This agreement forms part of the service agreement. You decide why and how the personal data in your CRM is used (you are the controller, or "data fiduciary" in India). We host and process it on your behalf (the processor).
1. What we process
- People: your contacts and leads, your clients and their staff, your own users.
- Data: names, contact details, company details, notes, messages, emails, call recordings and transcripts, proposals, invoices and anything else you or your systems put into the CRM.
- Purpose and duration: to provide the service, for as long as the service agreement runs and until deletion under section 7.
2. Your instructions
We process the data only on your documented instructions – the service agreement, the settings you choose in the CRM and your written requests – unless a law requires otherwise, in which case we tell you first where the law allows.
3. Confidentiality
Everyone at Shubhankar Chakraborty who can access your data is bound to keep it confidential and accesses it only to run, update, back up or support your CRM.
4. Security
- A separate server for your CRM; HTTPS; rate limits; passwords hashed; connector keys, mailbox passwords and two-step secrets encrypted.
- Roles and rights, optional or required two-step login, an audit log of every change by your users.
- Nightly encrypted backups with an off-site copy, kept 14 days, and a weekly test restore.
- Security updates applied promptly.
5. Sub-processors
| Who | What for | Where |
|---|---|---|
| Hostinger | Hosting your private server and its backups | the data centre region named in your order |
| Backblaze (B2 Cloud Storage) | Encrypted off-site backup copies (encrypted before they leave your server) | United States (US East) |
Providers you connect yourself – your mailboxes, calling, SMS and WhatsApp providers, payment providers, Google and Meta for reports – work under your own contracts with them. We tell you before we add or replace a sub-processor, so you can object.
6. Breaches and your requests
- We tell you without undue delay, and within 48 hours, after becoming aware of a breach affecting your data, with what we know and what we are doing.
- We help you answer requests from people about their data; the CRM has tools to download or erase one person's data and to record consent.
- We help with impact assessments and questions from authorities where they concern our service.
7. End of the service
At the end we give you a full export on request and then delete your server and its backups 30 days after the end date, unless a law requires us to keep something.
8. Checks and transfers
We answer reasonable questions about our security and give you the information you need to show you meet your duties. If data is transferred between countries, we use the safeguards the applicable law requires, such as standard contractual clauses.
Other policies: Privacy · Terms of use · Service agreement · Data processing · Refunds · Cookies