Internal Use Guidelines

Acceptable use and data handling practices for InnHub CRM.

For InnHub staff only.

Version 1.0 · Last updated April 4, 2026 · Next review October 2026

System Overview

SoftwareInnHub CRM
DeveloperHarbour 22 GmbH
Data OwnerInnHub La Punt AG
UsersInnHub staff only
Accessinnhub-crm.ch

Data Ownership

Software

  • CRM software code and intellectual property: Harbour 22 GmbH

Data

  • All data entered into the CRM: InnHub La Punt AG
  • Partner information, contacts, interactions, notes: InnHub property
  • InnHub has full rights to export, backup, and delete their data

Data Collected

  • Organization Data: Company names, addresses, industry, status, priorities
  • Contact Data: Names, emails, phone numbers, positions, LinkedIn profiles
  • Interaction Data: Meeting notes, communication history, follow-up tasks
  • User Data: InnHub staff login credentials, usage logs

Data Storage & Security

  • Hosting: Supabase (AWS Frankfurt, EU region)
  • Encryption: TLS 1.3 in transit, AES-256 at rest
  • Backups: Daily automated backups
  • Access: Restricted to authenticated InnHub users only

AI Assistant (CRM Chat)

The CRM includes an AI-powered assistant that can search contacts, analyse interactions, and help prepare for meetings using natural language. Here is how it works and what to be aware of:

How it works

  • When you ask a question, the CRM sends your query and the relevant data to the Claude API (by Anthropic) for processing
  • The AI can only access CRM data through the same query tools available to the application — it has no direct database access
  • All write operations (logging interactions, updating contacts) require explicit confirmation via an Apply button before anything is saved

Data handling

  • Anthropic does not store API inputs or use them for model training (per their API data usage policy)
  • Data is processed in-memory during the request and discarded after the response is returned
  • Conversation history is stored exclusively in InnHub's own database (Supabase) — not at Anthropic
  • The connection to Anthropic is encrypted via TLS and authenticated with a private API key

User guidelines

  • ✓Use for CRM tasks only—The assistant is designed for partner management — not general-purpose AI chat
  • ✓Review before applying—Always verify the details in a proposal card before clicking Apply
  • ✓No highly sensitive data—Avoid entering passwords, financial credentials, or personal ID numbers into the chat
  • ✓AI can make mistakes—Verify important facts against the actual CRM records — the AI may misinterpret or miss data

User Responsibilities

  • ✓Keep credentials secure—Strong passwords, MFA enabled, never share login credentials
  • ✓Business purposes only—CRM is for partner relationship management only
  • ✓Protect data confidentiality—Do not share partner data outside InnHub without authorisation
  • ✓Report security issues—Immediately report suspected breaches to security@innhub-crm.ch
  • ✓Keep data accurate—Update contact information, archive outdated records, delete duplicates
  • ✓Use English as the main language—All information entered into the CRM — organization profiles, contact records, notes, and interaction logs — should be written in English

Prohibited Activities

  • ✕Sharing CRM access with non-InnHub personnel
  • ✕Accessing data outside of job responsibilities
  • ✕Exporting data to personal email or storage without authorisation
  • ✕Using CRM for personal projects or external consulting
  • ✕Attempting to bypass security controls

Data Retention

  • Active Partners: Data retained as long as partnership is active
  • Inactive Partners: Data archived after 24 months of no activity
  • Deleted Accounts: User can request complete data deletion
  • Backups: Retained for 30 days, then permanently deleted

User Access Levels

All users currently have full access to all data. Role-based access controls may be introduced in a future update.

AdministratorFull system access, user management, data export/import, system configuration
Standard UserView and edit assigned partners/contacts, create interactions, export own data
ViewerRead-only access, no editing capabilities, no exports

Data Subject Rights

For external contacts stored in the CRM, InnHub ensures:

  • Right to Access: Contacts can request their data
  • Right to Rectification: Incorrect data can be corrected
  • Right to Erasure: Data deleted upon request (where legally permissible)
  • Right to Export: Data provided in portable format

Contact for data requests: privacy@innhub-crm.ch

Incident Response

In case of a security incident or data breach:

  1. 1.Immediately notify security@innhub-crm.ch
  2. 2.Do not delete logs, modify data, or attempt to fix it yourself
  3. 3.Preserve all evidence and system states
  4. 4.Document what happened, when, and what data may be affected
Response time: Within 24 hoursEscalation: tobias@innhub.ch

Compliance

This CRM and its usage are governed by:

  • InnHub La Punt AG employment contracts
  • InnHub La Punt AG IT usage policies
  • Swiss Data Protection Act (DPA)
  • GDPR (for EU partner data)
  • Swiss labor law

Support & Questions

Technical Support: tobias.kappeler@harbour22.com

Security Concerns: security@innhub-crm.ch

Data Requests: privacy@innhub-crm.ch

General Questions: tobias.kappeler@harbour22.com

By using InnHub CRM, you acknowledge that you have read, understood, and agree to comply with these guidelines and all applicable InnHub La Punt AG policies.

Security Overview