Privacy policy

Last updated: 17 September 2026

This Privacy Policy explains what data we process in MasterCRM (web panel, Android app and API), for which purposes and on which legal grounds. The service turns your Android phone into an SMS gateway and a source of call history — we are not a telecoms operator and we do not rent numbers.

1. Data controller

The controller of account-holder data (people who create a panel) is MobiPOS, established in Warsaw, Poland. Contact: [email protected].

For contacts, SMS content and call logs that you upload or sync from a phone, you (your organisation) are the controller. MasterCRM processes that data on your behalf to provide the service (GDPR Art. 28).

2. Data we collect

Account data: email, hashed password, name if provided, company name, tax ID, panel subdomain, settings (time zone, default country code).

Devices: paired Android phones (number, device IDs, QR pairing status, SMS permissions).

Communications: SMS content and metadata, delivery statuses, campaigns, templates, conversations, attachments.

Calls: history from the phone (number, direction, type, timestamp). We do not record calls.

Technical data: IP address, server logs, basic usage metrics — for security and operations.

3. Purposes and legal bases

Contract (GDPR Art. 6(1)(b)): account, panel, SMS gateway, call sync, API, auto-responder.
Legitimate interest (Art. 6(1)(f)): security, abuse prevention, aggregated statistics.
Legal obligation (Art. 6(1)(c)): e.g. lawful requests from competent authorities.
Consent (Art. 6(1)(a)): our own marketing, if you give it; you may withdraw it.

You are responsible for the consent of people you message. MasterCRM does not verify whether a person consented — we provide tools (opt-out, consent tags), but the decision and records stay with you.

4. Recipients and transfers

We do not sell data. Recipients may include infrastructure providers in the EU, Google (FCM / optional Google login), Meta (optional Facebook / Instagram login), and public authorities when the law requires it.

Your mobile carrier processes SMS and calls independently under your contract with that carrier.

5. Retention and rights

Account data: until you delete the account, then up to 30 days to finish wiping backups, unless a longer period is required by law. SMS, calls, contacts and campaigns stay until you delete them or the account.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority. For a Polish establishment that is typically the President of the Polish DPA (UODO); if you are in another EEA state you may also contact your local authority (e.g. ICO, IMY, CNIL). Requests: [email protected].

6. Changes

We will publish changes on this page. Material changes may also be emailed to the account address.