Credivo CRM

Privacy Policy

Last updated: 4 October 2026

1. Who we are

This Privacy Policy explains how Credivo CRM ("Credivo", "we", "us") handles personal data on our website and in the Credivo CRM service. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

2. Two different roles

• Website visitors and our own customers. When you fill our demo form or buy a plan, we decide how your data is used. We are the Data Fiduciary for this data.
• Data inside a customer's CRM. The leads, chats, notes and documents that a business stores in its CRM belong to that business. The business is the Data Fiduciary and we act only as its Data Processor, following its instructions. If you are a customer of a business that uses Credivo CRM, please contact that business first about your data; we will help them respond.

3. What we collect

From the website

• Demo form: name, mobile number, business type, city, team size and your message. It is saved as a lead in our own CRM so our team can call you.
• Spam protection: your IP address is held briefly in memory to limit repeated form submissions. It is not stored in a database.
• Ad source: if you reached us from an ad or campaign link, the campaign details in that link (utm_source, utm_medium, utm_campaign, fbclid) are saved with your demo request so we know which ad worked.
• No tracking: the website does not use advertising, analytics or tracking cookies.

From businesses that use the CRM (our customers)

• Account data: names, usernames and phone numbers of the business's users, and hashed passwords (we never store passwords in readable form).
• Billing data: business name, contact person, phone, email and payment records. Card or UPI details are handled by the payment provider, not stored by us.
• Usage data: technical logs (time, page, errors) used to keep the Service secure and working.

Customer Data processed for a business

• Lead details entered by the business (such as name, phone, city, loan or product details, notes and follow-ups).
• WhatsApp messages exchanged through the business's WhatsApp Business number, delivered to us by Meta.
• Source information from Facebook / Instagram click-to-WhatsApp ads, when the business runs such ads.
• Documents uploaded by the business's staff or by its customers through an upload link. These are passed straight to the business's own office computer and are not stored on our servers. WhatsApp photos and files are fetched from Meta when someone views them and are not kept by us.
• Files a business saves in its "Saved files" library (for example a brochure or EMI chart), which are stored in its CRM database.

4. How we use data

• To provide the Service: show leads, send and receive WhatsApp messages, remind about follow-ups, send phone notifications, create reports and automate tasks that the business has switched on.
• To contact people who requested a demo, and to provide support and billing to our customers.
• To keep the Service secure, prevent misuse and fix problems.
• To meet legal obligations.

We do not sell personal data, we do not use Customer Data for advertising, and we do not use Customer Data to train artificial-intelligence models.

5. Who we share data with

We share data only with service providers that help us run the Service, under appropriate confidentiality and security terms:

• Hosting provider that runs our servers and stores the CRM databases.
• Meta Platforms (WhatsApp Business Platform), when a business connects its WhatsApp number, to send and receive its messages.
• Browser push services (such as Google, Apple and Mozilla), only to deliver notifications to users who switch them on.
• Content delivery networks (Google Fonts, cdnjs) that serve fonts and code libraries to your browser and can see your IP address.
• Payment provider, to process payments for our plans.
• Authorities, when required by law or a valid legal order.

Some of these providers may process data outside India. Where they do, we rely on providers with strong security practices and follow any restrictions notified under Indian law.

6. Cookies and storage

• The CRM uses one essential cookie to keep users logged in. It is not used for tracking.
• The CRM stores small preferences on the device (for example, a dismissed message) and registers a service worker so it can be installed as an app and show notifications.
• The marketing website sets no cookies.

7. How long we keep data

• Demo-form leads: up to 24 months after our last conversation, unless you become a customer or ask us to delete them earlier.
• Customer Data: for as long as the business's subscription is active. After it ends, the business can export its data for 30 days; then we delete it from our servers. Server backups roll over within 7 days.
• Billing records: as long as tax and accounting laws require (generally 8 years).

8. Security

• Encrypted connections (HTTPS) for all traffic.
• Each business gets its own separate installation and database.
• Passwords stored only as secure hashes; role-based access so staff see only their own leads.
• Incoming WhatsApp webhooks are verified with Meta's signature; the office-PC bridge and backup downloads use secret keys.
• Daily backups, with a copy kept on the business's own office computer.

No system is perfectly secure. If a personal data breach affects you, we will inform the affected business (and, where required, the Data Protection Board of India and affected individuals) without undue delay.

9. Your rights

Subject to the law, you can ask to access a summary of your personal data, correct or update it, erase it, withdraw consent, and nominate another person to exercise these rights on your behalf. For data inside a business's CRM, please send your request to that business; we will assist it. For data we hold as Data Fiduciary (for example a demo request), contact us using the details below. You may also complain to the Data Protection Board of India if you are not satisfied with our response.

10. Children

The Service is meant for businesses and is not directed at anyone under 18. We do not knowingly collect personal data of children through our website.

11. Changes to this policy

We may update this policy. The "Last updated" date above shows the latest version, and we will inform customers of material changes in advance.

12. Grievance officer

For questions or complaints about personal data, contact our grievance officer at the details below.

Contact

Questions, requests or complaints about this document can be sent to us here. We reply within 2 working days and resolve grievances within 30 days.

• [COMPANY KA NAAM]
• Address: [POORA ADDRESS]
• Email: [EMAIL]
• WhatsApp / Phone: +91 70886 28862

Also read: Terms of Service · Refund & Cancellation Policy