Privacy Policy

This website (officecrm.app) presents the Office CRM Platform and OfficeCRM.app. It is operated by Vajra Code, 68 Mcilwraith St, South Townsville, QLD 4810, Australia(“we”, “us”). We are the controller of the personal information described in this policy.

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Section 9 adds information for visitors from the European Economic Area (EEA) and the United Kingdom.

Contact for all privacy matters: hello@officecrm.app.

The website has marketing pages and needs no account to browse. We collect personal information in the following situations only.

• Contact and estimate-request forms (/contact and /custom-solutions). You give us your name, email address and company, and optionally your role, team size and timeline. You also choose a topic (question, estimate, purchase or support) and write a message. Together with your submission we record your IP address, browser user agent and the referring page.
• Customer sign-in area. We provide a sign-in area for customers. You can sign in with an email magic link (and with Google or Discord, where enabled). We then hold your account email address and name, your sign-in session and the content you submit through the area, such as requests, messages and an AI-assistant onboarding brief. If you use Google sign-in we also hold your Google account identifier, the address of your profile picture and the sign-in tokens Google issues to us. If you use Discord sign-in we hold your Discord account identifier, your Discord name, your verified Discord email address, the address of your avatar and the sign-in tokens Discord issues to us. The people who run the area can read what you submit, so that they can answer you.
• Live demo access. If you ask for access to the live product demo from the customer area, we send the demo environment (operated by us on vajracode.com) your IP address, the role you chose, your email domain and a one-way code derived from your email address. We do not send the address itself. The demo environment records those details together with the IP addresses and browser type used to open and use the session, and when it was used. We keep a record of the request in your customer area.
• Spam protection. Forms include a hidden honeypot field, and requests are rate limited by IP address (your IP address is held for about an hour for this).
• Website usage statistics. When you browse the public pages we record which page you viewed, the page title, the website you came from and any campaign tags in the link, clicks on links and buttons (their label and destination), which sections of a page scrolled into view, how far you scrolled, how long the page was visible, your approximate country (when provided by our network provider), your language and a coarse device, browser and operating-system type, and the words you search for in the site search. We do not store your IP address with these records and we set no cookie: to count visitors we use a one-way hash of your IP address and browser type that changes every day, so a visit on one day cannot be linked to a visit on another. We do not record what you type into forms. If your browser sends a Do Not Track or Global Privacy Control signal, we do not record anything. You can also switch the statistics off yourself at any time, in the cookie notice or in section 7.
• Error monitoring. If the site fails in your browser or on our server, our error-monitoring provider (Sentry) receives technical diagnostics: the type of error and its trace, the page address, and your browser and operating system. We do not send cookies or user identifiers with these reports, and reports from your browser pass through our own server first. An error message can incidentally contain personal information.
• Server logs. Our hosting infrastructure and network provider record standard request information such as IP address, time and requested URL.
• Emails you send us. If you write to hello@officecrm.app, we keep the correspondence.

We do not intentionally collect sensitive information. Please do not include it in forms or messages.

Purchases are made on www.vajracode.com, not on this site. This site does not collect payment details.

We use personal information for these purposes:

• To respond to your enquiry, prepare an estimate, or handle a purchase or support question. Basis (GDPR): steps at your request before entering a contract, or our legitimate interest in answering enquiries.
• To provide the customer sign-in area and the services you request through it. Basis: performance of a contract, or steps before a contract.
• To keep the website secure and reliable: spam and abuse prevention, rate limiting, error diagnosis. Basis: our legitimate interest in a secure, working website.
• To understand how the website is used and to improve its content and navigation, using the usage statistics described in section 2. Basis: our legitimate interest in improving the website (these records are not linked to you as an individual).
• To meet legal obligations, for example keeping records and responding to lawful requests. Basis: legal obligation.
• Where you have opted in, for anything else we ask you about. Basis: consent, which you can withdraw at any time.

We do not sell personal information and we do not use it for advertising or profiling. Under the APPs we collect information that is reasonably necessary for these purposes and use or disclose it for them, or for a related purpose you would reasonably expect.

We share personal information only with service providers that help us run the website, and only as needed for that service:

• Hosting and network: Hosting.com (virtual server), managed through Laravel Forge, and Cloudflare (DNS and, where enabled, content delivery and protection), which sees the traffic to the site including IP addresses.
• Database: MongoDB, which we run ourselves on our own server at Hosting.com. It stores form submissions, accounts, customer-area content and sign-in data.
• Off-site backups: Amazon Web Services (Amazon S3, Sydney, Australia). The daily database backup is encrypted on our server before it is sent, with a key that Amazon does not hold, so Amazon stores it but cannot read it. It is deleted automatically after 35 days.
• Email: Google Workspace, used to send and receive email, including the notification of each form submission.
• Sign-in: Google or Discord, if you choose that way to sign in. Discord Inc. then receives the fact that you signed in to our site, and we receive your Discord email address and name.
• Rate limiting: Upstash (Redis), which processes IP addresses to limit abusive requests.
• Website statistics: Google Analytics 4 (Google). Our server forwards the usage events described in section 2 to Google Analytics. No Google script runs in your browser, and Google does not receive your IP address or a cookie identifier from us, only the daily one-way hash.
• Website statistics (own server): Matomo, run by us at matomo.vajracode.net. Our server forwards the same usage events to it, with your language and, where we enable it, your country and your browser’s user agent string. No Matomo script or cookie runs in your browser, and your IP address is not sent to it.
• Error monitoring: Sentry.
• Profile picture: Gravatar (Automattic). When you are signed in, our server checks whether a Gravatar exists for your email address, using a one-way hash of it, and shows it next to your account menu. Your browser does not contact Gravatar, and we do not store the picture. If you signed in with Google, your browser loads your Google profile picture from Google instead; if you signed in with Discord, from Discord.
• Live demo: the demo environment on vajracode.com, operated by us, receives the details described in section 2 when you ask for demo access.

These providers act as our service providers (processors or sub-processors) under their own terms and security commitments. We may also disclose information where the law requires it, to protect our rights, or in connection with a sale or restructure of our business. Purchases on www.vajracode.com are handled by that store, including its payment processor, under its own policies (see section 13).

We are based in Australia, and our providers operate globally. Your information may be processed in Australia, the United States, the European Union and other countries where our providers or their sub-processors operate. Where we disclose information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs (APP 8). For visitors from the EEA and the UK, transfers outside those regions rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, where applicable to the provider.

These periods are applied automatically by a daily job on our server, except where we say a person decides:

• Enquiries and estimate requests: your name, email, company, message and the other details you entered are deleted 24 months after you sent them, unless a customer relationship exists. If it does, we keep the relevant records for as long as the relationship and our legal obligations require. The technical details recorded with a submission (IP address, browser user agent and referring page) are deleted after 90 days.
• Customer accounts and submitted content: kept while the account is active, and deleted or de-identified after a valid deletion request, subject to section 8. A person handles those requests. A sign-in link expires after 15 minutes and an unused one is then removed automatically, and a signed-in session lasts up to three days.
• Website usage statistics: detailed records are deleted automatically after 400 days (about 13 months); summarised figures that do not identify anyone may be kept longer. Because these records are not linked to an individual, we cannot look up or delete the records of a particular person. Data held in Google Analytics and Matomo follows the retention setting of those properties.
• Spam protection records: your IP address is held for about an hour for rate limiting.
• Backups: we take daily database backups on our server and keep them for up to 35 days (every day for the last week, then one a week). An encrypted copy is also kept at Amazon Web Services and deleted there after 35 days. A record that has been deleted can remain in these backups until they expire, and we do not restore it into use afterwards.
• Server logs and error-monitoring data: kept for the periods set by our hosting provider and by Sentry respectively.

When we no longer need personal information and are not required to keep it, we delete or de-identify it. See also our data deletion page.

This site uses no analytics cookies and no advertising cookies. It has no advertising trackers, no tag manager, no social-media pixels and no session-replay tools.

We use strictly necessary storage only:

• sign-in cookies, set when you use the sign-in page or are signed in to the customer area: a session cookie, a security token that protects the sign-in form (CSRF) and a cookie that remembers the page to return to;
• your display choices, kept in your browser’s local storage: light or dark theme, high contrast, reduced animation and the fact that you closed the cookie notice, so the notice is not shown again;
• while you are signed in, a temporary note in your browser tab about whether your profile picture could be loaded.

We measure how the website is used with our own cookieless statistics (section 2). They do not use cookies or any identifier stored in your browser, and they respect Do Not Track and Global Privacy Control signals.

You can switch the statistics off for this browser here:

Error monitoring (section 2) collects technical diagnostics when an error occurs; it is not used to track you across sites.

You may ask us to:

• give you access to the personal information we hold about you;
• correct information that is inaccurate, out of date or incomplete;
• delete your personal information;
• stop or restrict processing that is based on our legitimate interests (objection);
• give you a copy of information you provided, in a common machine-readable format (portability);
• withdraw a consent you have given, without affecting processing done before you withdrew it.

To exercise any of these rights, email hello@officecrm.app from the address concerned. We may need to verify your identity first. We aim to respond within 30 days. Access or deletion may be refused or limited where the law permits or requires it, for example where we must keep records; we will explain why. Deletion requests are described on the data deletion page.

If you are in the EEA or the UK, the GDPR or UK GDPR applies to our handling of your personal information, and Vajra Code is the controller. Our legal bases are set out in section 3. You have the rights in section 8, plus the right to lodge a complaint with a supervisory authority (section 10). Where we rely on consent you may withdraw it at any time, and where we rely on legitimate interests you may object to that processing. Providing personal information through the forms is voluntary, but we cannot answer an enquiry without contact details. International transfers are covered in section 5.

We do not currently appoint an EU or UK representative. Contact us at hello@officecrm.app for any request.

Please contact us first at hello@officecrm.app so we can try to resolve your concern. We will respond within a reasonable time, normally within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. If you are in the EEA or the UK, you may also complain to the data protection supervisory authority in your country of residence or work (in the UK, the Information Commissioner’s Office).

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, including encrypted connections (HTTPS), access controls on our systems and databases, restricting access to people who need it, and using reputable providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach is likely to cause you serious harm, we will notify you and the regulator as the law requires.

This website is a business product site and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email us and we will delete it.

This policy covers this website only. It does not cover:

• the store at www.vajracode.com, where purchases and licences are handled through Stripe checkout. The store’s own policies govern payment data and any account you create there;
• the optional AI assistant add-on running in a customer’s own installation, which is the customer’s own deployment and outside the scope of this policy;
• third-party websites we link to.

We may update this policy from time to time. The date at the top shows when it was last updated (25 October 2026). Material changes will be highlighted on this page.

Vajra Code
68 Mcilwraith St
South Townsville, QLD 4810
Australia
hello@officecrm.app