Privacy Policy

1. Introduction

Welcome to CRM Platform ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our customer relationship management platform, including any associated websites, applications, and services (collectively, the "Service").

By accessing or using our Service, you agree to the terms of this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, company name, job title, and password when you register for an account.
• Organization Data: Company address, industry, size, website, tax identification numbers, and billing information.
• CRM Data: Lead and contact information, communication records (emails, calls, messages), notes, tasks, deals, invoices, proposals, contracts, and any other data you input into the Service.
• Payment Information: Credit card numbers, bank account details, and billing addresses processed through our third-party payment processors (Stripe, Razorpay).
• Communication Data: Emails sent and received through connected email accounts, call recordings (with consent), SMS messages, and WhatsApp messages.
• File Uploads: Documents, images, and other files you upload to the Service.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, time spent, and interaction patterns within the Service.
• Device Information: IP address, browser type, operating system, device identifiers, and screen resolution.
• Cookies and Tracking: We use essential cookies for authentication and session management. We use analytics cookies to understand how the Service is used.
• Log Data: Server logs including access times, error logs, and API request metadata.

2.3 Information from Third Parties

• OAuth Providers: When you connect Google or Microsoft accounts, we receive email access tokens and profile information as authorized.
• Payment Processors: Transaction confirmations and payment status from Stripe and Razorpay.
• Communication Providers: Call metadata and delivery status from Twilio.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and send related information (invoices, receipts, payment confirmations)
• Send administrative notifications (service updates, security alerts, support messages)
• Respond to your comments, questions, and customer service requests
• Analyze usage patterns to improve the Service
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms of service
• Provide AI-powered features (lead scoring, email drafts, proposal generation) using anonymized and aggregated data

4. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encryption at Rest: Sensitive data (OAuth tokens, API keys, credentials) is encrypted using AES-256-GCM.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+.
• Password Security: Passwords are hashed using bcrypt with a cost factor of 12.
• Access Controls: Role-based access control with granular permissions ensures users only access data they are authorized to see.
• Multi-Tenancy Isolation: Each organization's data is logically isolated using organization-level scoping on every database query.
• Audit Logging: All data access and modifications are logged for security auditing.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data in the following circumstances:

• Service Providers: Third-party services that help us operate (cloud hosting, email delivery, payment processing, error tracking).
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.
• With Your Consent: We may share data with third parties when you explicitly authorize us to do so.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymize your data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).

Soft-deleted records (leads, contacts, tasks) are retained for 30 days before permanent deletion, allowing recovery if needed.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we limit the processing of your data.
• Objection: Object to the processing of your data for certain purposes.
• Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at privacy@crmplatform.com.

8. Cookies

We use the following types of cookies:

• Essential Cookies: Required for authentication and session management (httpOnly, secure).
• Preference Cookies: Store your UI preferences (theme, sidebar state).

We do not use third-party advertising or tracking cookies.

9. International Data Transfers

Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and compliance with applicable data protection laws.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at: