LEGAL

Privacy Policy

Last updated: 1 April 2026 · GNM Group · cowyboymanager.com

1. Information We Collect

We collect the following categories of information when you interact with Cowboy CRM or our website:

• Account information: Name, email address, company name, job title, and login credentials provided during registration or demo scheduling.
• Usage data: Actions performed within the CRM, module usage patterns, login timestamps, IP addresses, and browser/device information.
• Client data: Contact records, call logs, deposit records, and other operational data that enterprise clients input into the Cowboy CRM system. This data is owned by the enterprise client, not by GNM Group.
• Communication data: Emails, demo scheduling requests, and support communications sent to us.
• Technical data: Server logs, error reports, and performance metrics collected automatically for system maintenance and security purposes.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Cowboy CRM platform
• Process demo requests and respond to inquiries
• Send product updates, security notices, and operational communications
• Analyze usage patterns to improve system performance and features
• Maintain security, prevent fraud, and enforce our Terms of Service
• Comply with applicable legal obligations

We do not sell your personal information to third parties. We do not use client operational data (call logs, contact records, deposit data) for any purpose other than providing the contracted service.

3. Data Storage and Security

All Cowboy CRM data is hosted on AWS infrastructure with the following security controls in place:

• Encryption: All data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.
• Access control: Role-based access control (RBAC) limits data access to authorized personnel. All access events are logged in an immutable audit trail.
• Backups: Automated daily backups with encrypted offsite storage. Point-in-time recovery supported.
• Monitoring: Continuous security monitoring with automated anomaly detection and alerting.
• Compliance: Our security architecture is designed to align with SOC 2 Type II principles.

4. Data Retention

We retain personal information for as long as necessary to provide the contracted service and comply with legal obligations. Enterprise client data is retained for the duration of the service agreement. Upon contract termination, client data is purged within 90 days unless retention is required by law.

Usage logs and technical data are retained for up to 24 months for security and performance analysis purposes.

5. GDPR and Your Rights

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your personal data where there is no legitimate basis for continued processing.
• Right to data portability: Request transfer of your data in a machine-readable format.
• Right to object: Object to processing of your data for specific purposes, including direct marketing.
• Right to restriction: Request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at privacy@cowyboymanager.com. We will respond within 30 days.

6. Do Not Contact (DNC) Compliance

Cowboy CRM enforces Do Not Contact (DNC) restrictions at the API level. Clients flagged as DNC are excluded from all outbound communication — email, SMS, WhatsApp, and call scheduling — before any communication is dispatched. DNC flags are immutable once set, and all DNC events are recorded in the immutable audit log with timestamp and operator identity.

7. Third-Party Services

Cowboy CRM integrates with the following categories of third-party services:

• Infrastructure: Amazon Web Services (AWS) for hosting, storage, and compute.
• Communications: SMS and email gateway providers configured per enterprise client requirements.
• Analytics: Internal analytics only. We do not use third-party analytics services (Google Analytics, Mixpanel, etc.) in the core CRM platform.

All third-party processors are bound by data processing agreements (DPAs) that require them to maintain appropriate security standards.

8. Cookies

The Cowboy CRM application uses session cookies for authentication and security purposes only. These cookies are essential for system operation and cannot be disabled while using the platform. We do not use tracking cookies, advertising cookies, or third-party analytics cookies in the core CRM application.

The cowyboymanager.com marketing website may use essential cookies for site functionality. No advertising or cross-site tracking cookies are used.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page indicates when the most recent revision was made. Material changes will be communicated to active enterprise clients via email at least 30 days before taking effect.

10. Contact

For privacy-related inquiries, data subject requests, or to report a potential privacy issue:

• Email: privacy@cowyboymanager.com
• Company: GNM Group · cowyboymanager.com · Israel