Legal
Privacy policy
MV Public Relations Ltd ("MVPR", "we") operates CRM Builder. Last updated: 28 October 2026.
1. Who we are
CRM Builder (crm-builder.com) is a signal-first CRM. It finds the people who engage with the problem that a customer solves, and follows each company from its first signal to a closed deal. MV Public Relations Ltd operates it. We are registered in England and Wales (company number 09312518) at 83 Baker Street, London, W2 4AP, United Kingdom.
For any question about privacy or your data, write to tom@mvpr.io.
2. Our 2 roles
We are the controller of the data about the people who use CRM Builder: your account, your sign-in, your billing and how you use the product. We are also the controller of the data about visitors to crm-builder.com.
We are a processor of the data that a customer puts in its workspace: its contacts, its companies, the signals about them, its messages, its call notes and its content. The customer is the controller of that data and decides why it is used. We process it only to give the customer the service, as the customer instructs. If a customer holds data about you, contact that customer first. We will help them to answer you.
3. The data that we collect as controller
- Account data: your name, your email address, your workspace and your role. Our sign-in provider holds your password or your Google sign-in.
- Billing data: your billing name and address, your VAT number and your top-ups. Our payment provider holds your card. We never see the full card number.
- Usage data: the pages that you open, the actions that you take, the AI agents that you connect, and technical data such as your IP address and browser.
- Communications: the emails that you send to us and that we send to you, such as your invite and your welcome email.
4. The data in a customer workspace
A customer decides what goes into its workspace. The data can come from:
- contacts that the customer imports from a CSV file or from a CRM that it connects, such as Attio or HubSpot.
- the public engagement with LinkedIn posts that the customer chooses to track: the name, headline, company and profile of each person who likes or comments.
- the LinkedIn accounts, mailboxes, calendars and call recorders that the customer connects.
- enrichment that the customer runs, which can find a work email address, a job title or company details.
- the signals that tracked links, emails and campaigns record, such as a click, an open, a reply or a meeting booked.
The customer must have a lawful basis to hold this data and to contact the people in it. CRM Builder gives each customer tools to exclude a person, to delete a contact and to stop outreach.
5. Why we use your data, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| To give you the service and run your account | Contract, Art. 6(1)(b) |
| To take payment and keep billing records | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| To send emails about your account, such as invites and the welcome email | Contract, Art. 6(1)(b) |
| To keep the service secure, stop abuse and limit how fast it is used | Legitimate interests, Art. 6(1)(f) |
| To improve the product from how it is used | Legitimate interests, Art. 6(1)(f) |
| To obey the law | Legal obligation, Art. 6(1)(c) |
6. AI
- CRM Builder uses large language models to classify contacts by persona, to find themes in content, to draft messages and to analyse writing style.
- We send a model only the data that a task needs.
- We use the models through business APIs. Under those terms, the model providers do not use the data that we send to train their models.
- A person reviews an AI draft before it is sent. CRM Builder does not make decisions about people by automated means alone that have a legal or a similarly significant effect on them (Art. 22 UK GDPR).
- An AI agent that a customer connects, through our MCP connection, can read and change the customer workspace only with the permissions that a workspace admin approves. The admin can remove the connection at any time.
7. Our service providers
We share data with these providers only to run CRM Builder. We do not sell personal data.
| Provider | What it does |
|---|---|
| Vercel | Hosting, in Frankfurt (EU), anonymous page speed data, and the visitor beacon of our public pages |
| Neon | The database, in Frankfurt (EU) |
| Upstash | Workspace settings, encrypted, and rate limits |
| Clerk | Sign-in and accounts |
| Stripe | Payments and invoices |
| Resend and SendGrid | Email delivery |
| Anthropic, OpenAI and Google, through the Vercel AI Gateway | AI models |
| Google Analytics | Measurement of our public pages, only after you say yes on the cookie banner |
| Apify, Unipile and Jina | Reading public LinkedIn and web pages that a customer chooses to track |
| Surfe, Apollo and Moz | Enrichment that a customer runs |
A customer can also connect its own tools, such as Attio, HubSpot, Calendly, Dripify, Teamfluence, Fireflies or Recall.ai. Data then passes between CRM Builder and that tool, on the customer's instruction.
8. International transfers
We host the service and the database in Frankfurt, in the EU. Some providers are in the United States. When data goes outside the UK or the EEA, we use the safeguards that the law allows, such as the Standard Contractual Clauses and the UK International Data Transfer Addendum.
9. Cookies
CRM Builder uses only the cookies that it needs: the sign-in cookies that keep you signed in, and a cookie that keeps the state of a setup step. Our page speed measurement uses no cookie and does not identify you. We use no advertising cookies.
Our public pages, not the app, set 1 more cookie: mvpr_vid, a random visitor id that lasts 365 days. It tells us which public pages a browser read and for how long, so that we can see what interests a visitor before a first conversation. It holds no personal data. If your browser sends the Global Privacy Control signal, we set no visitor id and send nothing. To stop it in a browser, open crm-builder.com/?internal=1 once in that browser.
Our public pages also ask you, once, whether we may measure how the site is used. If you say yes, Google Analytics loads and sets its cookies (_ga and _ga_*, up to 2 years), with advertising features off. If you say no, it does not load. We keep your answer in your browser's local storage, not in a cookie, and it never leaves your browser. The "Cookie choice" link in the footer lets you change it. If your browser sends the Global Privacy Control signal, we treat that as no and do not ask.
10. How long we keep data
- Account data: while your account is open, and 30 days after it closes.
- Billing records: up to 7 years, as UK law requires.
- Customer workspace data: while the customer's account is open. When the account closes, we delete the workspace data on request, within 90 days.
- Security and usage logs: up to 12 months.
11. Your rights
Under UK data protection law, you have the right to:
- get a copy of your personal data.
- correct data that is wrong or incomplete.
- ask us to delete your data.
- ask us to limit how we use your data.
- get your data in a structured, machine-readable form.
- object to a use that is based on our legitimate interests.
- withdraw your consent, where we rely on it.
Write to tom@mvpr.io. We reply within 1 month. If you are not satisfied, you can complain to the Information Commissioner's Office (ico.org.uk).
12. Security
We encrypt data in transit and at rest. We encrypt the keys and secrets that a customer saves, and we never show them again. Access to a workspace needs a sign-in, and each person sees only the workspaces that they belong to.
13. Changes
We can change this policy. The date at the top shows the last change.
14. Contact
tom@mvpr.io. MV Public Relations Ltd, 83 Baker Street, London, W2 4AP, United Kingdom.