We collect only what we need to run your CRM account. We don't sell your data, we don't share it with ad networks, and we don't use it to train any AI model. Your customer records in TatvaCRM belong to you. If you ever want your data removed, email support@tatvacrm.com and we'll delete it within 30 days.
1.Who we are
TatvaCRM is a product operated by Tatva Fintech Pvt. Ltd., a private limited company incorporated in India with its registered office in Pune, Maharashtra. For the purposes of the Digital Personal Data Protection Act 2023, Tatva Fintech Pvt. Ltd. acts as a Data Fiduciary in respect of data we collect directly from you on tatvacrm.com, and as a Data Processor in respect of personal data you enter into your TatvaCRM workspace about your own customers.
2.Data we collect
We collect personal data in three contexts, and only for the purposes described below.
2.1 Account data
When you sign up, we collect your name, work email, a password hash, your company name, and optionally your phone number and role. We use this to create your account, authenticate you, and send you service-related messages.
2.2 Workspace data
When you use TatvaCRM, you create records — contacts, companies, deals, tasks, notes, files. These records may contain personal data about your own customers. We store this data on your behalf and never access it except when you explicitly request support or when legally compelled by a valid order.
2.3 Technical data
We collect standard server logs containing IP addresses, user agents, and request timestamps. We use these for security monitoring, abuse prevention, and debugging. We do not use third-party analytics products that track users across sites.
3.How we use it
- To provide and operate TatvaCRM
- To send you transactional emails (password resets, billing receipts, security alerts)
- To respond to your support enquiries
- To detect and prevent fraud, abuse, and security incidents
- To comply with legal obligations when we receive a valid legal request
We do not use your data to train any machine learning or AI model, we do not sell it to advertisers, and we do not share it with data brokers.
4.Sharing & sub-processors
We use a small number of infrastructure providers to run the service. The full list and what each one processes is maintained on our Security page. We notify customers 30 days before adding or changing any provider.
WhatsApp & Meta: Where you connect a WhatsApp Business account, we process messages and contact identifiers through the WhatsApp Business Platform provided by Meta Platforms, Inc. so that you can message your contacts. We share with Meta only what is needed to deliver those messages; Meta handles that data under its own terms and privacy policy. You can ask us to delete the WhatsApp data we store at any time — see our Data Deletion page.
Lead capture integrations. Where you connect a lead source to your workspace — a Google Ads lead form or your own website's server — we receive the enquiry details that source sends, such as name, email address, phone number, the answers to your form questions, and campaign and click identifiers (for example Google Ads campaign, form and click IDs), and we create a lead in your workspace on your behalf. You choose which sources to connect and what your forms ask, and you are responsible for telling the people who complete your forms how their details will be used, including linking your own privacy policy where the source requires it. We use these details only to create, assign and attribute the lead in your workspace. We do not use them for advertising, and we do not send conversion or other data back to Google.
5.Where we store it
Customer data is stored in AWS RDS PostgreSQL (Mumbai). File attachments are stored in Backblaze B2. Cache and queue data is stored in AWS ElastiCache (Redis, Mumbai).
All customer data is already stored in India (Mumbai) on every plan. If you have a hard contractual requirement around data residency, contact us and we'll walk you through the specifics.
6.Retention
We retain your data for as long as your account is active. If you delete your account or cancel your paid plan and don't renew, we retain your data for 30 days, then permanently delete it from our production database. Encrypted backups are retained for a further 30 days and then rotated out.
Lead capture records. So that an enquiry is not lost if processing is briefly delayed, each enquiry received through a lead capture integration is held as an encrypted processing copy until its lead is created, and for no longer than 7 days from when we first received it. The copy is deleted once the lead is created; an enquiry that cannot be processed within 7 days is deleted and cannot be recovered. We also keep a delivery record so that the same enquiry is never created twice. It holds the source's reference for the enquiry (such as the Google Ads lead ID or your website's submission ID), the integration it arrived through, the ID of the lead it created and processing dates. Processing details are removed from it after 180 days; the references themselves are kept for as long as your workspace exists. When a lead is created we also keep a record of how it was assigned, together with the campaign, form and click identifiers the source sent; this record is kept for as long as your workspace exists, including after the lead is deleted. Deleting a lead moves it to Trash, from where it is permanently deleted after 30 days, or sooner if Trash is emptied; this does not remove the delivery or assignment records. These records contain identifiers that can relate to a person, and we protect them as personal data.
7.Your rights
Under the DPDP Act 2023 and equivalent international frameworks, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Erase your data, subject to legal retention requirements
- Port your data to another service via CSV export, built into the app
- Withdraw consent where consent is the basis for processing
- File a grievance with us, or with the Data Protection Board of India if unresolved
To exercise any of these rights, email support@tatvacrm.com. We respond within one working day and fulfil valid requests within 30 days.
For step-by-step instructions on deleting your account and data — including data processed through WhatsApp and Meta — see our Data Deletion page.
8.Security
Our security posture — encryption, schema-per-tenant isolation, access control, backup policy, incident response — is documented in detail on our Security page.
9.Minors
TatvaCRM is a business tool and is not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us and we will delete it.
10.Changes to this policy
We update this policy when the product changes, when the law changes, or when we add or remove a sub-processor. Material changes are announced to all account holders by email at least 30 days before they take effect.
11.Contact us
For any question about this policy, to exercise your data rights, or to raise a grievance:
Email: support@tatvacrm.com
Post:
Grievance Officer, Tatva Fintech Pvt. Ltd., Pune, Maharashtra, India.
For questions about this policy, email support@tatvacrm.com.