Privacy Policy

Fergus CRM Integration (the "App") is operated by FernNola Limited (NZBN 9429053630490) ("we", "us", or "our"), a New Zealand limited liability company.

The App is a software integration that connects your CRM platform accounts with Fergus job management accounts, enabling the secure and automated transfer of data between the two platforms.

Contact details for privacy enquiries:
Email: support@fernnola.com
Website: www.fernnola.com
Registered office: 1222 State Highway 16, RD3, Waimauku, New Zealand

This Privacy Policy describes how we collect, use, handle, store, and protect information when you install and use the Fergus CRM Integration App through the CRM Marketplace.

This policy applies to:

• App users - CRM account holders, including agencies and subaccounts, that install and use the App.
• CRM staff members - CRM users within an installed account whose details are recorded when they access the embedded App page.
• End customers - Individuals whose data (including contact details, job records, and site information) is processed through the App as a result of an App user's activity.

Where you are an end customer, your primary privacy relationship remains with the business controlling your data. This policy explains how we process personal data on that business's behalf.

Under the New Zealand Privacy Act 2020, the UK/EU General Data Protection Regulation (GDPR), and equivalent legislation, our role depends on the context of processing:

• Data Processor - Where we process customer contact, job, or site data on behalf of an App user. In this context, the App user is the Data Controller.
• Data Controller - Where we process information provided directly to us, including account credentials, OAuth tokens, CRM staff user details, and support communications.

4.1 Data Synced Between the CRM and Fergus

The App facilitates the transfer of the following categories of data between the CRM and Fergus:

Data is transferred in near real time as part of the sync operation. To operate the integration and maintain an activity log, we store a subset of this data on our servers, including contact names, opportunity names, pipeline and stage names, and Fergus job numbers. This information is retained as described in Section 7 and is used solely for deduplication, error diagnosis, audit trail, and displaying activity history within the App.

Calendar sync: The App provides bi-directional calendar event mirroring between Fergus and the CRM, with user matching by email address. When inbound sync is first enabled, existing CRM appointments from the past 30 days are backfilled into Fergus.

Note sync: Job and customer notes are synced bidirectionally between Fergus and the CRM, with content-hash tracking to detect edits and prevent duplicates.

4.2 Authentication Tokens

To operate the integration, we store OAuth access tokens and refresh tokens for the CRM, and Fergus credentials (a Personal Access Token or OAuth tokens). These tokens:

• Are necessary to authenticate API requests on your behalf
• Are encrypted at rest using AES‑256 or equivalent
• Are used solely for operating the integration
• CRM OAuth tokens are permanently deleted immediately when you uninstall the App
• Fergus credentials (PAT and OAuth tokens) are permanently deleted 7 days after uninstallation, unless you reinstall within that period

4.3 CRM Staff User Data

When a CRM staff member opens the embedded App page within the CRM, we record:

• Their CRM user ID, name, and email address
• Their CRM role (e.g. admin)
• The date and time they last accessed the App

This information is used to provide a personalised experience within the App and for operational monitoring. It is retained indefinitely and deleted on request.

4.4 Activity Log Data

The App maintains an activity log of events for each installed location, including:

• Job creation events - contact name, opportunity name, Fergus job number, pipeline and stage, action taken
• Quote outcome events - whether a quote or estimate was published, sent, accepted, or rejected, and which pipeline stage the opportunity moved to; job phase events recording when a job is scheduled, work-completed, or invoiced
• Calendar sync events - events created, updated, or deleted between platforms, and user mapping changes
• Note sync events - notes created, updated, or deleted between platforms
• Enquiry lifecycle events - enquiry created, contacted, converted to job, or rejected
• Error and conflict records - error messages and details of any data conflicts encountered

This log is visible to App users within the embedded App and is used to provide transparency about integration activity. Log records are retained indefinitely and deleted on request.

4.5 Technical and Operational Data

We collect limited technical information required to operate and maintain the App, including API response metadata, error diagnostics, and calendar sync run logs (per-run operational metrics used for monitoring). This data does not include full customer records and is retained for a maximum of 90 days.

4.6 Support Communications

If you contact us for support, we process the information you provide (such as name, email address, account details, and issue description) solely to respond to and resolve your enquiry.

We process information only for the purposes outlined below:

We do not:

• Sell or commercially share data
• Use customer data for marketing or profiling
• Train artificial intelligence or machine‑learning models using App data
• Use data for purposes unrelated to operating the integration

The App acts as a conduit between third‑party platforms and relies on the following sub‑processors:

We do not use additional sub‑processors beyond those listed above. Should this change, this policy will be updated accordingly. We are not responsible for the privacy practices of third‑party platforms and encourage users to review their respective policies.

We apply a tiered approach to data removal on uninstallation. CRM OAuth tokens are deleted immediately. Fergus credentials are deleted automatically after a 7‑day grace period, allowing seamless reinstallation without reconfiguration. All other data (integration configuration, activity logs, and staff user data) is retained to support reinstallation and audit requirements, and is permanently deleted on request. To request deletion, contact support@fernnola.com.

We implement appropriate technical and organisational safeguards, including:

• Encryption of OAuth tokens and API credentials at rest (AES‑256 or equivalent)
• Encryption of data in transit (TLS 1.2 or higher)
• Restricted access to infrastructure and systems
• Periodic review of security controls

No system is entirely secure. If you become aware of a security issue, please contact support@fernnola.com immediately.

The App is operated from New Zealand. Application infrastructure is hosted on Vercel Inc. and data is stored in a Railway-hosted PostgreSQL database, both of which may process data in the United States. The CRM and Fergus may also process data in multiple jurisdictions, including the United States and Australia.

• UK / EEA users: Transfers outside the region are safeguarded by standard contractual clauses and recognised compliance certifications.
• New Zealand users: Transfers comply with Information Privacy Principle 12 of the NZ Privacy Act 2020.

New Zealand (Privacy Act 2020)

• Right to access personal information
• Right to request correction
• Right to complain to the Office of the Privacy Commissioner

United Kingdom / European Union (GDPR)

• Right of access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent (where applicable)
• Right to lodge a complaint with a supervisory authority

Requests can be submitted to support@fernnola.com. We respond within 20 working days (NZ) or 30 calendar days (GDPR).

The App is intended for business use and is not directed at individuals under the age of 18. We do not knowingly process children's personal data.

We may update this Privacy Policy from time to time. The "Last updated" date will reflect any changes. Continued use of the App constitutes acceptance of the updated policy.