Hot Sauce CRM privacy policy

Hot Sauce CRM operates in two roles depending on whose data we're handling:

• Controller (we decide what happens): when we collect information directly from you — for example, when you submit our marketing get-started form at hotsaucecrm.com, fill out our consent form for our own gym, or contact us as a SaaS prospect.
• Processor (we act on a customer's instructions): when we process information on behalf of one of our paying customers (a gym or fitness club) — for example, the gym's members' contact details, appointment history, and communication content. In that case, the gym is the data controller and decides what happens with your data; we just store and transmit it on their behalf under our Data Processing Addendum.

If you're a gym member and want to exercise rights over your data, contact the gym you have a relationship with first. They'll forward the request to us if we need to act on it. You can also submit a request directly via /dsr.

We collect the information you give us directly: your name, mobile number, email address, and the consent preferences you choose on our consent form. We also record technical metadata (IP address, device fingerprint, timestamp) at the moment you submit consent, as required for compliance audit trails.

We use your contact information to do exactly what you consented to — send the texts, emails, or calls you opted in to. We never use your information for any purpose you didn't explicitly approve.

We do NOT sell, rent, or share your mobile number or SMS opt-in data with any third party for marketing purposes. Mobile information collected as part of our text-message program (including your number and the date/time of your opt-in) is used solely to deliver the messages you requested and to maintain proof-of-consent records.

Numbers are shared with our SMS gateway provider (e.g. Twilio) only as needed to physically deliver the text — they are bound by their own data-handling obligations and do not use your number for any other purpose.

See our SMS Program Terms for frequency, pricing, and opt-out details.

You can opt out of any channel at any time:

• Text messages: reply STOP to any text you receive from us.
• Email: click the unsubscribe link in any email we send.
• Phone calls: tell the staff member on the call, or ask us in person.

We use the following third-party services to operate Hot Sauce CRM. Each is contractually obligated to handle Personal Data only as we direct, and only for the purpose listed. All are US-based.

• Vercel — application hosting
• Supabase — database, authentication, and file storage
• Twilio — SMS sending and inbound parsing
• Resend — email sending and inbound parsing
• Anthropic — AI draft generation and assessments (for customers on the Medium tier or higher)
• Upstash — rate-limiting for public endpoints

See the Data Processing Addendum for the full subprocessor list with data locations.

Our default retention periods:

• Active records — retained while you have an active relationship with us or our customer.
• Archived records — 7 years from the archive date.
• SMS / email / call content — 2 years from the date of the communication.
• Audit log entries — 7 years (regulatory defensibility).
• Consent proof records — retained indefinitely after revocation, so we can demonstrate we honored your opt-out if asked.

Depending on where you live (California, EU, UK, and other jurisdictions with comprehensive privacy law), you have the right to request:

• Access — see what data we hold about you.
• Export — get a copy in a portable format.
• Deletion — have your data erased.
• Correction — fix inaccurate information.
• Opt-out of sale or sharing — we do not sell or share personal data for cross-context behavioral advertising, so this right is honored by default.

Submit a request via our Data Subject Request form. We respond to verified requests within 30 days.

Questions about this policy? Reach out via any contact channel listed on our site.