Privacy Policy

You — the individual whose data we process, whether you are a customer, a contact in your lead pipeline, or a visitor to a public page — are the data principal under the DPDP Act. We are the data fiduciary for data we hold on your behalf.

If you are an agency customer, we also process the personal data of your leads and clients (your customers' data) on your behalf — in that relationship you are the data fiduciary for that data, and the Data Processing Terms govern that relationship.

We process the following personal data:

We do not collect sensitive personal data (biometric, health, sexual orientation, etc.) unless you explicitly store it in a free-form note field — in that case you are responsible for the purpose and consent basis for that data.

We process your personal data on one or more of the following bases under the DPDP Act:

• Contract: providing the Service you subscribed to (account, billing, CRM records you explicitly entered).
• Consent: marketing outreach over WhatsApp / email. Public form submissions capture a single "we may contact you about your enquiry" consent checkbox. You can withdraw consent at any time by asking us to opt out — we record a per-lead WhatsApp opt-out flag and honor it on every send path.
• Legal obligation: retaining GST invoices and payment records for the statutory period.
• Public interest / legitimate interest: protecting the platform against abuse (rate-limiting, security incident response).

We share personal data only with the subprocessors listed in the Sub-processor List, for the purposes described there. We never sell personal data or share it for marketing by third parties.

We keep your data for as long as your subscription is active. After cancellation, we keep a 30-day grace window so you can export everything. After that, we delete your personal data and all tenant rows, except where the law requires us to retain a record (GST invoices, payment settlement records — kept up to 8 years per the Income Tax Act).

Under the DPDP Act you have the right to:

• Access: download your personal data in a machine-readable format (workspace export).
• Correction: update your contact details, business details, and record fields.
• Erasure: delete your account and associated data (account deletion + workspace close).
• Complaint: raise a grievance with our Grievance Officer (page).

Some subprocessors (Amazon SES, Anthropic, Meta, DigitalOcean, Cloudflare) operate in the United States. Where personal data transfers to a subprocessor abroad, we rely on the contractual and certification bases available under the DPDP Rules. No data is transferred to a jurisdiction without a recognised legal mechanism.

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 on the primary database, object storage). Access is controlled by role-based permissions and tenant isolation. Integration credentials (Razorpay, Meta, Google) are stored in an encrypted envelope (S1.1 standard). We maintain a vulnerability disclosure policy and run periodic access reviews.

If a personal data breach occurs, we will notify affected data principals without unreasonable delay, consistent with the DPDP Act's notification duty. You will also be notified by email if your contact details are affected.

The Service is for businesses aged 18+. We do not knowingly process the data of children under 18. If you believe a minor's data has been submitted through a public form, contact us and we will delete it.

Questions about this Policy: support@microlevelcrm.com. Data protection queries are routed to the Grievance Officer (Grievance Officer page).