Privacy

What DroneCRM collects, why, who else touches it, and what you can ask us to do with it.

Last updated 25 September 2026. DroneCRM is run by National Drone Services, LLC, a Texas limited liability company, trading as DroneCRM ("we").

The short version

  • Your company's data is yours. We use it to run DroneCRM for you, and for nothing else.
  • We don't sell data, and we don't use it for advertising.
  • When you connect your email, DroneCRM files client emails by who they're from and to, when they were sent and their subject. It reads what an email says only when someone in your company opens it in DroneCRM (or asks Tower about it), and doesn't keep a copy.
  • From your calendar, DroneCRM reads only when you're busy, never what the event is.
  • Card and bank details go straight to Stripe. DroneCRM never sees or stores them.

Who this covers

Two kinds of people: the drone companies that use DroneCRM and their staff ("you"), and the companies' own clients, whose details a company keeps in DroneCRM. For client details, the drone company decides what goes in and why, and we look after it on their behalf. Clients with questions about their details should ask the company first, and can also write to us.

What we collect

  • Your account: name, email address, password (stored only as a one-way hash), the company you belong to and your role.
  • What your company puts in: clients, contacts, sites and their outlines, jobs, quotes, invoices, payments you record, flight logs, fleet details, notes, photos and documents you upload, and social post drafts.
  • From connected accounts, only when you connect them: email headers (sender, recipients, subject, date) for messages to or from your clients, and an email's text when someone opens it in DroneCRM (shown, not stored); for email connected with an app password (IMAP), that password, stored encrypted; the times you're busy on your calendar; customers, invoices and payments in QuickBooks or Xero; the Facebook Page and Instagram account you publish to.
  • Payments: Stripe tells us whether a payment went through and its amount. We never see card or bank numbers.
  • Technical: sign-in sessions, the address a request came from (to limit abuse), error logs, and, if you turn on alerts on a device, that browser's push address.
  • AI use: how much of your company's AI credits each Tower feature used, so we can show and bill it.
  • Your website, if you ask: when the owner uses "Match my website", DroneCRM reads that public page and its stylesheets for colours and fonts.

How we use it

  • To run DroneCRM: show your data to the people in your company, send the emails you approve, keep your calendar and books in step, and check bookings against weather and airspace.
  • To write drafts and answers with Tower. When Tower drafts an email, a summary or a social post, or answers a question you ask it, the facts it needs (and, for posts, the job's photos; for a question about an email, that email's text) are sent to Anthropic's Claude API. When you ask Tower something outside your account, it may search the web through Anthropic. Anthropic doesn't train its models on this. Without it, Tower writes from templates.
  • To alert you straight away when a TFR or a weather problem affects a booked job, by email and, if you turn it on, a notification on your phone or computer.
  • To keep the service secure and working, and to answer you when you write to us.
  • To bill your subscription and any AI credits you buy.

We don't use your data, or your clients', for anything else, and we don't sell or rent it. Nothing from your company, or from the accounts you connect (Google, Microsoft, QuickBooks, Xero, Facebook), is used to train AI or machine learning models, ours or anyone else's.

Google user data

DroneCRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We ask for read access to Gmail, permission to send the emails you approve from your address, and access to the calendar events DroneCRM creates and to your free and busy times.
  • We use this only to file client email under the right client and job, show an email's text when someone in your company opens it in DroneCRM or asks Tower about it (without storing it), send what you approved, put your bookings on your calendar and avoid booking you when you're busy.
  • We don't use it for advertising and don't sell it. People at DroneCRM don't read it, except with your permission for support, for security, or where the law requires.
  • We don't use it to develop, improve or train generalized AI or machine learning models. When you ask Tower about an email, its text is sent to Anthropic only to answer you, and Anthropic doesn't train on it.

Who else handles data

We use these providers to run DroneCRM. Each gets only what its part needs.

  • OVHcloud, where DroneCRM and its database run, in Canada.
  • Stripe, for payments, our own billing and AI credits.
  • Postmark, to send DroneCRM's email.
  • Anthropic, for Tower's drafts, answers and web searches (see above).
  • Your browser's push service (Google, Apple, Mozilla or Microsoft), to deliver alerts to devices where you turned them on. It receives the alert's short text.
  • Google, Microsoft, Intuit, Xero, Meta and NDS DataDelivery™, when your company connects them.
  • Open-Meteo and the FAA, for weather and airspace. They receive site locations, not who your clients are.

Facebook and Instagram data

When a company connects its Facebook Page, DroneCRM keeps the sign-in Facebook gives it (encrypted), the names of the Pages and Instagram accounts it may post to, and an ID Facebook uses for the person who connected them. It uses them only to publish the posts a person at that company approves.

To delete that data, do either of these:

  • On Facebook, go to Settings and privacy, Settings, Business integrations, and remove DroneCRM. Facebook tells DroneCRM, which deletes the sign-in, the names and the ID straight away. If you ask Facebook to delete your data too, it gives you a link to check the request and a confirmation code.
  • In DroneCRM, go to Settings, Facebook and Instagram, and choose Disconnect. Or email contact@dronecrm.net and we'll do it for you within 30 days.

Posts already published stay on the Page until the Page removes them, and the company's own record of what it posted stays in DroneCRM.

Photos

Photos you upload are kept as uploaded, including any location data the camera saved. The smaller copies DroneCRM shows, shares on a client's page, or posts to Facebook and Instagram have that location data removed.

How long we keep it

For as long as your company uses DroneCRM. If your subscription ends, your account becomes read-only and we keep everything for 60 days in case you come back. [What happens after 60 days: owner to decide.] Backups are kept for 14 days. You can export your clients, jobs, quotes and invoices as CSV at any time.

Your choices

  • Disconnect any connected account in Settings. DroneCRM stops reading from it straight away and revokes its access where the provider allows.
  • Ask us for a copy of your data, to correct it, or to delete it: contact@dronecrm.net. We'll answer within 30 days.
  • Depending on where you live, you may have more rights under your state's privacy law. We honour them.

Security

Each company's data is kept apart in the database itself, not only in the app. Connected-account tokens are encrypted, connections use HTTPS, and nothing goes out through a connected account without a person's approval, unless your company switched that kind of message to automatic.

Changes

If we change this policy in a way that matters, we'll tell account owners by email before it takes effect.

Contact

National Drone Services, LLC, 6757 West Loop S, Ste 500, Bellaire, TX 77401, contact@dronecrm.net.