- You can also clear the data of this site in your browser. That removes what the page keeps there.
- If you delete your account in one app, I get a request to delete what my other apps keep for it. I finish it within 30 days.
Complaints
If you are not happy, you can complain to a data protection authority. In the EU, this is the authority of your country. In the United Kingdom, it is the ICO. In Canada, it is the Office of the Privacy Commissioner of Canada. For Alberta, it is the Office of the Information and Privacy Commissioner of Alberta. In Saudi Arabia, it is SDAIA. I would like to answer you first.
Children
This tool is not for children under 13, or under 16 in the EU without a parent's permission. If a child gave me data, write to me. I will delete it.
If you collect data about other people
You may use this tool to collect data about other people, such as joiners, customers, guests or signers. You then decide why and how. You must tell them, and you must have a lawful reason. I use that data only to run the tool for you, as your processor. I use it for nothing else.