Privacy Policy

Fergus CRM Integration (the "App") is operated by FernNola Limited (NZBN 9429053630490) ("we", "us", or "our"), a New Zealand limited liability company.

The App is a software integration that connects your CRM platform accounts with Fergus job management accounts, enabling the secure and automated transfer of data between the two platforms.

Contact details for privacy enquiries:
Email: support@fernnola.com
Website: www.fernnola.com
Registered office: 1222 State Highway 16, RD3, Waimauku, New Zealand

This Privacy Policy describes how we collect, use, handle, store, and protect information when you install and use the Fergus CRM Integration App through the CRM Marketplace.

This policy applies to:

• App users - CRM account holders, including agencies and subaccounts, that install and use the App.
• CRM staff members - CRM users within an installed account whose details are recorded when they access the embedded App page.
• End customers - Individuals whose data (including contact details, job records, and site information) is processed through the App as a result of an App user's activity.

Where you are an end customer, your primary privacy relationship remains with the business controlling your data. This policy explains how we process personal data on that business's behalf.

Under the New Zealand Privacy Act 2020, the UK/EU General Data Protection Regulation (GDPR), and equivalent legislation, our role depends on the context of processing:

• Data Processor - Where we process customer contact, job, or site data on behalf of an App user. In this context, the App user is the Data Controller.
• Data Controller - Where we process information provided directly to us, including account credentials, OAuth tokens, CRM staff user details, and support communications.

4.1 Data Synced Between the CRM and Fergus

The App facilitates the transfer of the following categories of data between the CRM and Fergus:

Data is transferred in near real time as part of the sync operation. To operate the integration and maintain an activity log, we store a subset of this data on our servers, including contact names, opportunity names, pipeline and stage names, Fergus job numbers, and custom field mapping configuration. This information is retained as described in Section 7 and is used solely for deduplication, error diagnosis, audit trail, and displaying activity history within the App.

Calendar sync: The App provides bi-directional calendar event mirroring between Fergus and the CRM, with user matching by email address. When inbound sync is first enabled, existing CRM appointments from the past 30 days are backfilled into Fergus.

Note sync: Job and customer notes are synced bidirectionally between Fergus and the CRM, with content-hash tracking to detect edits and prevent duplicates.

4.2 Authentication Tokens

To operate the integration, we store OAuth access tokens and refresh tokens for the CRM, and Fergus credentials (a Personal Access Token or OAuth tokens). These tokens:

• Are necessary to authenticate API requests on your behalf
• Are encrypted at rest using AES‑256 or equivalent
• Are used solely for operating the integration
• CRM OAuth tokens are permanently deleted immediately when you uninstall the App
• Fergus credentials (PAT and OAuth tokens) are permanently deleted 7 days after uninstallation, unless you reinstall within that period

4.3 CRM Staff User Data

When a CRM staff member opens the embedded App page within the CRM, we record:

• Their CRM user ID, name, and email address
• Their CRM role (e.g. admin)
• The date and time they last accessed the App

This information is used to provide a personalised experience within the App and for operational monitoring. It is retained indefinitely and deleted on request.

4.4 Activity Log Data

The App maintains an activity log of events for each installed location, including:

• Job creation events - contact name, opportunity name, Fergus job number, pipeline and stage, action taken
• Quote outcome events - whether a quote or estimate was published, sent, accepted, or rejected, and which pipeline stage the opportunity moved to; job phase events recording when a job is scheduled, work-completed, or invoiced
• Calendar sync events - events created, updated, or deleted between platforms, and user mapping changes
• Note sync events - notes created, updated, or deleted between platforms
• Enquiry lifecycle events - enquiry created, contacted, converted to job, or rejected
• Customer sync events - new CRM contacts discovered from Fergus customers, and contact detail updates synced between platforms
• Error and conflict records - error messages and details of any data conflicts encountered

This log is visible to App users within the embedded App and is used to provide transparency about integration activity. Log records are retained indefinitely and deleted on request.

4.5 Technical and Operational Data

We collect limited technical information required to operate and maintain the App, including API response metadata, error diagnostics, and calendar sync run logs (per-run operational metrics used for monitoring). This data does not include full customer records and is retained for a maximum of 30 days.

4.6 Support Communications

If you contact us for support, we process the information you provide (such as name, email address, account details, and issue description) solely to respond to and resolve your enquiry.

We process information only for the purposes outlined below:

We do not:

• Sell or commercially share data
• Use customer data for marketing or profiling
• Send customer data to AI or machine-learning providers (see /legal/subprocessors)
• Use data for purposes unrelated to operating the integration

The App acts as a conduit between third‑party platforms and relies on third-party infrastructure providers. A current list of sub-processors is maintained at /legal/subprocessors.

We are not responsible for the privacy practices of third‑party platforms and encourage users to review their respective policies.

When you uninstall the App, we delete your CRM OAuth tokens immediately. Your Fergus credentials are deleted automatically after a 7-day grace period, so you can reinstall without reconnecting. Contact names in activity log entries are redacted after 30 days; the log entries themselves are kept. All other data (integration configuration, activity logs, opportunity names, and staff user data) is kept to support reinstallation and audit, and is permanently deleted on request. We complete deletion requests within 7 business days. Deleted data may persist in encrypted database backups for up to 21 days after deletion from the live database. To request deletion, contact support@fernnola.com.

We implement appropriate technical and organisational safeguards, including:

• Encryption of OAuth tokens and API credentials at rest (AES‑256 or equivalent)
• Encryption of data in transit (TLS 1.2 or higher)
• Restricted access to infrastructure and systems
• Periodic review of security controls

No system is entirely secure. If you become aware of a security issue, please contact support@fernnola.com immediately.

The App is operated from New Zealand. Application infrastructure is hosted on Vercel Inc. in Singapore and data is stored in a Railway-hosted PostgreSQL database in Singapore. The CRM and Fergus may also process data in multiple jurisdictions, including the United States and Australia.

• UK / EEA users: Transfers outside the region are safeguarded by standard contractual clauses and recognised compliance certifications.
• New Zealand users: Transfers comply with Information Privacy Principle 12 of the NZ Privacy Act 2020.

New Zealand (Privacy Act 2020)

• Right to access personal information
• Right to request correction
• Right to complain to the Office of the Privacy Commissioner

United Kingdom / European Union (GDPR)

• Right of access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent (where applicable)
• Right to lodge a complaint with a supervisory authority

Requests can be submitted to support@fernnola.com. We respond within 20 working days (NZ) or 30 calendar days (GDPR).

The App is intended for business use and is not directed at individuals under the age of 18. We do not knowingly process children's personal data.

We may update this Privacy Policy from time to time. The "Last updated" date will reflect any changes. Continued use of the App constitutes acceptance of the updated policy.