FindTime, operated by GLOWFISH LLC, provides scheduling and CRM features that can use connected calendars, Salesforce records, meeting transcripts and notes. This overview describes our approach to protecting that information and the scope of organizational reviews. Our Privacy Policy explains collection, use, sharing and individual rights.
Hosting and access
- Our core application and database infrastructure is configured on Google Cloud in the United States (us-central1). External services may process data in other locations; this is not an exclusive regional-residency commitment.
- Web connections use HTTPS. Our database configuration requires encrypted connections, and managed storage uses provider encryption at rest. Integration credentials such as Salesforce OAuth tokens are additionally encrypted by the application.
- Accounts can turn on two-factor authentication (authenticator app, with recovery codes), and it is asked for again before password or email changes. We email you about sign-ins from a new location or device.
- Application authorization scopes access to users and permitted team contexts. Infrastructure access is managed through Google Cloud IAM. Authorized operational access may be needed for support, maintenance or security investigations.
- We use automated tests and security scanning in development, with infrastructure configuration maintained in Terraform. These controls do not eliminate every risk.
Salesforce and organizational pilots
The connector retrieves selected standard fields from Contacts, Leads, related Accounts, Opportunities, Tasks and Events. These include contact information, descriptions, activity text and opportunity details. Copies are stored in FindTime, and blank contact fields may be filled from Salesforce. Custom Salesforce fields are excluded by the connector.
Pull is the default mode. Pull + push requires approval of proposed updates before sending them to Salesforce. Pull-only behavior is an application setting, not a read-only OAuth scope. Your Salesforce permissions and organization policies still determine API access.
For a pilot, agree the purpose, users and permitted data with your administrator. Start with synthetic or appropriately anonymized sandbox data, admin-approved app access assigned to the intended user, and your existing IP policy. Limiting who can authorize the app does not itself restrict which records that user can access. Review data handling and any required agreement before connecting organizational production data.
Conference Companion (Zoom and Microsoft Teams)
The Conference Companion shows your own FindTime CRM in a side panel during a Zoom or Teams meeting. It is visible only to you and is read-only. In Zoom it reads no Zoom data: no recordings, chat, participants or meeting content. Zoom's authorization is used once to open the app and is not stored. In Teams it uses only your Microsoft sign-in to match your FindTime account. The meeting is matched from your synced calendar.
The panel's session lasts up to 12 hours and is limited to your account. Presenting blurs the whole panel while you share your screen. See the Conference Companion guide.
LinkedIn live sync
When you turn on LinkedIn live sync, our provider Unipile holds the LinkedIn session for your account and retrieves your connections and profile details for FindTime. FindTime never sees your LinkedIn password. Disconnecting stops syncing and deletes the provider session; data already imported stays in your CRM until you delete it.
Transcripts and AI processing
Connected transcript sources, including Krisp, and imported notes can supply meeting text and speaker information. CRM features store and process this content, summaries, contact attributes, insights and text embeddings. Relevant content may be sent to Anthropic or Google for analysis; company research can also use search grounding. The email assistant sends incoming email content to TypeSafe to classify what each message is asking for. Automated redaction and sanitization reduce some risks but do not guarantee anonymity.
FindTime does not use customer content to train AI models. We have no negotiated zero-data-retention agreement with Anthropic, Google or TypeSafe. Provider retention may include caching, safety monitoring and legal exceptions. Read the AI-provider terms and retention information and our provider list. Provider certifications and agreements do not constitute certification of FindTime.
Retention, removal and pilot exit
Disconnecting a source stops further syncing; it is not a complete deletion request. Salesforce snapshots remain for reconnection. The separate Remove Salesforce data control removes connector snapshots, links and associated source records, but retains contact fields already filled and does not undo changes made in Salesforce or erase every derived artifact. Disconnect before removal to prevent re-importing data.
Account deletion uses a confirmation and processing workflow. Backup copies age out separately, and legal retention exceptions may apply. For an organizational pilot, agree a return/deletion plan covering imported records, transcripts, derived data, credentials and backups. Contact to review scope and timing.
DPA and security reviews
A draft FindTime Data Processing Agreement is available on request for review. Any applicable data-processing agreement must be agreed between FindTime and the customer before taking effect. Provider DPAs describe provider processing for FindTime; they do not replace an agreement between FindTime and your organization.
Request the draft or an organizational security review below. We can discuss processing scope, provider terms and available security evidence. This overview is not an independent audit or certification and does not promise contractual response or deletion deadlines.
Report a security issue
Send vulnerability reports or suspected security incidents to . Include enough detail to reproduce the issue, without sending credentials or unnecessary personal data. Security contact information is also available in security.txt.