Privacy policy

Who we are

MagpieCRM is run by Mr PNA Greenall, trading as MagpieCRM, of 35a Highbury Corner, London N5 1RA ("we", "us"). For the personal data described below, we are the controller. Contact us about anything on this page at pele@magpiecrm.com.

When our customers use MagpieCRM Cloud to hold contacts, find prospects and send email, they decide what happens to that data and we process it for them, under our data processing agreement. Their own privacy notices cover that. What we do for them is described under "People in our customers' workspaces" below.

Visiting our website

• We use PostHog, a web analytics service, to see how people use magpiecrm.com so we can improve it. PostHog holds this data for us in its EU cloud, in Frankfurt. We also use Google Ads' tag to measure how well our Google ads work: whether a visit came from one of our ads, and whether that visitor then went on to sign up.
• Until you choose, and if you decline, PostHog counts your visit without cookies: nothing is stored on your device. Visits are counted with a privacy-preserving hash that PostHog calculates on its servers from technical details your browser sends. We see which pages were viewed, what was clicked and where visitors came from, not who you are. Google's tag also runs without cookies: it sends Google cookieless measurement pings (the page, the time, and technical details your browser sends, such as its IP address), which Google uses to count ad clicks and model conversions without recognising you. Our lawful basis is legitimate interests: understanding and improving our website and our advertising.
• If you accept, PostHog also sets a cookie and uses your browser's storage to recognise your browser across pages and visits, and records a replay of your visit (the pages you see, and where you move and click), with anything you type into a form hidden. Google's tag also sets advertising cookies (such as _gcl_au, kept for up to 90 days) so a visit from one of our ads can be linked to a later sign-up, including on app.magpiecrm.com, and Google may use this for ad measurement and personalisation. Our lawful basis for this is your consent. You can change your mind at any time with "Cookie settings" at the bottom of every page; declining again removes these cookies.
• Your browser also remembers your cookie choice, your light or dark theme, and the last workspace name you signed in to, in its own storage. Your cookie choice is also kept in a small cookie (magpie_consent, for up to a year) that app.magpiecrm.com can read, so signing up there respects the same choice. The theme and workspace name aren't sent to us.
• Our website is hosted by Cloudflare, which keeps short-lived technical logs (such as IP addresses) to deliver and protect it.
• Our pages load fonts from Google Fonts, so your browser's IP address is sent to Google when they load.

Using MagpieCRM Cloud

People in our customers' workspaces

MagpieCRM customers use prospect search to find people at businesses: name, job title, seniority, company, country and professional profile address. We find these details with a crawler and web search we run ourselves, from:

• Search engines. We search Google and DuckDuckGo for public LinkedIn profiles that match what a customer is looking for, such as a job title in a country, and read the name, job title, employer and location shown in the results. We also search DuckDuckGo for companies: their websites, their LinkedIn company pages, and signs that they're hiring or have raised funding.
• LinkedIn's public pages. We read public profile and company pages directly, the ones anyone can open without signing in, to confirm a person's current job and find out about their employer. Company search answers from an index of companies we build from those company pages. We don't use a LinkedIn account, so we only see what a person or company has made public.
• Company websites. When a customer looks for the founder, owner, chief executive or similar of companies of up to 50 people, we read the company's own website (its home, about, team and contact pages, where its robots.txt rules allow) for the name and role it gives. Someone found this way has no profile address, and is never added to the shared database described below.

Until November 2026 we also got prospect data from SocialFetch, a third-party data source that draws on public professional profiles. We no longer use it for MagpieCRM Cloud, but details found through it can still be in customers' workspaces and in the shared database described below.

NodeMaven carries our searches for people and our reads of LinkedIn's public pages (see "Who we share data with"), without being told which customer they're for. Customers can then find and check a work email address. When a company's mail server accepts every address, so no address there can be checked, the Service may instead work out the likely address from the format other addresses at that company follow (such as first.last), using addresses the customer already holds there. Such an address is marked as unconfirmed, and is only used if the customer chooses to. Each customer is the controller of the people they find and contact, and must have a lawful basis and tell you where they got your details. We process that data for them and don't use it for anything else, apart from the shared database described below. Search results themselves aren't saved to disk: they're held only in server memory, briefly, so the same person or page isn't paid for twice (see "How long we keep it").

Shared database of business contacts. We keep a database of business contacts that MagpieCRM Cloud customers found through prospect search and saved with a verified work email address, so the next customer looking for the same person doesn't have their details looked up and checked again. We are the controller of this database. It holds a person's name, job title, employer and its website domain, country, professional profile address and verified work email address, and nothing else. The details came from the person's public professional profile, read directly or in search results, or, for some people added before November 2026, through SocialFetch, the data supplier we used then. The email address was confirmed with their employer's mail server without an email being sent. Our lawful basis is legitimate interests: letting businesses reach the right person at a company about things relevant to their job, without the same details being collected over and over. We email each person a notice before anyone can be shown them, and nobody is shown them until a day after it was sent. A record whose notice bounces, or can't be sent within 21 days, is deleted. People in the database are shown only to MagpieCRM Cloud customers, through prospect search, who may use the details only to contact the person about business matters and must stop when asked. The database is stored on our servers in Germany, with names, email addresses and profile addresses encrypted. Every notice has a link that removes you in one click, and another that shows what we hold and lets you correct it; you can also email pele@magpiecrm.com. Removing yourself deletes the record and adds you to the suppression list described below, so no customer is shown you again. The rules our customers agree to are in the Contributor Terms.

Company email formats. To make the addresses our customers use more accurate, so fewer emails reach the wrong person or bounce, we keep two kinds of company-level information and share them between customers' workspaces: whether a company's mail server accepts every address, and the format its addresses follow (such as first.last). A workspace works a format out from addresses the customer already holds at that company, and sends us only the format and a count of matching addresses, never names or addresses. We only share a format for companies of 10 or more people, once at least three addresses from at least two customers back it, so it can't be linked to any one person. We are the controller for this, and our lawful basis is legitimate interests. You can object at pele@magpiecrm.com.

If you don't want to be found or contacted through MagpieCRM, email pele@magpiecrm.com. We'll add you to the suppression list in every MagpieCRM Cloud workspace, so you won't be shown, revealed or saved from prospect search again, and any saved contact that matches you is deleted. The list holds only one-way keyed hashes of what you give us, so we can recognise you without storing your details. You can also unsubscribe from any customer's email with the link in it, and ask that customer directly for access to, or deletion of, your data.

Who we share data with

We use these providers to run MagpieCRM, each under a contract that protects your data, apart from NodeMaven (below):

• Contabo (Germany): our servers, and their daily backups.
• OVH (UK, London): our mail server, which sends email, and the servers email verification connects from.
• Kinde (UK data region; the company is in Australia): sign-in.
• Stripe: payments.
• Cloudflare: our website, DNS and email forwarding.
• PostHog (EU cloud, Frankfurt; the company is in the United States): website analytics.
• Google (Google Ireland; Google LLC in the United States): measuring our Google ads on our website. For ad measurement, Google acts as an independent controller; see how Google uses information from sites that use its services.
• NodeMaven (NodeMaven FZ-LLC, United Arab Emirates): a hosted browser that runs our Google and DuckDuckGo searches for people, and the proxy that carries all our requests for LinkedIn's public pages. It has no data processing agreement with us yet; we're arranging one.
• Zoho (EU): our own email.

The full list for customer data, with locations and safeguards, is on our sub-processor list. We don't sell personal data, and we'll only share it otherwise when the law requires us to.

International transfers

Most of our providers keep data in the UK or EU. Where data goes elsewhere, such as to Stripe, Cloudflare or Google in the United States, or to Kinde's support team in Australia, it's protected by an adequacy decision, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. Our analytics data stays in PostHog's EU cloud; any access to it by PostHog from the United States is covered by the same safeguards.

NodeMaven, in the United Arab Emirates, is the exception: it publishes no transfer safeguard, so what it sees isn't covered by one yet. We're arranging one with it, and will update this page when we have it.

How long we keep it

• Your account details: while you're a customer, and for up to 12 months afterwards in case you come back.
• Billing records: 6 years after the end of the tax year they relate to, as UK law requires.
• Your workspace's data: deleted within 30 days after your subscription ends, and from backups within 10 days after that.
• Technical logs: only as long as they're needed for security, normally no more than 90 days.
• Analytics: events for 12 months, and session replays for 30 days.
• Google's advertising cookies: up to 90 days on your device; Google keeps its ad measurement data under its own retention rules.
• Prospect search results: never saved to disk by us. In a customer's workspace, a person's profile details for up to 24 hours, and the rest of a search's results not yet shown for up to an hour, in server memory only. On our own servers, a page of web search results for up to 24 hours, and a search's results until 30 minutes after it was last asked for, also in memory only.
• LinkedIn profiles that turned us away: a keyed hash of the profile address, not the address itself, for up to 30 days, so we don't keep asking for them.
• People in our shared database of business contacts: until 12 months after their email address was last verified, or until they ask to be removed, whichever comes first.
• Opt-out hashes: kept indefinitely, so your choice lasts.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to move it to another service. Email pele@magpiecrm.com; we'll reply within a month. If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority.

Changes

If we change this policy in a way that matters, we'll tell customers by email before it takes effect. The date at the top shows when it last changed.