Privacy Policy

1. Scope and who we are

This Privacy Policy applies to the Ecomama Farms customer relationship management platform at crm.ecomamafarms.com, including its inquiry forms, staff workspace, client portals, proposals, contracts, document tools, calendar features, invoices, and related communications (collectively, the “CRM”).

Ecomama Farms LLC (“Ecomama Farms,” “we,” “us,” or “our”) operates the CRM to manage venue inquiries, events, client relationships, and business operations. For personal information described in this policy, Ecomama Farms is generally the business or controller that determines why and how the information is processed.

This policy does not govern independent websites, applications, or services operated by third parties, even when the CRM links to or integrates with them. Those services are governed by their own terms and privacy notices.

2. Information we collect

Information you or others provide

• Identity and contact information, such as names, email addresses, telephone numbers, mailing addresses, partner details, planner information, and business affiliations.
• Event and inquiry information, such as event type, requested and confirmed dates, guest counts, budget ranges, service preferences, planning details, accessibility or accommodation requests, referral sources, and messages.
• Account information, such as login email, account role, organization membership, password hash, permissions, session records, and account preferences.
• Client and transaction records, such as proposals, contracts, electronic signature status, invoices, payment schedules, payment status, transaction references, credits, and related correspondence. Payment providers may collect payment card or bank information directly under their own privacy notices.
• Content and communications, including form responses, uploaded documents and images, notes, email content, client portal submissions, support requests, and communications among clients, planners, vendors, and staff.
• Vendor and operational information, including vendor contact details, catering details, schedules, tasks, availability blocks, and event logistics.

Google Calendar information

If an authorized administrator connects a Google account, we may process the connected account email address, selected calendar identifier, OAuth access and refresh tokens, calendar list metadata, event details, availability information, and identifiers for events created or synchronized by the CRM. More detail appears in the Google user data section below.

Information collected automatically

• Device and log information, such as IP address, browser and device type, operating system, requested pages, timestamps, referring page, and diagnostic or security events.
• Usage and audit information, such as sign-ins, changes to records, access attempts, workflow activity, integration status, and actions taken by staff or automated processes.
• Attribution information, such as referral URLs, source links, and UTM campaign parameters associated with an inquiry submission.

Please avoid submitting highly sensitive information that the CRM does not request or need, such as Social Security numbers, government identification numbers, or complete payment card details.

3. Sources of information

We may receive personal information from:

• You when you submit a form, create an account, or use the CRM.
• Your partner, planner, coordinator, vendor, or another person involved in an inquiry or event.
• Ecomama Farms staff who create or update business records.
• Connected services you authorize, such as Google Calendar, DocuSign, Calendly, Typeform, email providers, and billing or payment providers.
• Technical systems that support authentication, security, hosting, file storage, backups, and application operation.

If you provide personal information about another person, you should have authority to provide it and should direct that person to this policy when appropriate.

4. How we use information

We use personal information to:

• Receive, review, route, and respond to venue inquiries.
• Schedule tours and events, coordinate vendors, and manage venue availability.
• Create and administer client accounts, staff accounts, and secure client portals.
• Prepare and manage proposals, contracts, signatures, invoices, payment schedules, documents, and event records.
• Send requested, transactional, administrative, and operational communications.
• Connect and operate integrations that an authorized user enables, including calendar synchronization and electronic signatures.
• Authenticate users, enforce permissions, prevent fraud and abuse, maintain audit logs, and protect the CRM and its users.
• Diagnose errors, maintain backups, monitor reliability, improve workflows, and develop CRM features.
• Comply with law, preserve records, resolve disputes, enforce agreements, and establish or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of a contract or steps requested before entering a contract, legitimate interests in operating and securing our business, consent for optional connections or communications, and compliance with legal obligations.

5. Cookies and similar technology

The CRM uses cookies and comparable browser storage that are necessary for authentication, session continuity, security, preferences, and core application functions. Blocking these technologies may prevent sign-in or other parts of the CRM from working correctly.

The CRM does not currently use third-party advertising cookies or use personal information for cross-context behavioral advertising. Some linked or embedded third-party services may set their own cookies when you interact with them; their privacy notices govern those technologies.

6. How we disclose information

We may disclose personal information to the following recipients:

• Staff and authorized participants. Ecomama Farms staff and authorized planners, coordinators, clients, or vendors may receive information needed for an inquiry, event, or business workflow.
• Service providers. Providers may support hosting, databases, authentication, file storage, backups, security, email delivery, electronic signatures, calendar functions, form intake, scheduling, document generation, billing, payments, and technical operations.
• Integrations you authorize. When an administrator enables an integration, we disclose the information needed to perform the requested feature and receive relevant status or record updates from that provider.
• Legal and safety recipients. We may disclose information when reasonably necessary to comply with law or legal process; investigate fraud, abuse, or security incidents; protect rights, safety, and property; or establish, exercise, or defend legal claims.
• Business transaction recipients. Information may be reviewed or transferred as part of a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality protections.

We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising and do not offer financial incentives in exchange for personal information.

7. Google user data

The CRM requests Google Calendar permissions only after an authorized administrator chooses to connect a Google account. We use Google user data to list calendars available to that account, let an administrator select a calendar, display relevant calendar events and availability, and create, update, or remove CRM-related events such as venue tours.

We do not use Google user data for advertising, sell it, or transfer it to data brokers. We do not use it to determine creditworthiness, lending eligibility, or for unrelated profiling. We disclose Google user data only to service providers acting on our behalf when needed to operate or secure the feature, when the user directs or clearly authorizes the disclosure, or when required by law.

Human access to Google user data is limited to circumstances where an authorized user has affirmatively agreed to specific access, where access is necessary for security or abuse investigation, where it is needed to provide support and the user has consented, or where applicable law requires it.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

An authorized administrator can disconnect Google Calendar from the CRM. Users may also revoke the CRM’s access through their Google Account security settings. Disconnecting or revoking access stops new Google Calendar access but may not automatically delete event records, audit records, or data that must be retained for legal or operational purposes. You may request deletion as described below.

8. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Retention depends on the type of record, the status of the inquiry or event, contractual and accounting requirements, security needs, legal limitation periods, and our obligation to preserve evidence or resolve disputes.

Account and active event records are generally retained while the account or business relationship remains active. Contracts, invoices, payment records, and related communications may be retained longer to meet tax, accounting, insurance, and legal requirements. Security logs and backups are retained for limited operational periods. Deleted information may remain in protected backups until those backups are overwritten through the ordinary retention cycle.

OAuth access tokens are retained while the applicable integration remains connected or as needed to complete revocation and security processes. We may retain a limited record of the connection or actions performed for audit and fraud-prevention purposes.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. Depending on the context, these safeguards may include access controls, role-based permissions, password hashing, encrypted network transport, protected storage, secret management, rate limiting, audit logging, backups, and incident response procedures.

No method of transmission or storage is completely secure. You are responsible for using a strong, unique password, protecting your credentials and devices, signing out of shared devices, and notifying us promptly if you suspect unauthorized access.

10. Your choices and privacy rights

Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; object to or restrict certain processing; withdraw consent; or appeal a decision on a privacy request.

You may update certain information through the CRM or ask Ecomama Farms staff to correct an event or client record. You may disconnect optional integrations, revoke Google access through your Google Account, and use unsubscribe instructions in eligible non-transactional emails. We may still send communications necessary for an active inquiry, contract, event, invoice, security matter, or account.

To submit a privacy request, email kristie@ecomamafarms.com with the subject “Privacy Request.” Describe the right you wish to exercise and the email address or event relationship associated with your information. We may request information reasonably necessary to verify your identity and authority. We will use verification information only for handling the request.

Rights are not absolute. We may deny or limit a request when permitted by law, including when records are needed to complete a transaction, comply with law, maintain security, preserve legal claims, or protect another person’s privacy. We will explain the basis for a denial when required.

11. California privacy rights

If the California Consumer Privacy Act, as amended, applies to a request, California residents may have rights to know the categories, sources, purposes, and recipients of personal information; access specific pieces of personal information; request deletion or correction; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service without unlawful discrimination for exercising a privacy right.

The categories collected during the preceding 12 months are described in Information we collect. The business purposes and categories of recipients are described in How we use information and How we disclose information. We have not sold personal information or shared it for cross-context behavioral advertising during the preceding 12 months.

You or an authorized agent may submit a request using the contact method in Your choices and privacy rights. For an agent request, we may require signed authorization and may ask you to confirm the request directly. Because we do not sell or share personal information for cross-context behavioral advertising, there is no separate “Do Not Sell or Share” opt-out required for our current practices. We will recognize legally required browser-based preference signals if our practices change in a way that makes them applicable.

12. Children’s privacy

The CRM is intended for adults and authorized business users. It is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through the CRM. Event records may incidentally contain a minor’s name or event-related detail when provided by a parent, guardian, client, or planner. If you believe a child has submitted information without appropriate authorization, contact us so we can review and address it.

13. International processing

Ecomama Farms operates in the United States. If you access the CRM from another country, your information may be transferred to and processed in the United States and other locations where our service providers operate. Those locations may have privacy laws different from the laws where you live. Where required, we use appropriate safeguards for international transfers.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in the CRM, our practices, integrations, or applicable law. We will post the updated policy here and change the “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice when required by law.

15. Contact us

For questions, privacy requests, or concerns about this policy, contact: