Privacy policy

CallCRM ("we", "us") provides a call-tracking and lead-management service to companies ("customers") whose salespeople make calls from Android phones. This policy explains what personal data the service handles, why, who sees it, how long it is kept and what you can ask of us. It is written for three readers: company owners and admins who use the dashboard, salespeople who use the app, and the people they call.

1. Roles

The customer company decides which leads to call, which salespeople to enrol and whether to record calls. Under the Digital Personal Data Protection Act 2023 the company is the data fiduciary for its leads and employees, and CallCRM is its data processor: we handle data on the company's instructions and for no other purpose. For the account data of owners and admins (your name, email, login), CallCRM is the fiduciary.

2. What we collect

From company accounts

• Name, work email, work phone number and role of each dashboard user; password hashes, never passwords.
• Company name, time zone, settings and billing details.

From the salesperson app, after the salesperson has read the disclosure and agreed

• Call log entries of the SIM(s) the salesperson marks as work SIMs: number called or calling, start time, duration, ringing time and call type. Calls on other SIMs are never read.
• SIM identifiers and the phone's make, model, Android version and app version.
• App health: permission state, battery settings, last sync time, so admins can fix setup problems.
• What the salesperson enters: call outcomes, notes, follow-ups, new leads.
• Call recordings, only if the company turned recordings on and the salesperson allowed access: the app uploads the files that the phone's own call recorder saved for answered calls on the work SIM. CallCRM never records audio itself and never reads other audio on the phone.

What the app never reads

Contacts, messages, emails, other apps, location, or the personal SIM.

About leads (the people being called)

Names, phone numbers, email addresses and notes about leads come from the company, which uploaded or entered them. CallCRM stores them and links them to calls. If you are a lead and want to know what a company holds about you, contact that company; we help them answer.

3. Why we process it

• To run the service: show calls, leads and follow-ups to the company and its salespeople.
• To transcribe and review recorded calls, when the company has turned this on.
• To keep the service secure, detect abuse and fix problems.
• To send account emails such as password resets. We do not send marketing email to salespeople or leads.

We do not sell personal data and do not use it to train AI models.

4. Who processes data for us

CallCRM runs on these providers, each bound by a contract that limits them to providing their service:

• Vercel (dashboard hosting) and a virtual server in Mumbai, India (application and background jobs).
• Neon (database, hosted in Singapore).
• Cloudflare R2 (file storage for recordings and imported files).
• Sarvam AI (speech-to-text) and DeepSeek (written review of the transcript). They receive the audio or the transcript of recorded calls and the salesperson's first name; they never receive phone numbers. Both may process data outside India. Companies that do not want this keep recordings or AI analysis switched off.
• An email provider for account emails.

5. How long we keep it

• Account, lead and call data: for as long as the company's account is active.
• Recordings, transcripts and AI reviews: for as long as the company keeps them; admins can delete them at any time, and a company can ask us to delete all of them.
• Audit logs (who played or exported what): one year.
• After a company closes its account, everything is deleted within 30 days, except invoices and records we must keep by law.

6. Security

Data moves over HTTPS only. Access is limited by role: a salesperson sees only their own leads, calls and recordings; owners and admins see their company. Recording playbacks and exports are written to an audit log. Backups are kept so that a fault does not lose your data. No system is perfectly secure; if a breach affects your data we will tell the affected company and, where the law requires, the authorities without undue delay.

7. Your rights and choices

• Salespeople: you can stop tracking at any time by signing out of the app; the tracking notification disappears and nothing more is read. Calls already synced stay with your company.
• Everyone: you can ask for access to, correction of, or deletion of your personal data, and you can withdraw consent you gave. Write to privacy@callcrm.xyz. Where the company holds your data as fiduciary, we forward the request to it and help it respond; where we are the fiduciary, we answer within 30 days.
• Leads: ask the company that called you to stop; it can mark you "do not call" and remove your details.

Grievance contact under the DPDP Act: privacy@callcrm.xyz. If you are not satisfied with our response you may approach the Data Protection Board of India once it is operational.

8. Children

CallCRM is a business tool for adults. We do not knowingly process data of anyone under 18 as a user of the service.

9. Cookies

The dashboard uses only the cookies needed to keep you logged in and to protect forms from forgery. There are no advertising or tracking cookies.

10. Changes

When this policy changes we update the date at the top and, for material changes, tell company owners by email before they take effect.

11. Contact

privacy@callcrm.xyz for privacy matters, support@callcrm.xyz for everything else. See also the terms of service.