Privacy Policy
How we handle personal information on our websites and in AlwaysCRM, including Google Calendar data. We do not sell your data, and we do not use it for advertising.
Last updated 7 October 2026
Who we are
This policy covers the always49.co.uk and AlwaysCRM websites and the AlwaysCRM application (including client portals, booking pages and other sites hosted on it). They are all run by Always Forty Nine Ltd (“Always49”, “we”, “us”), Emet Lane, Emersons Green, Bristol BS16 7BX, United Kingdom.
For questions about this policy or your information, email hello@always49.co.uk or call 0117 322 6310.
When an organisation uses AlwaysCRM, the information it puts into the CRM (its customers, contacts, bookings and so on) belongs to that organisation. The organisation decides how that information is used, and we process it on its behalf to provide the service.
What we do not do
- We do not sell personal information, including Google user data.
- We do not rent, trade or give it to data brokers or information resellers.
- We do not use it for advertising, including targeted, personalised, retargeted or interest-based advertising.
- We do not use it to decide creditworthiness or for lending.
- We do not use your data, or any Google user data, to develop, improve or train generalised or non-personalised AI or machine-learning models.
What we collect
- Details you send us: name, email address, phone number, company and the message you type into a contact, enquiry or booking form.
- AlwaysCRM account details: your name, email address, password (stored only as a secure hash), role, profile details you add, two-factor authentication settings, and records of sign-ins and actions so we can keep accounts secure.
- Information organisations store in AlwaysCRM: such as contacts, companies, leads, notes, tasks, projects, bookings, event attendees, invoices and files.
- Payment details: card payments are handled by Stripe. We receive confirmation of the payment, but we never see or store full card numbers.
- Basic visit data: pages viewed, rough location (country or city), browser and device type, so we can see which pages are useful and keep the service working.
- Google user data: only if you choose to connect your Google Calendar. This is explained in full in the next section.
Google user data (Google Calendar)
AlwaysCRM can connect to your Google Calendar. This is optional and only happens if you click Connect Google Calendar in Settings → Google Calendar and approve access on Google’s consent screen. We do not access your Gmail, Google Contacts, Google Drive or any other Google service.
What Google user data we access
We ask Google for two permissions:
- See your calendars and events (
calendar.readonly): the list of your calendars (name, ID and time zone), and the events on the calendars you choose (each event’s start and end time and its title). - Add and change events (
calendar.events): so we can put CRM bookings assigned to you onto your primary calendar, and update or remove them when the booking changes or is cancelled.
To keep the connection working we also store the access token and refresh token Google gives us, when the access token expires, which calendars you have chosen, and the IDs of the calendar events we created for your bookings.
How we use Google user data
We use it only to provide these features, which you can see in the app:
- Showing your upcoming calendar events to you in AlwaysCRM (Settings → Google Calendar and “My free time”).
- Working out when you are busy, so availability checks and booking pages do not offer times when you already have an event. People booking with you only see that a time is unavailable. They never see your event titles or any other details.
- Adding bookings assigned to you to your primary Google Calendar, and keeping those events up to date.
We do not use Google user data for any other purpose, and we do not use it for advertising or to build profiles about you.
How we store Google user data
Calendar events are read from Google when a page needs them and are not saved in our database. The only Google data we store is the tokens, your calendar selection and the IDs of events we created, as described above. The tokens are encrypted before they are saved.
Who we share Google user data with
We do not sell, transfer or disclose Google user data to anyone, except:
- our hosting provider, which stores our database (including the encrypted tokens) only so we can run the service;
- where the law requires it, or to protect the security of the service and its users;
- as part of a merger, acquisition or sale of the business, where the new owner must protect it in the same way and you are told first.
Google user data is never passed to advertisers, data brokers or AI providers. It is not sent to the AI writing features or to AI assistants you connect to AlwaysCRM (such as ChatGPT or Claude), and it is never used to train AI or machine-learning models.
Our staff do not read your Google user data, unless you ask us to help with a support issue, it is needed for security reasons (for example, to investigate abuse), or the law requires it.
Limited Use
AlwaysCRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we protect Google user data
- All connections to AlwaysCRM and to Google use encrypted HTTPS.
- Google tokens are encrypted at rest using AES-256 and are hidden from all screens and exports.
- A user’s tokens are only used for that user’s own calendar. Other users in the organisation cannot use them to read your calendar.
- Access to our servers is limited to the people who maintain the service. Accounts can be protected with two-factor authentication.
How long we keep it and how to delete it
- We keep your Google tokens and calendar selection only while your Google Calendar is connected.
- You can disconnect at any time in Settings → Google Calendar. We then revoke our access with Google and immediately delete the tokens and your calendar selection.
- You can also remove AlwaysCRM’s access from your Google Account at myaccount.google.com/permissions. AlwaysCRM then stops working with your calendar.
- If your AlwaysCRM user account is deleted, the stored Google tokens are deleted with it.
- Booking events we added to your Google Calendar belong to you and stay in your calendar until you delete them in Google Calendar.
- You can ask us to delete any Google user data we hold by emailing hello@always49.co.uk. We will do this within 30 days.
How we use your information
- To provide AlwaysCRM and the features your organisation uses.
- To answer your enquiry and deliver work we have agreed with you.
- To send emails you or your organisation have set up, such as booking confirmations, invoices and workflow emails.
- To keep accounts and the service secure, prevent abuse and fix problems.
- To understand, in general terms, how the website and app are used, so we can improve them.
- To keep records the law requires, for example invoices.
How we protect your information
We use encrypted HTTPS connections, store passwords only as secure hashes, encrypt sensitive secrets (such as two-factor keys and third-party tokens) at rest, keep each organisation’s data separate, and limit access to the people who need it. Accounts can be protected with two-factor authentication.
How long we keep information
We keep personal information only for as long as we need it for the purposes in this policy. Enquiry details are kept while we respond and carry out any work that follows. Information in AlwaysCRM is kept while the organisation’s account is active, or until the organisation deletes it. When information is no longer needed, we delete it or remove anything that identifies you, unless we must keep a record for accounting, tax or another legal reason. Google user data is kept and deleted as described in the Google Calendar section above.
Your rights
You can ask us:
- What personal information we hold about you, and for a copy of it.
- To correct anything that is wrong.
- To delete it, where we are allowed to.
- To stop or limit how we use it.
Email hello@always49.co.uk. If your information is held in AlwaysCRM by an organisation you deal with, you can also contact that organisation directly. You can complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handle your information.
Changes to this policy
When we change this policy we will update the “Last updated” date. If we change how we use Google user data or other personal information in a way that matters, we will tell AlwaysCRM users in the app or by email before the change takes effect, and ask for your consent again where required.
Contact
Always Forty Nine Ltd, Emet Lane, Emersons Green, Bristol BS16 7BX, United Kingdom. Email hello@always49.co.uk or call 0117 322 6310.
See also our Terms of Service.