Privacy Policy

Connect CRM is operated by Nexify Infotech LLP. You can reach us for any privacy question, or to raise a grievance, at info@nexify.co.in. Our registered address is Nexify Infotech LLP, A-1003, Pioneer Belina, Canal Road, Bhimrad, Opp. Meera Heights, Vesu, Surat, Gujarat 395017, India.

Connect CRM serves businesses. Our relationship to the data depends on whose data it is.

• For the data of our own account holders (your name, email, phone, organisation and billing details), Nexify Infotech LLP is the data fiduciary, also called the controller, and this policy governs how we handle it.
• For the CRM data our customers upload and process (their leads, contacts, conversations and related records), the customer is the data fiduciary, or controller, and Nexify Infotech LLP acts only as the data processor on that customer's instructions. If your personal data appears in a business's Connect CRM account because you dealt with that business, that business is responsible for it and you should contact them first. We will help route your request to them.

• Account data: your name, work email, phone number, a securely hashed password, your organisation name, role and preferences, and billing and tax details needed for subscriptions.
• Customer CRM data, processed on behalf of our customers: the leads and contacts a customer stores, which can include names, phone numbers, email addresses, postal addresses, notes, tags and custom fields the customer defines.
• WhatsApp, calling and messaging data: the content and metadata of messages sent and received through the WhatsApp Business Platform, call logs, delivery and read status, and, where a customer enables recording with the required consent, call recordings.
• Usage and device data: log data, IP address, browser and device information, app version, and how features are used, collected to keep the service secure and reliable.
• Cookies and similar technologies: we use only the essential cookies needed to sign you in and keep your session secure. We keep these to a minimum and do not use them for advertising.

We use personal data to:

• provide, operate and maintain the service and its features;
• authenticate users and protect accounts;
• send and receive WhatsApp messages and calls that you initiate through the platform;
• process subscriptions, payments, invoices and wallet balances;
• provide customer support and respond to your requests;
• keep the service secure, prevent fraud and abuse, and debug problems;
• improve the product and understand how it is used, in aggregate; and
• comply with legal, tax and regulatory obligations.

Our legal bases under the DPDP Act are your consent, the performance of the contract or service you have asked for, and the other legitimate and legal uses that the law permits. Where we rely on consent, you can withdraw it at any time.

Connect CRM connects to the WhatsApp Business Platform provided by Meta. Data obtained through WhatsApp and Meta is used only to provide the messaging features you enable, such as your team inbox, templates, broadcasts and automations, and is handled in line with Meta's Platform terms and policies. We do not use WhatsApp or Meta data for advertising, and we do not sell it.

We do not sell personal data. We share data only with the service providers, called sub-processors, that we need in order to run the platform, and only for that purpose. These include, described in general terms:

• Meta, for the WhatsApp Business Platform;
• Razorpay, for payments and subscription billing;
• telephony providers, for calling and virtual numbers;
• shipping and logistics providers, for order fulfilment where you use it;
• cloud hosting, email and SMS providers, for infrastructure and notifications.

Each sub-processor acts under a contract and is permitted to use the data only to provide its service to us. We may also disclose data where the law requires it, or to protect the rights, safety and security of our users and the service.

We keep account and CRM data while your account is active and for as long as we need it to provide the service, to meet legal, tax and accounting duties, and to resolve disputes. You can export or delete your data at any time. See our Data Deletion page. Audit and consent logs are retained for at least one year. After an account is closed, or after a verified erasure request, we delete or anonymise your personal data within the timelines described on the Data Deletion page and no later than 90 days, except where we must keep certain records by law.

Your data is hosted in data centres located in the India region. Where a sub-processor must be used for a specific feature, we take steps to keep the data protected consistent with this policy and applicable law.

We use appropriate technical and organisational measures to protect personal data, including:

• encryption in transit using TLS and encryption at rest using AES-256;
• strict row-level tenant isolation so one customer cannot see another customer's data;
• role-based access controls and least-privilege access for our team;
• encrypted storage of integration credentials, signed webhooks, and secret management;
• monitoring, logging and regular reviews of our security posture.

If a personal data breach occurs, we will act promptly to contain and investigate it. We will notify the Data Protection Board of India and affected users as required by law, and we aim to notify affected users within 72 hours of becoming aware of the breach where it is feasible to do so.

Subject to the DPDP Act, you have the right to:

• access a summary of the personal data we process about you;
• ask us to correct, complete or update your personal data;
• ask us to erase your personal data when it is no longer needed;
• raise a grievance about how your data is handled; and
• nominate another person to exercise your rights in the event of death or incapacity.

You can exercise most of these rights yourself inside Connect CRM, under Settings and then Privacy or Data requests, or you can email us at info@nexify.co.in.

You can request an export or deletion of your data in two ways: use the self-serve tools inside Connect CRM (Settings, then Privacy or Data requests), or email us at info@nexify.co.in. Full details, including what is deleted and the timeline, are on our Data Deletion page.

If you have a question or a grievance about your personal data, contact Nexify Infotech LLP at info@nexify.co.in, or write to us at Nexify Infotech LLP, A-1003, Pioneer Belina, Canal Road, Bhimrad, Opp. Meera Heights, Vesu, Surat, Gujarat 395017, India. If you are not satisfied with our response, you may approach the Data Protection Board of India.

Connect CRM is a business tool and is not intended for anyone under the age of 18. We do not knowingly onboard children or knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, and for material changes we will provide a more prominent notice. Your continued use of the service after an update means you accept the revised policy.

Nexify Infotech LLP, operator of Connect CRM. Email info@nexify.co.in. Registered address: Nexify Infotech LLP, A-1003, Pioneer Belina, Canal Road, Bhimrad, Opp. Meera Heights, Vesu, Surat, Gujarat 395017, India.