Privacy policy

Last updated 3 November 2026

CRM Glue is customer relationship software for travel agencies. It is made and run by Wemark Tech Pty Ltd ("we", "us"). This policy explains what personal information we handle, why, and the choices you have. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. Two kinds of information

Agency account information. Details of the travel agencies that use CRM Glue and their staff: names, work email addresses, roles, sign-in and activity records, and billing contacts. We are responsible for this information.

Information agencies keep about their own customers. Travellers' names, contact details, travel plans, bookings, payments, passport details and messages. The agency decides what is stored and is responsible for it. We hold and process it only to provide CRM Glue to that agency, on its instructions. If you are a traveller, please contact your travel agency first about your information.

2. What we collect

• Account details: name, email, role and agency for each staff member, and a two-factor sign-in record.
• Activity records: sign-ins, last-seen times, and a record of changes made in the software (who changed what, and when), kept for security, support and the agency's own audit trail.
• Messages sent and received through CRM Glue by email, WhatsApp and SMS, including attachments, so they appear in the agency's inbox and customer history.
• Billing details: the agency's billing contact and subscription status. Card payments are handled by Stripe; we never see or store full card numbers.
• Technical information needed to run the service securely, such as browser type and connection logs.

3. How we use it

• To provide, maintain and secure CRM Glue, including delivering the messages agencies send.
• To provide support, investigate problems and prevent misuse.
• To bill agencies and manage their subscriptions and allowances.
• To meet legal obligations.

We do not sell personal information, use it for advertising, or use agencies' customer information to train artificial intelligence models.

4. Support access

Authorised CRM Glue staff may view an agency's account to provide support, investigate problems or keep the service secure. This access is limited in time, is view-only (nothing can be changed or sent), and every visit is recorded in our internal logs.

5. WhatsApp and Meta

When an agency connects its WhatsApp Business account, we receive and store the messages, contact names, phone numbers and media exchanged with that agency's customers, so they appear in the agency's inbox. We use information from Meta only to provide this messaging service to that agency. Access tokens are stored securely on our servers, are never shown in the software, and are deleted when the agency disconnects WhatsApp or closes its account.

6. Where information is stored

CRM Glue's database and stored files are hosted in Sydney, Australia. Some of the service providers below may process information outside Australia, as noted. We choose providers with strong security and privacy commitments and share only what each needs.

7. Security

• Two-factor sign-in is required for everyone who uses CRM Glue.
• Each agency's records are separated at the database level, so one agency can never see another's.
• Information is encrypted in transit and at rest.
• Changes are recorded in an audit trail.

8. How long we keep it

We keep an agency's information while its account is open. After an agency cancels, we keep its information for 90 days so it can come back or ask for an export, then delete it, unless the law requires us to keep something longer. See Data deletion to ask for deletion sooner.

9. Access, correction and complaints

You can ask us for access to the personal information we hold about you, or ask us to correct it. Email sales@wemarktech.com.au and we will respond within 30 days. If you are a traveller, we may refer your request to your travel agency, which controls your information.

If you are unhappy with how we have handled your information, please tell us first. If we cannot resolve it, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes

We may update this policy. We will post the new version here with a new date, and tell agencies about significant changes.