Privacy Policy
Last updated: October 13, 2026
This policy explains how Ultimate Customizer (“we”, “us”) handles information when HighLevel agencies use Ultimate Customizer (the “App”), its website and its HighLevel Marketplace integration.
Information we collect
- Agency account data from HighLevel: when you install the App we receive your agency’s Company ID, the installing user’s HighLevel user ID, your agency name, and OAuth access and refresh tokens for the permissions you approve (by default only read access to company details).
- Theme settings: the colors, effects, menu names and other settings you save in the customizer, including any custom CSS, image links and text you enter.
- Domains: the CRM domains you connect, the domains our files are loaded from, and domains that request your files without permission (for license protection).
- Technical data: IP addresses are used briefly to prevent abuse (rate limiting) and appear in our hosting provider’s logs. We do not use them to build profiles.
- Cookies: we use strictly necessary cookies only, to keep you signed in to your app page and to protect sign-in. The customizer stores an editor key and cached logos in your browser’s local storage. We use no advertising or analytics cookies.
Information we do not collect
The App does not read, store or transmit your contacts, conversations, opportunities, payments or other CRM records. The script runs in your users’ browsers to apply the design. It only inspects the signed-in user’s role and company to enforce the license and to show the customizer to admins, and this information is not sent to us.
How we use information
- To provide the App: generate your theme files and serve them to your connected domains.
- To verify and enforce your license, including detecting use on unauthorized domains.
- To confirm the App is still installed with HighLevel.
- To provide support and respond to you.
- To keep the service secure and comply with legal obligations.
Sharing
We do not sell or rent personal information. We share data only with service providers that run the App on our behalf: Vercel (hosting) and MongoDB Atlas (database), with HighLevel as needed to operate the integration, or when required by law.
Security
Data is sent over HTTPS. OAuth tokens are encrypted at rest (AES-256-GCM), sessions are signed, and access to the Super Admin panel is restricted. No method of transmission or storage is completely secure, but we work to protect your information.
Retention
We keep agency data while the App is installed and for as long as needed to provide support and keep license records. Activity logs are deleted automatically after 180 days. You can ask us to delete your agency’s data at any time.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your information, or to object to some processing. To make a request, email idylle_radieuse@outlook.com from an address associated with your agency and include your Company ID.
International transfers
Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards for these transfers.
Children
The App is a business tool and is not directed to children.
Changes
We may update this policy. We will change the date above, and for material changes we will notify you by email or in the App.
Contact
Ultimate Customizer · idylle_radieuse@outlook.com