Last Updated: 3/31/2026
Effective Date: 3/31/2026

---

Introduction

Core365 ERP ("Core365," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our software-as-a-service platform and related services (collectively, the "Service").

Core365 provides business management software to business customers ("Clients"). This Privacy Policy applies to:

• Information we collect from our Clients and their authorized users
• Information we collect from visitors to our website
• Information processed on behalf of our Clients

Important: If you are an end user or customer of one of our Clients' businesses, please contact that business directly for information about how they handle your personal information.

Core365 processes such information as a service provider on behalf of our Clients.

---

1. Information We Collect

1.1 Information You Provide Directly
Account Information:

• Business name, address, and contact information
• Names and email addresses of authorized users
• Billing information (processed by our payment providers)
• Phone numbers for account administration

Client Data:

• Data you or your authorized users upload to the Service
• Customer records, transaction data, and business information you manage through the Service
• Communications sent through the Service (including SMS and email campaigns)

Communications:

• Inquiries and correspondence through our contact forms
• Support requests and feedback

1.2 Information Collected Automatically
Usage Data:

• Log data (IP addresses, browser type, operating system)
• Pages viewed, features used, and actions taken within the Service
• Date and time of access
• Device identifiers

Cookies and Tracking Technologies:

• Session cookies for authentication and security
• Analytics cookies to understand Service usage
• Preference cookies to remember your settings

For more information about cookies, see Section 8 below.

1.3 Information from Third-Party Integrations

If you connect third-party services to Core365 (such as Google Workspace, Facebook Business, payment processors, or marketing platforms), we may receive information from those services as necessary to provide the integration. The information received depends on the specific integration and your settings with that third-party service.

Third-party services we may integrate with include:

• Google (Calendar, Drive, Analytics, Ads)
• Facebook/Meta (Business API, Ads, Messenger)
• ActiveCampaign, Drip (marketing automation)
• Payment processors
• Communication platforms

---

2. How We Use Information

We use the information we collect for the following purposes:

To Provide the Service:

• Create and manage your account
• Process transactions and send related information
• Provide customer support
• Enable integrations you authorize

To Improve and Protect the Service:

• Analyze usage patterns to improve functionality
• Detect, prevent, and address technical issues
• Protect against fraudulent or unauthorized activity
• Ensure Service security and integrity

To Communicate with You:

• Send administrative notices and Service updates
• Respond to inquiries and support requests
• Send marketing communications (with your consent, where required)

To Comply with Legal Obligations:

• Meet regulatory and legal requirements
• Respond to lawful requests from authorities
• Protect our legal rights and interests

---

3. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

3.1 Service Providers

We share information with third-party vendors who perform services on our behalf, including:

All service providers are contractually obligated to use your information only for the services they provide to us and to maintain appropriate security measures.

3.2 Third-Party Integrations

When you enable integrations with third-party services (Facebook, Google, etc.), information may be shared with those services according to the permissions you grant. Those services' privacy policies govern their use of your information.

3.3 Legal Requirements

We may disclose information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

3.5 With Your Consent

We may share information with third parties when you give us explicit consent to do so.

---

4. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

---

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Employee training on data protection

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Account Information

You may update or correct your account information at any time by logging into the Service or contacting us at privacy@core365.io.

6.2 Marketing Communications

You may opt out of marketing emails by clicking the "unsubscribe" link in any marketing email or by contacting us. Note that you may still receive transactional or administrative communications.

6.3 Cookies

Most web browsers accept cookies by default. You can usually modify your browser settings to decline cookies, although this may affect your ability to use certain features of the Service.

6.4 Data Export

---

Clients may export their data from the Service in standard formats. Contact support@core365.io for assistance.

7. California Privacy Rights (CCPA/CPRA)

7.1 Core365 as a Service Provider

Core365 operates as a "Service Provider" under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) with respect to personal information we process on behalf of our Clients. We process personal information solely to provide our Service as described in our agreements with Clients.

For End Users of Our Clients: If you are a California resident and a customer of a business that uses Core365, please contact that business directly to exercise your privacy rights. They are responsible for responding to your requests under California law. We will cooperate with our Clients to fulfill verified consumer requests.

7.2 Our Direct Collection

For personal information we collect directly from California residents (such as Client contacts and website visitors), you have the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

7.3 Exercising Your Rights

To exercise your California privacy rights, contact us at:

• Email: privacy@core365.io

We will respond to verified requests within 45 days. We may request additional information to verify your identity.