# NAJIHA BUYER CRM — Online Edition (deployment starter)

This is a deploy-ready browser app with Supabase Auth + PostgreSQL. It is not yet hosted at crm.najihaglobal.com; you must create the Supabase project and upload these files to hosting.

## 1. Create Supabase
1. Create a project at https://supabase.com/
2. Open SQL Editor and run all contents of `supabase_setup.sql`.
3. In Project Settings → API, copy Project URL and anon/public key.
4. In Authentication → URL Configuration, add your final CRM URL to Site URL / Redirect URLs.
5. For first use, open `index.html`, paste URL and anon/public key, then create an account.
6. Confirm email if email confirmation is enabled, then sign in.

IMPORTANT: Only use the anon/public key in the browser. NEVER put service_role or secret keys in `index.html`.

## 2. Upload to your hosting
Upload these files to a private subdomain document root, for example `crm.najihaglobal.com`:
- index.html
- prospects_australia.json
- prospects_australia.csv
Use hosting File Manager or FTP. Enable HTTPS/SSL before use. Keep the CRM separate from the public WordPress site.

## 3. Import starter prospects
After login, Buyer Database → “Import 50 Australia prospects”. The list is a starting prospect list, not 50 confirmed buyers. Review company and product fit before outreach.

## 4. What works
- Supabase email/password authentication
- Private per-user leads table enforced by Row Level Security
- Add/edit/delete buyer records
- Dashboard counts
- Follow-up worklist
- Import starter prospects
- CSV export
- Public web search launcher
- Outreach message templates and email draft via mailto

## 5. What is NOT automated yet
- No autonomous web crawling or guaranteed buyer verification
- No automatic bulk email/WhatsApp sending
- No automatic email inbox sync or reply detection
- No scheduled server-side reminders
- Apollo / HubSpot connectors are separate integrations and are not connected by this package

For automatic prospect enrichment, email delivery and scheduled follow-up, add a secured backend/approved API integration, consent/compliance checks, rate limits, unsubscribe handling and user approval before sending. Do not expose API secrets in browser code.

## 6. Data & privacy
Supabase RLS policies restrict leads to the authenticated owner. Use a strong password, enable MFA if available, and do not share the anon key together with any service-role secret. Export regular CSV backups.
