CRMish

Webhook Integration Terms

Effective date: 2026-05-28 · DRAFT v1 — counsel review required

> Not legal advice. Working draft. These Webhook Integration Terms apply when you enable CRMish to receive incoming webhook events from third-party services (ClickFunnels, GoHighLevel, Kajabi, or any other source you configure).

1. What this covers

CRMish's contact-webhook endpoint lets third-party services automatically send contact records into your CRMish workspace when an event happens in that third-party service. These Webhook Integration Terms ("Webhook Terms") govern your use of that feature.

These Webhook Terms form part of, and are subject to, the Terms of Service, Privacy Policy, Acceptable Use Policy, Anti-Spam Policy, and Data Processing Addendum.

2. Roles

  • You are the controller of contact data you cause to be sent to CRMish via webhook.
  • CRMish is the processor of that contact data on your behalf.

This DPA-style relationship is described in detail in the Data Processing Addendum.

3. Your warranties

By enabling and using webhook ingest, you represent and warrant that:

3.1 Lawful basis

You have a lawful basis under applicable law (consent, contract, legitimate interest, or otherwise) to share each contact record with CRMish and to use it in the ways you intend.

3.2 Source-platform compliance

The third-party service from which you import contacts has presented each contact with disclosures consistent with applicable law (e.g., GDPR Articles 13–14, CASL, applicable U.S. state laws). You will not configure a source platform to circumvent its own privacy notices.

3.3 Right to import

You have the right to import each contact record, including (where applicable) the right to combine that record with your CRMish workspace data.

3.4 Honoring opt-outs

You will honor any opt-out, deletion, or access request from any imported contact, regardless of the channel through which the request reaches you.

3.5 No prohibited categories

You will not import:

  • Records you know or have reason to know were obtained without consent.
  • Records purchased from list brokers or scraped from public sources without verification of consent.
  • Records of persons under the minimum age required by law.
  • Special categories of personal data (race, religion, health, sexual orientation, political opinion, biometric, genetic) unless you have an explicit lawful basis and have informed CRMish in writing.

4. Authentication

  • The webhook endpoint authenticates inbound requests using a per-user secret generated in Settings → Integrations.
  • You are responsible for keeping this secret confidential. Treat it like a password.
  • If the secret is exposed, revoke and regenerate it immediately.
  • We may rate-limit or block requests that exceed a reasonable volume threshold.

5. Payload handling

  • Inbound payloads are size-limited (currently 8KB per event). Anything beyond the cap is truncated before storage.
  • Each event — whether accepted, rejected, or rate-limited — is recorded in the webhook events audit log for up to 12 months.
  • The audit log is accessible only to the user who configured the webhook secret.

6. Field mapping

  • CRMish provides default field mapping from common provider formats (ClickFunnels, GoHighLevel, Kajabi, generic JSON).
  • You may override the mapping per workspace in Settings → Integrations. Overrides apply prospectively only.
  • We do not validate the legal grounds for any specific mapping (for example, mapping a "phone" field is your representation that you may store that phone number).

7. CRMish's responsibilities

CRMish will:

  • Process inbound contact data only to deliver the Service to you.
  • Maintain the security measures described in the Security Overview and DPA §8.
  • Notify you of any confirmed Personal Data Breach affecting webhook data within 72 hours of confirmation.
  • Assist you with reasonable Data Subject requests received via your CRMish workspace.

CRMish will not:

  • Use contact data you import for our own marketing or model training.
  • Sell or share contact data with third parties for advertising.
  • Aggregate identifiable contact data across customers.

8. Errors and disputes

8.1 Inaccurate or unauthorized imports

If you import a contact in error or without authorization, you may delete the record from your workspace immediately. Deletion is propagated to backups per the Privacy Policy retention schedule.

8.2 Subject complaints reaching CRMish

If a contact complains directly to CRMish about being imported, we will:

  • Acknowledge the complaint to the contact.
  • Forward it to you for action where appropriate.
  • Take reasonable steps to suppress further processing of that contact in your workspace pending your response.
  • Cooperate with regulators if required.

9. Indemnification

You will indemnify, defend, and hold harmless CRMish from and against any third-party claims, regulatory actions, or losses arising out of (a) contact data you cause to be sent via webhook, (b) your messaging of imported contacts, or (c) your breach of these Webhook Terms.

10. Suspension

If we receive credible evidence that your webhook usage is non-compliant — particularly that you are importing contacts without consent or messaging them in violation of anti-spam law — we may:

  • Suspend the webhook endpoint for your account pending investigation.
  • Notify you and request that you stop the practice.
  • Terminate the feature or the account in serious or repeated cases.

11. Provider-specific notes

CRMish offers documentation for the following providers as of the effective date:

  • ClickFunnels — see /integrations/clickfunnels
  • GoHighLevel — see /integrations/gohighlevel
  • Kajabi — see /integrations/kajabi

Other providers may work via the generic JSON endpoint. CRMish makes no representation about a specific provider's reliability, data quality, or compliance posture — those are between you and that provider.

12. Changes

We may update these Webhook Terms. Material changes are posted here.

13. Contact

| For | Email | |---|---| | Integration support | integrations@crmish.io | | Privacy questions | privacy@crmish.io | | Abuse reports | abuse@crmish.io |

Document version: webhook-v1 · Last updated 2026-05-28.