Privacy Notice

Who we are and our role

Air360crm ("Air360", "we", "us"), trading as Air360 CRM, is the data controller for the personal data described in this notice. This means we decide what personal data is collected through the Air360 public site and customer portal (air360crm.com and related pages), why it is collected and how it is used, and we are responsible for handling it in line with applicable data protection law.

This notice does not cover the separate application and database built for your business — for that system you are the controller of your own operational records, and Air360 acts on your instructions under the data handling terms agreed as part of your engagement.

Information we collect and why

• – Account information (name, email, phone, login credentials): to create and secure your account and authenticate you.
• – Company information (company name, industry, size, registered details): to manage your subscription and issue billing documents.
• – Onboarding requirements (workflows, modules and configuration details you submit): to configure and deliver your system.
• – Uploaded documents (files attached for onboarding, billing or support): to process the request they relate to.
• – Support and enhancement messages (ticket and request content): to provide support and track requested changes.
• – Order and subscription records (package, price, subscription status, renewal dates, and payment confirmations we receive from our payment provider): to manage entitlements, renewals and accounting. We do not collect or store your card details.
• – Technical and usage data (IP address, device and browser information, portal activity logs): to keep the service secure, prevent fraud and abuse, and improve the product.

Legal basis for processing

We process account, company, onboarding, order and support data to perform our contract with you. We rely on our legitimate interests to keep the service secure, prevent fraud and abuse, and improve our products. We rely on legal obligation for accounting, tax and record-keeping requirements. Where we send marketing communications or use non-essential cookies, we rely on your consent, which you can withdraw at any time.

Payments and Merchant of Record

Our order process is conducted by our online reseller Paddle.com, which acts as the Merchant of Record for all orders placed through checkout. When you make a purchase, the personal data you enter at checkout — including your name, email, billing address, country and payment method details — is collected and processed by Paddle in order to take payment, calculate and remit taxes, issue invoices and receipts, manage your subscription, and handle refunds and chargebacks. Card and bank details are entered directly into Paddle's checkout and are never collected, seen or stored by Air360.

Air360 receives from Paddle only the information needed to fulfil and service your order — such as your name, email, country, the package purchased, subscription status and renewal dates. Paddle handles this data as described in the Paddle Privacy Notice, and its role in your purchase is set out in the Paddle Buyer Terms.

Who we share information with

We do not sell your personal data. We share it only with the following categories of recipient:

• – Merchant of Record — Paddle.com, for the sale of our products, payment processing, subscription management, tax compliance, invoicing, refunds and billing-related customer support.
• – Service providers and subprocessors — hosting, cloud infrastructure, database, email delivery, analytics and support tooling providers, engaged under confidentiality and data protection obligations and only to the extent needed to run the service.
• – Professional advisers — legal, accounting and audit advisers where necessary.
• – Authorities — regulators, law enforcement or courts where we are legally required to disclose information, or to establish or defend legal claims.
• – Successors — a buyer or successor entity in connection with a merger, acquisition or sale of assets.

Some of these recipients are located outside your country. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, depending on the destination.

How we protect your information

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss. These include encryption of data in transit over HTTPS, encryption of data at rest by our infrastructure providers, authenticated access with role-based permissions so users only reach the records for their own organisation, private document storage restricted to your authorised users and the Air360 team working on your account, access logging and audit trails, and least-privilege administrative access limited to staff who need it. Payment card data is handled entirely by Paddle within its own PCI-compliant environment and never reaches Air360 systems.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to affect you, we will notify you and any relevant supervisory authority as required by law.

Your client system is separate

Each client's CRM, HRMS or ERP system is a separate application with its own dedicated database. The portal covered by this notice only holds subscription, onboarding, project, application-link, billing and support information — not your day-to-day operational records, which live in your own system.

Retention

We keep portal information for as long as your subscription is active, and afterwards only as long as needed for the purposes described above — typically up to seven years for order, invoice and tax records to meet accounting and legal obligations, and a shorter period for support tickets and technical logs. When personal data is no longer needed, we delete or anonymise it.

Cookies

We use essential cookies and similar technologies that are required to sign you in, keep your session secure and remember basic preferences. Paddle may set cookies within its checkout to process your order and prevent fraud. Where we use non-essential analytics or marketing cookies, we ask for your consent first, and you can change or withdraw it at any time through your browser settings or by contacting us.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to certain processing, to receive a portable copy, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local data protection authority. To exercise any of these rights, contact us using the details below; we will respond within one month, and will tell you if we need longer. Some requests may be limited by our ongoing contractual, accounting or legal obligations. For data held by Paddle in its role as Merchant of Record, you can also contact Paddle directly.

Contact us

For privacy questions, requests or security concerns, reach out to Air360crm at ramzan@air360crm.com or via our contact page. Our Refund Policy and Terms of Service explain the commercial side of your purchase.