The Short Version
We collect only what we need to run fstop for you. We don't sell your data. We don't show you ads. We don't track you across the web. Your business data is yours, and we treat it that way.
If you turn on Inbox sync, fstop reads your Gmail only to find replies from people who are already in your inquiries, and keeps only those. Everything else is discarded the moment it is read. You can turn it off at any time.
Who We Are
Fstop CRM ("fstop", "we", "us", "our") is a client relationship management platform built for photographers and videographers. Our website is fstopcrm.com and our support email is hello@fstopcrm.com.
What Data We Collect
Account Information
When you sign up for fstop, we collect:
- Your name and email address (via Google OAuth sign-in)
- Your Google profile picture (provided by Google during sign-in)
- Your business name (entered during onboarding)
We use Google OAuth for authentication. We do not store your Google password. Google provides us with your name, email, and profile picture when you authorize sign-in.
Business Data You Enter
Everything you create inside fstop is your data. This includes:
- Client and inquiry information (names, emails, phone numbers, event details)
- Contracts and contract templates
- Email templates and sent emails
- Invoices and payment records
- Branding settings (logos, colors, fonts, social links)
- Timelines, tasks, notes, and media files
- Form builder configurations
- Team member information
Inquiry Data From Your Website Visitors
When someone fills out your fstop-connected contact form or embedded form, we receive the data they submit (typically name, email, event date, event type, and message). This data is stored in your fstop account so you can manage your inquiries. We process this data on your behalf — you are the data controller for your clients' information.
Payment Information
Subscription billing is handled by Stripe. When you subscribe, your payment details (credit card number, billing address) are collected and processed directly by Stripe. We do not see or store your full credit card number. We receive from Stripe: your subscription status, billing period, and the last 4 digits of your card for display purposes.
Client Invoice Payments (Stripe Connect)
If you connect your own Stripe account, your clients can pay your invoices by card. These payments are processed directly by Stripe on your connected account. fstop never receives or stores your clients' card numbers, security codes, or bank details — card information is entered on Stripe's secure checkout, not on fstop. From these transactions we store only non-sensitive references: your Stripe account identifier, a Stripe payment identifier, and whether an invoice is paid, so we can show you which invoices have been paid. Your clients' payment data is handled solely by Stripe under Stripe's Privacy Policy. Any identity, business, or bank information you provide when connecting your Stripe account is collected and held by Stripe, not by fstop.
Google Calendar Data
If you connect Google Calendar, we access your calendar events to display them in your fstop dashboard. We request the minimum permissions needed to read and display your calendar. We do not modify your Google Calendar data unless you explicitly create events through fstop.
Gmail Integration
fstop connects to Gmail through Google OAuth. We never see or store your Google password. There are two levels of access, and you choose each one separately.
Sending (default). When you connect Google, fstop requests permission to send email on your behalf (the gmail.send scope). Emails you send from fstop go out from your own Gmail account. This permission cannot read your mail.
Inbox sync (optional). If you turn on Inbox sync in Settings, fstop asks for read access to your Gmail (the gmail.readonly scope) so that replies from your clients appear on their inquiry inside fstop. Here is exactly what happens with that access:
- What we look at. When new mail arrives in your inbox, or you send an email from Gmail, fstop checks the sender, the recipients and the conversation thread against the people already in your fstop inquiries. When you first turn Inbox sync on, or start a conversation with someone in fstop, it also searches your last 90 days of mail to and from those same people.
- What we keep. Only messages to or from someone in your inquiries: the sender, recipients, subject, date, the message itself, the names and sizes of any attachments, and Gmail thread identifiers. These are stored in your fstop account so you can read and reply to them there. Attachment files themselves are not copied; when you open one, fstop fetches it from Gmail for you at that moment.
- What we discard. Any message that does not match one of your inquiries is discarded immediately after the check. It is never stored, logged, or shown to anyone.
- What we never do. We do not read your mail for advertising, we do not sell or share it, we do not use it to build profiles, and we do not use it to train artificial intelligence or machine learning models. No fstop employee reads your messages unless you ask us to help with a specific problem and give us permission to look.
- Turning it off. Switch Inbox sync off in Settings and fstop stops reading your mail at once. Messages already stored on your inquiries stay in your account until you delete the inquiry or ask us to remove them. You can also revoke fstop's access entirely from your Google Account permissions page.
AI features. Some fstop features can summarize a client conversation or draft a reply for you to edit. When you use one of these, the relevant conversation is sent to our AI provider, Anthropic, to generate that result. Anthropic processes it to produce the response and does not use it to train models. We do not run these features unless you ask for them.
Google's requirements. fstop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Usage Data
We collect basic usage data to keep the service running and improve it:
- Pages visited within the app
- Browser type and device type
- General location (country/region level, not precise location)
- Error logs when something breaks
Advertising and Analytics
We advertise fstop, and we measure which ads bring people to us. To do that, our marketing website and our login and signup screens use Google Analytics, Google Ads, the Meta (Facebook and Instagram) pixel, and the TikTok pixel, loaded through Google Tag Manager. These tools see which pages you visit on our website, the device and browser you use, and whether you signed up or started a subscription.
When a subscription starts, our servers also tell Meta and TikTok that a signup converted, so the ad that brought you can be credited. That message contains the event name, the plan value, a scrambled (hashed) email address, and, for Meta, the Meta cookie identifiers already set in your browser. Nothing else.
These tools are never loaded inside the fstop app after you sign in. The screens that show your clients, inquiries, contracts, galleries and email do not carry any advertising or analytics tag. None of your business data, your clients' data, or any data from Google APIs such as Gmail or Google Calendar is ever shared with an advertising or analytics provider.
How We Use Your Data
We use your data to:
- Provide and operate the fstop platform
- Authenticate your account via Google OAuth
- Process your subscription payments via Stripe
- Send emails on your behalf via your connected Gmail
- Show your clients' email replies on their inquiry, if you turn on Inbox sync
- Summarize a conversation or draft a reply, when you ask an AI feature to
- Display your Google Calendar events in your dashboard
- Send you account-related emails (billing confirmations, important updates)
- Respond to your support requests
- Fix bugs and improve the platform
We do not use your data to:
- Sell to third parties
- Show you advertisements
- Build advertising profiles
- Train AI models on your business data or your email
- Send you marketing emails without your consent
Where Your Data Is Stored
Your data is stored on Supabase, which runs on Amazon Web Services (AWS) infrastructure. Supabase provides database hosting, authentication services, file storage, and edge functions. Data is stored in secure, encrypted databases. Supabase's infrastructure is SOC 2 Type II compliant.
Media files you upload (logos, photos) are stored in Supabase Storage with access controls so only you and your authorized team members can access them.
Third-Party Services
Fstop uses the following third-party services to operate. Each processes data only as needed for their specific function:
- Supabase — Database, authentication, file storage, and serverless functions
- Google OAuth — Account sign-in and authentication
- Google Calendar API — Calendar sync (only if you connect it)
- Gmail API — Sending emails on your behalf, and reading client replies if you turn on Inbox sync (only if you connect it)
- Anthropic — Generates summaries and reply drafts when you use an AI feature; does not train on your data
- Stripe — Subscription billing, and client payments if you connect Stripe
- Square — Client payments, only if you connect Square
- Brevo — Delivers emails when Gmail is not connected, and our own account and newsletter emails
- Cloudflare — Gallery photo storage and delivery, and receiving inquiry emails sent to your fstop address
- Vercel — Website and application hosting
- Google Analytics, Google Ads, Meta, TikTok — Measuring our own advertising, on our marketing website and signup screens only (see Advertising and Analytics above)
We do not share your data with any service not listed above. We do not use data brokers, and we never share your account data, your clients' data, or any Google user data with advertising or analytics providers.
Data Security
We take the security of your data seriously:
- All data is transmitted over HTTPS (TLS encryption in transit)
- Database data is encrypted at rest
- Authentication is handled via Google OAuth (we never handle your password)
- Row-level security policies ensure you can only access your own data
- API keys and secrets are stored in environment variables, never in code
- OAuth tokens for Google services are stored securely and scoped to minimum required permissions
Your Rights
You have the right to:
- Access your data — Everything you've entered is visible in your fstop account at all times
- Export your data — You can export your data while your account is active
- Delete your data — You can request deletion of your account and all associated data by emailing hello@fstopcrm.com
- Disconnect integrations — You can turn off Inbox sync or disconnect Google in fstop Settings, or revoke fstop's access at any time from your Google Account permissions
- Delete synced email — Email hello@fstopcrm.com and we will remove every message Inbox sync stored for your account within 7 business days
Data Retention
Your data is retained as long as your account is active. If you cancel your subscription:
- You retain access until the end of your billing period
- After your access expires, your data is kept for 30 days in case you resubscribe
- After 30 days, your data is permanently deleted from our systems
If you request immediate deletion, we will process it within 7 business days.
Gmail data specifically: Google OAuth tokens are deleted the moment you disconnect Google or delete your account. Messages stored by Inbox sync are deleted with the inquiry they belong to, when you delete your account, or on request.
Cookies
Inside the fstop app, we use only the storage needed for the platform to work:
- Authentication — To keep you logged in to your account
- Session and preferences — To remember your session and settings
On our marketing website and on the login and signup screens, Google, Meta and TikTok set their own cookies to measure our advertising, as described in Advertising and Analytics above. You can block these with your browser's privacy settings or an ad blocker without affecting how fstop works.
Children's Privacy
Fstop is a business tool designed for professional photographers and videographers. It is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.
Changes to This Policy
If we make significant changes to this privacy policy, we will notify you by email and update the "Last updated" date at the top of this page. Minor clarifications or formatting changes may be made without notification.
Contact
If you have questions about this privacy policy or how we handle your data, email us at hello@fstopcrm.com.