Coastline
Get started

Privacy Policy

Last updated: September 28, 2026

1. Introduction

This Privacy Policy describes how Coastline CRM LLC (“Coastline,” “we,” “us”) collects, uses, and shares information when you use our CRM at coastlinecrm.com and related subdomains (the “Service”). The Service is a customer relationship management application for sales teams, and includes the Coastline mobile app for iOS and Android, a companion to the web CRM.

This policy covers information we collect through the Service. It does not cover information you separately share with third-party tools you connect to Coastline; those tools have their own privacy policies.

2. Information we collect

Account information

When you create an account, we collect your name, email address, phone number, a hash of your password, and the workspace you create or join. If you pay for a subscription, our payments provider collects and stores your payment details; we receive only a billing summary and a customer identifier.

Customer data

The Service exists to let you manage your own records. Anything you enter or import (contacts, deals, notes, files, calendar events, emails synced from a connected inbox, messages sent through the Service) we treat as your data. We process it on your behalf to operate the Service. You decide what to put in, and you are responsible for having the right to use it under the Terms of Service.

Connected email and calendar accounts

The Service lets you connect a personal or business email and calendar account (for example, a Google or Microsoft account) so you can read, search, send, and organize email and manage your calendar inside Coastline. You connect an account through the provider’s own secure sign-in and consent screen, and you can disconnect it at any time from within the Service, which stops the sync and revokes our access going forward.

When an account is connected, we access it only to provide the features you enabled. What happens to the information depends on whether it relates to your CRM records:

  • Messages tied to a contact or project (an email whose sender or recipient matches a contact in your workspace, or that belongs to a conversation already linked to a project) are stored in your workspace so they appear alongside that record. Emails you send through the Service are also stored.
  • The rest of your mailbox is read live from your email provider each time you view it and is not stored on our servers. We keep only a lightweight index where needed to power features such as new-message notifications.
  • Attachments are stored only for messages tied to a project. For other messages we keep the file’s name and type, not its contents.
  • On-device cache. To load quickly, the Service temporarily caches recently viewed messages and message lists on your own device (in your browser), the same way a desktop or mobile email app does. This cache is tied to your signed-in account and is cleared when you sign out or switch accounts.

Connected Google Business Profile

A workspace can connect the Google Business Profile it manages so its members can read and reply to the business’s Google reviews inside Coastline. When connected, we access the business’s locations and reviews, store the reviews in that workspace so they appear in the Service, and post, edit, or delete replies only when a member of the workspace does so or sets up an automation that does. Disconnecting stops the sync and revokes our access going forward.

Usage and device data

When you use the Service we log information that browsers and servers normally exchange: IP address, browser type and version, operating system, pages viewed, referrer, and timestamps. We use this to run the Service, diagnose errors, and detect abuse.

We use PostHog, a product-analytics service, on our public marketing pages and signup page to understand how visitors use them. It records pages viewed, clicks, how far a page is scrolled, referrer, browser and device type, and approximate location derived from IP address. It does not set cookies or store identifiers on your device.

On those same pages we also use the Meta advertising pixel, so that we can measure whether our ads bring people to the site and show ads to people who have visited it. It sets a cookie on your device and tells Meta that you visited the page. We do not send Meta your name, email address, or anything you type on the page. The pixel does not run in the signed-in Service, and it does not run at all if your browser sends an opt-out signal such as Global Privacy Control, or if you are visiting from the EEA, the UK, or Switzerland, where we do not set it without asking you first. Our Cookie Policy describes the cookie it sets.

Mobile app information

The Coastline mobile app for iOS and Android is a companion to the web CRM and requires a Coastline account. With your permission, the app accesses the following on your device:

  • Camera: to capture project photos and scan documents.
  • Photos and files: to upload photos, set a profile picture, and attach documents.
  • Location, while you are using the app: to show your position and nearby jobs on the map and to fill in the address of a job you create from your current location. We request location only while the app is in the foreground; we do not track your location in the background. When you create a record from a location, the resulting address is saved as part of that record. We may use approximate and precise location.
  • Notifications: to send you job and message alerts. To deliver these we register a push token with Expo’s push notification service.

The app also sends crash reports and basic device and operating-system information to Sentry to help us diagnose errors. We disable collection of personally identifying data in these crash reports. The app does not use advertising identifiers and does not track you across other apps or websites.

3. Cookies

We use cookies for things like keeping you signed in, remembering your display settings, and crediting a referral when you sign up. Our Cookie Policy lists each one. Our marketing and sign-up pages also set an advertising cookie through the Meta pixel described above, subject to the limits stated there. We set no other advertising or analytics cookies, and none anywhere in the signed-in Service.

Most browsers let you block or delete cookies. Blocking the session cookie will prevent the Service from signing you in.

4. How we use information

We use the information described above to:

  • Provide, operate, and maintain the Service.
  • Authenticate you and secure your account.
  • Process payments and send billing notices.
  • Send transactional email: confirmations, password resets, receipts, support replies, service notices.
  • Respond to your support requests.
  • Detect, investigate, and prevent security incidents, fraud, and abuse.
  • Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your Customer Data to train machine-learning models, and we do not let the providers that power our AI features train on it.

AI features

Coastline’s AI features (called Current) help you with your own records: for example, drafting a reply to a Google review, summarizing an email, or answering a question about your workspace. When you use one, or when a feature you turned on uses one for you (for example, sorting incoming email by what it asks for, or an automation you set up to draft review replies), the information needed for that request, which can include data from a connected Google account, is sent to Anthropic through the Vercel AI Gateway to generate the response, and the result is returned to you in the Service. Both are configured with zero data retention: they do not store that information after the response is generated, and they do not use it to train or improve any AI model. When a workspace turns on AI calling, its phone calls are handled by a voice agent from xAI: the call audio, and the details the agent needs for that call (such as the caller’s name or the appointment the call is about), are processed by xAI to hold the conversation. xAI is also configured with zero data retention and does not use it to train any AI model.

Limited use of data from Google and other connected accounts

When you connect a Google account (email, calendar, or Business Profile) or a Microsoft account, we use the information we receive from it only to provide and improve the user-facing features of the Service that you enabled and can see, such as showing your email and calendar next to your records, syncing your reviews, and the AI features described above when you use them on that information. We do not use it for any other purpose. In particular:

  • We do not sell this information, and we do not use it for advertising, marketing, or analytics about you. The analytics and advertising tools described in section 2 run only on our public marketing and sign-up pages and never receive information from a connected account.
  • We do not use it, or anything derived from it, to develop, train, or improve generalized or standalone artificial-intelligence or machine-learning models, and we do not transfer it to any AI provider that would.
  • We do not transfer it to others except as needed to provide the Service to you, to comply with applicable law, or as part of a merger or acquisition with notice to you.
  • We do not allow humans to read it, except with your consent, to investigate a security or abuse issue, to provide support you have requested, to comply with applicable law, or where the information has been aggregated and anonymized.

Coastline’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements. Our use of information from a connected Microsoft account adheres to the applicable Microsoft terms.

5. Text messages we send you

When you create a Coastline account and provide a phone number, you may opt in to receive text messages from us at that number. We send three categories of texts:

  • Account notifications: such as security alerts about your account.
  • Billing notifications: such as failed payments, upcoming renewals, and receipts.
  • Service reminders: such as trial-ending notices and onboarding nudges.

We do not send marketing or promotional texts as part of this program. Consent to receive texts is not required to use Coastline; you may continue with email-only notifications.

Opting in is explicit: at signup or in your account settings, you check a box indicating you agree to receive texts at the number you provided. We also send a one-time code to confirm the number is yours; the verification code itself is sent regardless of whether you opted in to ongoing texts.

You may opt out at any time by replying STOP to any message, or by turning off SMS notifications in your account settings under Notifications. Message and data rates may apply. Message frequency varies.

We retain the timestamp, the phone number, and the exact wording you agreed to as the durable record of your consent, and we retain the timestamp and reason of any opt-out.

Texts a workspace sends to its own customers

The texts described above are messages Coastline sends to you. Separately, a workspace can enable text messaging to reach its own customers from a dedicated number. Those messages are sent by the workspace, not by Coastline, and are governed by that workspace’s own SMS privacy notice and terms, which we host on the workspace’s behalf. If you receive a text from a business that uses Coastline, that business, and not Coastline, is the sender and is responsible for how it obtains your consent and handles your information.

For a workspace that enables this feature, we store, on the workspace’s behalf, the information needed to operate it: the phone numbers the workspace messages, the consent and opt-out records for those numbers, and the history of messages sent and received. We process this information to provide the messaging feature to the workspace, and we do not use it for advertising or to train machine-learning models.

6. How we share information

We share information with service providers who help us run the Service. Each provider is bound by a contract that restricts them to processing information on our behalf. The current list:

  • Supabase: authentication, database, and file storage. United States.
  • Vercel: application hosting and request logging. United States.
  • Stripe: payment processing and billing. United States.
  • Resend: transactional email delivery. United States.
  • Unipile: email and calendar synchronization, used only when a workspace connects an inbox. United States.
  • Anthropic, through the Vercel AI Gateway: generates responses for our AI features when you use them, with zero data retention and no training on your data. United States.
  • xAI: the AI voice agent that answers and places calls, used only when a workspace turns on AI calling, with zero data retention and no training on your data. United States.
  • Twilio: SMS and voice messaging, used to deliver account notifications you've opted into and, when a workspace enables messaging, to send and receive messages with that workspace's contacts. United States.
  • Google Maps Platform: address autocomplete and geocoding for addresses you enter. Global.
  • PostHog: product analytics on our marketing site and signup page. United States.
  • Sentry: crash and error reporting for our mobile app, with personally identifying data disabled. United States.
  • Expo: push notification delivery for our mobile app. United States.

Meta is the exception. The advertising pixel on our marketing and sign-up pages sends Meta the fact that a browser visited one of those pages. Meta is not a service provider in the sense above: it uses that information for its own purposes as well as ours, under its own terms rather than a contract limiting it to processing on our behalf. That difference is exactly why we describe this as a share for targeted advertising in section 9 rather than burying it here, and why it is the one thing on this page you can switch off. It receives nothing you enter into the Service.

We also share information:

  • When you direct us to (for example, when you invite a teammate to your workspace).
  • With our auditors, accountants, and legal counsel, under duties of confidence.
  • To comply with law, a court order, or a valid government request.
  • To investigate or respond to a security incident or violation of our Terms of Service.
  • In connection with a merger, acquisition, or sale of assets; we will notify you if your information becomes subject to a different policy.

7. Data retention

We keep account information and Customer Data for as long as your account and workspace are active.

Account deletion. When you delete your account, we remove your profile and personal data from production systems after a 30-day grace period. This lets us reverse accidental deletions and respond to legal requests.

Workspace cancellation. If a workspace subscription is canceled, Customer Data remains available for reactivation for 90 days, then is purged from production systems.

Backups are encrypted and cycled within 30 days of the corresponding deletion.

Billing records are kept for up to seven years to meet tax and accounting obligations.

8. Security

We use industry-standard measures to protect your information, including TLS encryption in transit, encryption of data at rest, access controls and logging, and least-privilege administration. No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you without undue delay in line with applicable law.

You are responsible for using a strong password, enabling two-factor authentication where available, and keeping your credentials confidential.

9. Your rights

You can:

  • Access and update most account information directly in Settings → Account.
  • Export your Customer Data at any time; workspace owners can generate a full export under Settings → Data.
  • Delete your account from Settings → Account.

You can also email support@coastlinecrm.com to make any of these requests. We verify the email on file before acting on a request.

United States residents

A growing number of states have their own privacy laws, and the rights they grant differ in the details. Rather than work out which of them applies to you, we extend the following to everyone in the United States, whatever state you live in:

  • To know what personal information we hold about you and to get a copy of it.
  • To correct it if it is wrong.
  • To have it deleted.
  • To opt out of targeted advertising.
  • To be told why, if we turn a request down, and to appeal that decision by replying to us.

Targeted advertising.The Meta advertising pixel on our marketing and sign-up pages, described in section 2, tells Meta that a browser visited those pages so we can measure our ads and show ads to people who have visited. Some state laws call this targeted advertising, and some define “sale” broadly enough to include disclosing information for something other than money, which this may fall under. We would rather name it than argue the definitions, so: this is the one thing we do that those provisions are about, and you can turn it off.

How to opt out. Send a Global Privacy Control signal from your browser or an extension, and we honor it automatically everywhere in the United States, not only where a law obliges us to. The pixel does not load and its cookie is never set. You can also email support@coastlinecrm.com. Blocking cookies for our site or using a browser that blocks trackers has the same effect.

What we do not do. We do not sell personal information for money. We do not use anything you enter into the Service, including your Customer Data, for advertising of any kind. We do not use sensitive personal information to target ads. We do not profile anyone in a way that produces legal or similarly significant effects. We do not knowingly process the personal information of anyone under 18 for targeted advertising. Nothing in the signed-in Service is advertised against at all.

You may designate an authorized agent to make a request for you, and we will not treat you differently for exercising any of these rights.

California residents (CCPA/CPRA)

You have everything listed above, plus the rights California words differently. We do not sell personal information. Our use of the Meta advertising pixel is a “share” for cross-context behavioral advertising as California defines that term, and the Global Privacy Control signal is the opt-out. You also have the right to limit the use of sensitive personal information; we do not use it for advertising or for any purpose beyond providing the Service, so there is nothing to limit. We have not sold or shared the personal information of anyone we know to be under 16.

European Economic Area, United Kingdom, and Switzerland residents (GDPR and UK GDPR)

You have the rights of access, rectification, erasure, restriction, portability, and objection. Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you may object. You can lodge a complaint with your local supervisory authority.

Our legal bases for processing are:

  • Performance of a contract with you (to provide the Service).
  • Our legitimate interests in securing, improving, and operating the Service.
  • Compliance with a legal obligation.
  • Your consent, where the law requires it.

10. International transfers

We operate from the United States, and our service providers are primarily based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent Swiss mechanisms to lawfully transfer personal data.

11. Children

The Service is not directed to, and we do not knowingly collect information from, anyone under sixteen. If you believe a child has given us information, contact support@coastlinecrm.com and we will delete it.

12. Changes

We may update this policy from time to time. If a change is material, we will provide notice (for example, by email to account owners or a notice inside the Service) at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

Questions about this policy or requests about your data:

Coastline CRM LLC
support@coastlinecrm.com