CRM Bunker — Privacy Policy

Last updated: 21 October 2026

CRM Bunker is operated by Cyber Shark Labs Pty Ltd (ACN 701 604 560, ABN 55 701 604 560).

1. Who this policy covers

This policy applies to two different groups of people, and CRM Bunker's role is different for each:

Our Customers. If you have signed up for a CRM Bunker account (as a business owner, admin, or team member using the platform), you are a "Customer" for the purposes of this policy. This section of the policy is about you directly.

Contacts. If a CRM Bunker Customer has entered your details into their CRM Bunker account (for example, because you're a lead, client, or contact of that business), you are a "Contact". You have not signed up for CRM Bunker yourself, and CRM Bunker does not have a direct relationship with you. In this situation, CRM Bunker acts as a service provider on behalf of our Customer, who remains responsible for how they collected your information and their own legal basis for holding it. Any request about your data as a Contact should generally be directed to the business that holds it (our Customer), not to CRM Bunker directly — though we will assist our Customer in responding to any such request where needed.

2. Information we collect

About our Customers (the business and its team)

• Account details: company name, your name, username, email address, and a securely hashed password (we never store your actual password in readable form)
• Team member details for anyone your business invites: name, username, email, role
• Optional: a 4–6 digit quick-access PIN, if you choose to set one up for faster login on a trusted device
• Optional: your own email account credentials (e.g. a Gmail App Password), if you choose to connect your email for sending messages directly from CRM Bunker — this is stored per person, not shared across your team
• Usage and session information: login times, session activity, and IP-based information used for security purposes such as rate-limiting and account lockout protection

About Contacts (your leads, clients, or contacts you store in CRM Bunker)

• Whatever information our Customer chooses to enter: typically name, email, phone number, address, notes, custom fields, and any files or photos attached to that contact's record
• Call logs: if a Customer uses CRM Bunker's call-logging features, the date, time, and outcome of calls are recorded against that Contact's record
• Task and communication history: notes, tasks, and any emails sent to the Contact through CRM Bunker are logged against their record
• If a Contact submits a form connected to CRM Bunker's lead capture feature (e.g. a website enquiry form, or a Facebook/Instagram Lead Ad connected via Zapier), the information submitted through that form is automatically added as a new Contact record

3. How we use this information

• To provide the CRM Bunker service itself — letting our Customers manage their own contacts, tasks, and team
• To secure accounts — password hashing, login lockout after repeated failed attempts, and session management
• To send task reminder emails and account-related notifications to our Customers
• To provide customer support
• We do not sell any information — Customer or Contact — to third parties, and we do not use Contact information for our own marketing purposes

4. Who we share information with

CRM Bunker doesn't sell data, but a small number of service providers are involved in actually running the platform. Each is listed here with what they can access:

• Hosting provider (Servers Australia, Sydney, Australia): hosts the server the application and its data run on
• Backup storage (Wasabi, Sydney, Australia): receives encrypted, automated backups of the application's data. Backups are encrypted before they leave our server
• Email delivery: account-related and task-reminder emails are sent through Microsoft 365. Where a Customer connects their own email account (for example Gmail or Microsoft 365), emails they compose within CRM Bunker are sent through that provider
• Payments (Stripe): if your business subscribes to a paid plan, payment and billing details are collected and processed by Stripe, our payment provider. We don't store full card numbers on our own systems
• AI Assistant (Anthropic), only if this feature is turned on for your account: if you use the in-app AI help assistant, your message is sent to Anthropic's API to generate a response. This only happens when you actively use that specific feature — it is not connected to your CRM data by default, and this feature may not be enabled on your account
• Zapier and connected third-party services (e.g. Facebook/Instagram Lead Ads, Typeform), only if a Customer chooses to set up lead capture integrations: these are configured directly by the Customer, and the third-party service the Customer connects will also have its own privacy policy governing that connection
• Xero, MYOB, or similar accounting/quoting tools, only if a Customer chooses to connect one: information is sent only when the Customer explicitly triggers it (e.g. clicking "Send to quote tool" on a Contact)
• ServiceM8, only if a Customer chooses to connect their account
• We may also disclose information if required to do so by Australian law, or to protect the rights, property, or safety of CRM Bunker, our Customers, or others

Some of our service providers, including our backup storage provider, are headquartered outside Australia even though the specific infrastructure we use for your data is located in Australia. This means they may, in some circumstances, be subject to a foreign government's legal process (for example, under United States law) in a way that's outside our direct control. We choose providers with a genuine Australian-region presence specifically to reduce this exposure. Australian-region storage does not itself prevent these requirements or remove our obligations under Australian law. We will assess any demand received by us, limit any disclosure we make to what is lawfully required, and notify affected Customers unless legally prohibited.

5. Where information is stored

The primary CRM Bunker database and uploaded files are stored on servers physically located in Sydney, Australia, on infrastructure owned and operated by an Australian company. Backups are also stored in Sydney, Australia. Email delivery, payment processing and optional AI or integration services described in Section 4 may involve processing outside Australia. Australian hosting does not mean all service-related information is processed only in Australia.

6. How we protect information

• All traffic to and from CRM Bunker is encrypted in transit (HTTPS/TLS)
• Passwords are never stored in readable form — only a securely hashed version
• Backups are encrypted before leaving our server, and stored in a way that prevents them being deleted or altered for a fixed retention period, even if an administrator account were compromised
• Server access is restricted to authorised personnel using cryptographic key-based authentication, and the server receives automatic security updates
• Each Customer's data is kept logically separate from every other Customer's data within the application
• A small number of our own authorised staff can access Customer account data directly within the application itself — separate from the server-level access described above — for purposes such as providing support you've asked for, investigating a technical issue or suspected misuse of the platform, billing, or where we're required to by law. This access isn't used to look through accounts without one of those reasons.

No system can be guaranteed 100% secure, and we cannot promise information will never be accessed, disclosed, altered, or destroyed in a way inconsistent with this policy — but the measures above reflect our genuine current practice, not aspirational claims.

7. How long we keep information

If you cancel your subscription, your data isn't deleted immediately — you can reactivate at any time within 180 days (about 6 months) of cancelling, and everything will be exactly as you left it, except for automatic deletions under Section 6 or at your request. You'll receive an email reminder 30 days before that 180-day period ends. After 180 days without reactivation, your account's data — records, tasks, uploaded files, and team member accounts — is permanently deleted and cannot be recovered. A minimal record that your business was once a customer (name and dates only, no actual content) is kept for our own internal accounting.

Records of our own staff's access to your account — who, what action, when, and why, but never your contacts or content — are kept for 2 years from the date of each entry, including after your account is deleted, so that access can always be accounted for. They are then permanently deleted.

Backup copies of deleted data may also persist for a short additional period — currently up to 60 days — on our backup storage provider's systems after deletion from live systems. These backups are used only for disaster recovery, are encrypted and protected against tampering, and are automatically removed once that 60-day window passes.

8. Your rights

If you are a Customer, you can access, correct, or delete most of your own information directly within CRM Bunker at any time. For anything you can't change yourself, contact us using the details below. You may also request correction directly from us under applicable law.

If you are a Contact, please contact the business that holds your information directly (they are shown to you as the organisation you're dealing with) — they are best placed to action your request. If you're not sure who that is, contact us and we'll help direct your request.

9. Cookies and similar technology

CRM Bunker uses a single essential session cookie to keep you logged in securely. This cookie is required for the application to function and cannot be turned off while remaining logged in. We do not use tracking or advertising cookies.

10. Children's privacy

CRM Bunker is a business tool and is not directed at or intended for use by children.

11. Changes to this policy

If this policy changes in a way that reduces your rights, we will seek your consent or give notice as applicable law requires. Otherwise, an updated version will be published with a new date, and continued use of CRM Bunker after a change means you accept the updated policy.

12. Contact us

Privacy-related questions and requests can be sent to [email protected]. If you make a request under this policy, we will respond within 30 days, or explain any delay.

Cyber Shark Labs Pty Ltd (ACN 701 604 560, ABN 55 701 604 560), trading as CRM Bunker · PO Box 599, Cottesloe WA 6911 · [email protected]