How we handle your information
Last updated: 16 October 2026 MAD CRM is a customer relationship management and marketing platform provided by Madhouse Media Ltd (“MAD CRM”, “we”, “us” or “our”). This Privacy Policy explains how we collect, use and protect personal information when you use MAD CRM, including information processed through connected services such as Facebook and Instagram.
Last updated: 19 October 2026
Who we are and when this policy applies
MADCRM is provided by Madhouse Media Ltd. This policy applies to the MADCRM website, CRM application, support portals, mobile or installed applications and integrations that MADCRM operates.
For account administration, billing, security and service communications, Madhouse Media Ltd acts as a data controller. When a customer uses MADCRM to manage leads, contacts, support users or other business records, the customer normally determines why that information is processed and MADCRM acts as its service provider or data processor.
Information we process
- Account and business information: names, business names, email addresses, telephone numbers, user roles, authentication records and subscription information.
- CRM content: leads, contacts, companies, tasks, appointments, support conversations, files and other information entered or imported by authorised users.
- Service and security information: sign-in events, device and browser information, IP addresses, audit logs, error reports and usage information needed to operate and protect the service.
- Connected-service information: identifiers, credentials, configuration and content obtained when an authorised user connects services such as Meta, Google, Microsoft, Box or an email provider.
Facebook and Instagram data
MADCRM only requests Meta permissions needed for features the customer chooses to use. Depending on the feature and permissions granted, MADCRM may process:
- the Meta user identifier and name used to establish and audit the connection;
- access tokens and their expiry information;
- Facebook Page, Instagram professional account, Business, advertising account, campaign, form and media identifiers and names;
- Page or Instagram content, comments, engagement information and scheduled or published post information needed by Social Planner;
- lead-form submissions and advertising attribution information that the connected business is authorised to access.
MADCRM uses this information to show the accounts selected by the authorised user, retrieve leads, prepare or publish requested content, manage supported interactions, synchronise reporting and diagnose connection problems. It is not sold and is not used to build advertising profiles for MADCRM.
Why we use information
We process information to provide the contracted service, follow customer instructions, secure accounts, prevent abuse, provide support, meet legal obligations and improve reliability. Where consent is required for an optional connection, the user can withdraw it by disconnecting that service.
Sharing and international processing
Information may be processed by vetted hosting, communications, payment, storage and monitoring providers where necessary to operate MADCRM. Connected-service data is also exchanged with the provider selected by the customer when carrying out the customer’s requested action. We do not permit service providers to use customer information for their own unrelated purposes.
Where information is processed outside the United Kingdom, we use an appropriate transfer mechanism or rely on a legally recognised adequacy arrangement where required.
Security and access
MADCRM uses role and company scoping, access controls, encrypted transport, restricted credential display, logging and operational safeguards. Customers are responsible for assigning appropriate users, protecting their login details and ensuring that people connecting third-party accounts are authorised to do so.
Retention and deletion
We retain information only while it is needed to provide the service, meet contractual or legal requirements, resolve disputes and maintain security. Connection tokens are removed when the applicable connection is deleted and may also expire or be revoked by the provider. Backups and security logs may remain for a limited period before being overwritten.
Instructions for disconnecting Meta and requesting deletion are available on our data deletion page.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, receive a portable copy of information, and complain to the UK Information Commissioner’s Office. If your information was entered into MADCRM by one of our customers, please contact that business first because it normally controls that record.
Changes to this policy
We may update this policy when MADCRM or its legal obligations change. The date above identifies the current version.
Contact us
For questions or requests concerning this policy, contact MADCRM support or email [email protected]. Please do not include passwords or access tokens in a support request.