SUDSY CRM

PRIVACY POLICY

Effective Date: May 1, 2026
Last Updated: October 1, 2026

Sudsy CRM ("Sudsy CRM," "we," "us," or "our") respects your privacy and is committed to protecting personal information.

This Privacy Policy explains how we collect, use, disclose, retain, protect, and otherwise process personal information when you:

• Visit the Sudsy CRM website;

• Create or use a Sudsy CRM account;

• Subscribe to or use the Sudsy CRM software;

• Contact us;

• Request information, a demonstration, or support;

• Purchase our products or services;

• Interact with our marketing;

• Use forms, landing pages, or other online services operated by us; or

• Otherwise interact with Sudsy CRM.

This Privacy Policy should be read together with the Sudsy CRM Terms of Service and any other applicable notices provided at the time personal information is collected.

1. WHO WE ARE

Sudsy CRM is operated by:

Legal Business Name: Layer One Supplies Inc.
Operating Name: Sudsy CRM
Address: 3165 Walker Rd, Windsor, Ontario N8W3R6
Website: www.sudsycrm.com
Privacy Email: contact@sudsycrm.com

For privacy-related questions, requests, or complaints, you may contact our Privacy Officer:

Privacy Officer: Andrew
Email: contact@sudsycrm.com

We have designated a person responsible for privacy matters within our organization.

2. WHAT IS PERSONAL INFORMATION?

Personal information generally means information about an identifiable individual.

Depending on how you interact with Sudsy CRM, this may include:

• Name;

• Email address;

• Telephone number;

• Mailing address;

• Business contact information;

• Account username;

• Login credentials;

• IP address;

• Device information;

• Browser information;

• Operating system;

• Account activity;

• Subscription information;

• Billing information;

• Transaction information;

• Customer support communications;

• Appointment information;

• Form submissions;

• Notes;

• Marketing preferences;

• Website activity;

• Cookies and similar technologies;

• Information submitted through AI features;

• Information contained in communications;

• Information provided during sales or onboarding; and

• Other information you voluntarily provide.

We generally do not require highly sensitive personal information to use Sudsy CRM.

You should not submit sensitive personal information to Sudsy CRM unless the applicable feature is specifically designed to support it and you have determined that you have a lawful reason to do so.

3. INFORMATION WE COLLECT

We may collect personal information from several sources.

3.1 Information You Provide Directly

You may provide information when you:

• Create an account;

• Purchase a subscription;

• Request a demonstration;

• Contact sales;

• Contact support;

• Complete a form;

• Submit a support ticket;

• Send us an email;

• Communicate with us by telephone or other means;

• Subscribe to marketing communications;

• Participate in a promotion;

• Connect an integration;

• Configure your account;

• Submit feedback;

• Make a payment; or

• Otherwise interact with Sudsy CRM.

4. INFORMATION COLLECTED AUTOMATICALLY

When you visit our website or use our software, certain information may be collected automatically.

This may include:

• IP address;

• Browser type;

• Device type;

• Operating system;

• Screen resolution;

• General geographic information;

• Date and time of access;

• Pages visited;

• Features used;

• Referral information;

• Session information;

• Login activity;

• Error information;

• Security logs;

• Performance information; and

• Other technical information.

We use this information to operate, secure, maintain, troubleshoot, analyze, and improve our Services.

5. INFORMATION FROM THIRD PARTIES

We may receive information from third parties where permitted by law.

This may include information from:

• Payment processors;

• Authentication providers;

• Analytics providers;

• Advertising platforms;

• Integration partners;

• Business partners;

• Referral partners;

• Publicly available sources; and

• Other service providers.

The information we receive depends on the particular service and the permissions or authorization provided.

6. INFORMATION YOU ENTER INTO SUDSY CRM

Sudsy CRM is a customer relationship management and business automation platform.

Our customers may use the Platform to store information about their own customers, prospects, leads, employees, suppliers, and other individuals.

This information may include:

• Names;

• Email addresses;

• Telephone numbers;

• Addresses;

• Appointment information;

• Customer notes;

• Communication history;

• Purchase information;

• Service history;

• Form submissions;

• Website interactions;

• Marketing preferences;

• Review information;

• Vehicle or business information;

• Files and documents;

• Images;

• Other information entered by the customer; and

• Other information generated through the customer's use of the Platform.

7. OUR CUSTOMERS' RESPONSIBILITY FOR CUSTOMER DATA

When a Sudsy CRM customer uploads or enters personal information belonging to its own customers, that Sudsy CRM customer is generally responsible for determining:

• What information it collects;

• Why it collects the information;

• Whether it has authority to collect the information;

• What consent is required;

• How the information may be used;

• Who may receive the information;

• How long the information should be retained; and

• What privacy notices must be provided.

Sudsy CRM processes this information on behalf of the customer as necessary to provide the Services.

For example, if a detailing company uses Sudsy CRM to store its customers' names, telephone numbers, email addresses, appointment history, vehicle information, and communication history, the detailing company is responsible for determining whether it has the legal authority to collect and use that information.

If you are a customer or contact of a business that uses Sudsy CRM, you should generally direct privacy questions regarding information that business entered into Sudsy CRM to that business.

8. WHY WE COLLECT PERSONAL INFORMATION

We may collect and use personal information for the following purposes:

Providing the Services

• Creating and managing accounts;

• Providing CRM functionality;

• Processing subscriptions;

• Providing software features;

• Providing customer support;

• Maintaining account settings;

• Processing transactions;

• Delivering requested services; and

• Managing customer relationships.

Security and Fraud Prevention

• Protecting accounts;

• Detecting unauthorized access;

• Preventing fraud;

• Detecting abuse;

• Investigating security incidents;

• Protecting the Platform; and

• Protecting users and third parties.

Communications

• Responding to inquiries;

• Providing support;

• Sending account notices;

• Sending billing notices;

• Sending security notices;

• Sending service announcements;

• Providing requested information; and

• Sending marketing communications where permitted.

Improvement and Development

• Understanding how customers use our Services;

• Troubleshooting;

• Measuring performance;

• Improving existing features;

• Developing new features;

• Testing functionality;

• Analyzing trends; and

• Improving customer experience.

Legal and Compliance

• Complying with applicable laws;

• Responding to lawful requests;

• Enforcing our agreements;

• Resolving disputes;

• Maintaining required records;

• Protecting our legal rights; and

• Preventing unlawful activity.

We will identify the purposes for which personal information is collected at or before collection where required by applicable law. Canadian privacy guidance emphasizes that organizations should identify purposes clearly and narrowly rather than relying on vague or open-ended descriptions.

9. CONSENT

Where required by applicable law, we obtain consent before collecting, using, or disclosing personal information.

Depending on the circumstances, consent may be:

• Express;

• Implied where legally permitted;

• Provided electronically;

• Provided through account creation;

• Provided through a transaction; or

• Otherwise provided in accordance with applicable law.

We will make reasonable efforts to ensure that individuals understand the purposes for which their personal information will be collected, used, or disclosed.

You may withdraw consent where permitted by law.

Withdrawal of consent may affect our ability to provide certain Services.

Withdrawal of consent does not invalidate processing that occurred before consent was withdrawn.

10. LIMITING COLLECTION

We seek to collect personal information that is reasonably necessary for the purposes identified in this Privacy Policy or otherwise communicated to you.

We do not intentionally collect more personal information than reasonably necessary for the applicable purpose.

If you choose not to provide information that is necessary to provide a particular Service, we may be unable to provide that Service.

11. USE AND DISCLOSURE

We may use or disclose personal information for the purposes described in this Privacy Policy.

We may also use or disclose personal information:

• With your consent;

• Where you have authorized the disclosure;

• To service providers performing services on our behalf;

• To payment processors;

• To hosting providers;

• To telecommunications providers;

• To email providers;

• To AI providers;

• To analytics providers;

• To security providers;

• To integration partners where you have enabled an integration;

• To professional advisors;

• To comply with applicable law;

• In response to lawful legal processes;

• To protect our rights or property;

• To prevent fraud or security threats;

• In connection with a business transaction; or

• Where otherwise permitted or required by law.

We do not sell personal information to third parties for their own independent marketing purposes.

12. SERVICE PROVIDERS

We may use third-party service providers to operate Sudsy CRM.

These providers may include companies that provide:

• Cloud hosting;

• Databases;

• Data storage;

• Backup infrastructure;

• Payment processing;

• Email delivery;

• SMS delivery;

• Voice services;

• Telecommunications;

• Artificial intelligence;

• Analytics;

• Customer support;

• Authentication;

• Security;

• Error monitoring;

• Website hosting;

• Marketing;

• Automation;

• Scheduling; and

• Other technology infrastructure.

Service providers may process personal information on our behalf where necessary to provide their services.

We take reasonable steps to ensure that third-party service providers handling personal information provide appropriate protections.

Canadian privacy guidance recognizes that organizations remain accountable for personal information transferred to third parties for processing and should use contractual or other measures to provide comparable protection.

13. THIRD-PARTY INTEGRATIONS

Sudsy CRM may allow you to connect third-party applications and services.

Examples may include:

• Payment services;

• Email services;

• Calendar services;

• Advertising platforms;

• Social media platforms;

• Analytics services;

• AI services;

• Cloud storage;

• Accounting software;

• Scheduling platforms;

• Communication platforms; and

• Other business applications.

When you enable an integration, information may be transferred between Sudsy CRM and that third-party service as necessary to provide the integration.

Third-party services operate under their own privacy policies.

Sudsy CRM is not responsible for the privacy practices of third-party services that you independently choose to connect to your Account.

14. ARTIFICIAL INTELLIGENCE

Sudsy CRM may provide artificial intelligence features, including AI assistants, AI agents, content generation, summarization, classification, analysis, automated responses, and other AI-powered functionality.

Depending on the feature, information submitted to an AI Feature may be processed by Sudsy CRM and/or third-party AI providers.

Information processed may include:

• Prompts;

• Instructions;

• Customer information;

• Communication history;

• Notes;

• Form submissions;

• Appointment information;

• Business information;

• Uploaded content; and

• Other information submitted to the AI Feature.

AI processing is used to provide the requested functionality.

Sudsy CRM may use third-party AI infrastructure to provide certain AI Features.

We take reasonable steps to use AI providers and configurations appropriate for the Services being provided.

You should review the specific AI Feature before submitting sensitive information.

AI-generated output may be inaccurate or incomplete. Users remain responsible for reviewing AI-generated information before relying upon it.

15. AUTOMATED PROCESSING

Certain Sudsy CRM features may use automated processing, algorithms, or AI to:

• Route leads;

• Categorize information;

• Generate content;

• Summarize conversations;

• Recommend actions;

• Automate communications;

• Trigger workflows;

• Assist with customer service; or

• Perform other business functions.

Where applicable law provides rights concerning automated decision-making, Sudsy CRM will comply with those requirements.

16. EMAIL AND MARKETING COMMUNICATIONS

We may send you transactional and service-related communications.

These may include:

• Account confirmations;

• Password-reset messages;

• Billing notices;

• Security notifications;

• Service announcements;

• Support communications;

• Subscription notices; and

• Other communications necessary to provide the Services.

Where permitted by law, we may also send marketing communications.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided.

Unsubscribing from marketing communications does not necessarily prevent us from sending transactional or service-related communications.

17. SUDSY CRM CUSTOMERS' MARKETING COMMUNICATIONS

Sudsy CRM provides customers with tools for sending email, SMS, telephone calls, voicemail, and other communications.

Sudsy CRM customers are responsible for complying with applicable laws when using these features.

This includes, where applicable:

• Obtaining required consent;

• Maintaining consent records;

• Providing required identification;

• Providing unsubscribe mechanisms;

• Honouring unsubscribe requests;

• Complying with Canada's Anti-Spam Legislation;

• Complying with applicable telecommunications laws; and

• Complying with applicable privacy laws.

Sudsy CRM does not determine whether a customer's particular marketing campaign is lawful.

18. PAYMENT INFORMATION

Subscriptions and other payments may be processed by third-party payment processors.

Where a third-party payment processor processes your payment, Sudsy CRM generally does not receive or store your complete payment-card number.

We may receive information such as:

• Name;

• Billing address;

• Payment status;

• Transaction amount;

• Transaction date;

• Payment method;

• Card brand;

• Last four digits of a card;

• Subscription information; and

• Other transaction information.

Payment processors may collect and process additional information according to their own privacy policies.

19. COOKIES AND SIMILAR TECHNOLOGIES

Sudsy CRM may use cookies, pixels, tags, local storage, session storage, web beacons, and similar technologies.

These technologies may be used to:

• Maintain login sessions;

• Remember preferences;

• Provide functionality;

• Maintain security;

• Analyze website usage;

• Analyze Platform usage;

• Measure marketing;

• Detect fraud;

• Troubleshoot issues; and

• Improve our Services.

Additional information is available in our Cookie Policy.

20. SECURITY

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

These safeguards may include:

• Access controls;

• Authentication;

• User permissions;

• Encryption where appropriate;

• Security monitoring;

• Logging;

• Backups;

• Administrative controls;

• Technical controls; and

• Employee and contractor procedures.

No internet-based system can be guaranteed to be completely secure.

You are responsible for maintaining the security of your Account credentials and controlling access to your Account.

21. PRIVACY INCIDENTS AND DATA BREACHES

If we experience a security incident involving personal information, we will investigate and respond in accordance with applicable law.

Our response may include:

• Containing the incident;

• Investigating what occurred;

• Assessing potential harm;

• Taking corrective measures;

• Notifying affected individuals where required;

• Notifying regulators where required;

• Documenting the incident; and

• Implementing measures intended to prevent recurrence.

22. INTERNATIONAL DATA PROCESSING

Sudsy CRM may use service providers located in Canada, the United States, or other countries.

As a result, personal information may be stored, processed, or accessed outside your province or country of residence.

The laws of those jurisdictions may differ from the laws where you live.

Where applicable law requires specific safeguards, contractual protections, assessments, notice, or consent regarding international transfers, we will take steps required by that law.

23. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:

• Providing Services;

• Maintaining Accounts;

• Providing customer support;

• Processing transactions;

• Complying with legal obligations;

• Resolving disputes;

• Enforcing agreements;

• Preventing fraud;

• Maintaining security;

• Maintaining business records; and

• Protecting legitimate business interests.

Retention periods may vary depending on the type of information and the reason it was collected.

When personal information is no longer required, we may securely delete, destroy, or anonymize it where permitted by law.

24. CUSTOMER ACCOUNT CLOSURE

If you cancel your Sudsy CRM Account, we may retain certain information for a reasonable period.

This may be necessary to:

• Complete the cancellation process;

• Maintain financial records;

• Resolve disputes;

• Prevent fraud;

• Maintain security;

• Comply with legal requirements;

• Enforce agreements; or

• Protect our legitimate interests.

Customer Data may be deleted according to our applicable data-retention practices.

Customers are responsible for exporting information they require before closing their Account.

25. YOUR PRIVACY RIGHTS

Depending on your location and the privacy laws that apply to you, you may have rights including:

• Accessing personal information we hold about you;

• Requesting information about how your personal information is used;

• Requesting information about disclosures;

• Requesting correction of inaccurate information;

• Withdrawing consent where applicable;

• Requesting deletion where legally available;

• Objecting to certain uses;

• Requesting information about our privacy practices; and

• Making a privacy complaint.

Canadian privacy law provides individuals with access rights and the ability to challenge the accuracy and completeness of personal information, subject to applicable exceptions.

26. ACCESS REQUESTS

To request access to your personal information, please contact our Privacy Officer.

Your request should include enough information for us to identify you and understand the information you are requesting.

We may need to verify your identity before providing access.

We may decline or limit access where permitted or required by law.

If we decline a request, we will provide an explanation where required.

27. CORRECTION REQUESTS

If you believe information we hold about you is inaccurate or incomplete, you may request that it be corrected.

We may verify the requested correction before making the change.

Where appropriate, we may also notify relevant third parties of a correction.

28. WITHDRAWING CONSENT

Where processing is based on consent, you may withdraw consent by contacting us, subject to legal or contractual restrictions.

Withdrawal of consent may affect our ability to provide certain Services.

We will explain the consequences of withdrawing consent where appropriate.

29. PRIVACY COMPLAINTS

If you have a concern about how we handle personal information, please contact our Privacy Officer.

We will review and investigate privacy complaints in accordance with our privacy procedures and applicable law.

You may also have the right to complain to the privacy regulator responsible for your jurisdiction.

30. CHILDREN'S PRIVACY

Sudsy CRM is intended primarily for businesses and professional users.

Our Services are not directed toward children.

We do not knowingly collect personal information from children in circumstances where doing so is prohibited by applicable law.

If you believe that a child has provided personal information to us improperly, please contact us.

31. BUSINESS INFORMATION

Certain information relating to businesses may not constitute personal information.

However, information about an identifiable individual remains subject to applicable privacy laws regardless of whether that information is associated with a business.

We will handle personal information according to applicable law.

32. PUBLICLY AVAILABLE INFORMATION

We may collect information that is publicly available where permitted by applicable law.

Public availability does not necessarily mean that information can be used for every purpose.

We will use publicly available personal information in accordance with applicable law.

33. BUSINESS TRANSACTIONS

If Sudsy CRM is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, personal information may be transferred as part of that transaction where permitted by law.

We will take reasonable steps to protect personal information during such transactions.

34. LEGAL DISCLOSURES

We may disclose personal information where reasonably necessary to:

• Comply with applicable law;

• Respond to lawful legal requests;

• Comply with court orders;

• Protect our legal rights;

• Prevent fraud;

• Investigate security incidents;

• Protect users or the public;

• Enforce our Terms of Service;

• Collect amounts owed to us; or

• Respond to emergencies where legally permitted.

35. PRIVACY GOVERNANCE

Sudsy CRM maintains policies and procedures intended to support responsible privacy management.

Our privacy program may include:

• Designating a Privacy Officer;

• Privacy policies;

• Access controls;

• Security procedures;

• Employee and contractor practices;

• Data-retention procedures;

• Incident-response procedures;

• Third-party service-provider controls;

• Privacy reviews;

• Training; and

• Other measures appropriate to our business.

We may review and update our privacy practices as our Services and legal requirements evolve.

Canadian privacy guidance recommends that organizations designate someone responsible for privacy compliance and maintain policies and practices covering personal information handled by the organization and its service providers.

36. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

• Changes to our Services;

• New features;

• Changes to how we process information;

• Changes to service providers;

• Changes in technology;

• Changes in legal requirements; or

• Changes to our business practices.

When changes are material, we may provide notice through:

• Our website;

• The Sudsy CRM Platform;

• Email;

• An account notification; or

• Another reasonable method.

The "Last Updated" date at the beginning of this Privacy Policy will indicate when it was last revised.

Where applicable law requires additional notice or consent, we will provide it.

37. CONTACT US

If you have questions about this Privacy Policy, wish to make an access or correction request, want to withdraw consent, or wish to make a privacy complaint, contact:

Sudsy CRM

Legal Business Name: Layer One Supplies Inc.
Privacy Officer: Andrew St-Pierre
Address: 3165 Walker Rd, Windsor, Ontario, N8W 3R6 Canada
Email: contact@sudsycrm.com
Website: www.sudsycrm.com

We will make reasonable efforts to respond to privacy inquiries and requests within the time required by applicable law.

38. ACKNOWLEDGEMENT

By using the Sudsy CRM website or Services, you acknowledge that you have had an opportunity to review this Privacy Policy.

Where applicable law requires specific consent to a particular collection, use, disclosure, or processing activity, Sudsy CRM will obtain that consent through the applicable process.