Privacy Policy

Last Updated: May 4, 2026

1. Introduction

Welcome to Nammaflow CRM, a product operated by Nammaflow Technologies ("Company", "we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Customer Relationship Management (CRM) platform, including our website, web application, and mobile application (collectively, the "Service").

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

2. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, phone number, company name, and role when you register for the Service.
• Usage Data: Pages visited, features used, actions taken, session duration, device type, operating system, browser type, and IP address.
• Lead & Customer Data: Contact details, call logs, activity notes, messages, documents, and any other data you enter into the CRM as part of your business operations.
• Communication Data: SMS and WhatsApp messages sent via the platform, voice call recordings (if enabled), and chat messages.
• Payment & Billing Data: Invoice details, payment records, and subscription information. We do not store full credit or debit card numbers; payments are processed through PCI-compliant third-party providers.
• Technical Data: Log files, error reports, and performance analytics to operate and improve the Service.

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service.
• Authenticate users and secure your account (including OTP-based two-factor authentication).
• Process transactions and send related billing notices.
• Send service-related notifications, updates, and support messages via WhatsApp, SMS, or email.
• Monitor usage patterns to improve features and user experience.
• Enforce our Terms & Conditions and comply with legal obligations.
• Detect, prevent, and respond to fraudulent, unauthorized, or illegal activity.

4. Data Sharing and Disclosure

We do not sell or rent your personal data to third parties. We may share data only in these circumstances:

• Service Providers: Trusted vendors who assist with hosting, telephony, messaging (e.g., WhatsApp API providers), payment processing, and analytics — bound by confidentiality agreements and only given access to data necessary to perform their service.
• Legal Requirements: When required by applicable Indian law, regulation, court order, or governmental authority.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred. You will be notified in advance.
• With Your Consent: For any other purpose with your explicit consent.

5. Workspace Data Isolation

Nammaflow CRM is a multi-tenant platform. Each organization (workspace) has its data logically isolated from other workspaces. Employees of one workspace cannot access data belonging to another workspace. Workspace administrators are responsible for managing access permissions within their workspace.

6. Data Retention

We retain your data for as long as your account is active or as necessary to provide the Service. Upon account termination, data may be retained for up to 90 days for backup and recovery purposes, after which it is securely deleted. Lead and activity data is retained for the period specified in your subscription plan.

7. Security

We implement industry-standard security measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit.
• Encrypted storage for sensitive credentials and tokens.
• JWT-based authentication with 8-hour session expiry.
• OTP-based two-factor authentication for all logins.
• Regular security reviews and access control audits.

No method of transmission or storage is 100% secure. If you become aware of a security issue, please contact us immediately at security@nammaflow.in.

8. Cookies and Tracking

We use session cookies and localStorage to maintain your login session and user preferences (such as theme and language). We do not use third-party advertising cookies. Essential cookies cannot be disabled as they are required for the platform to function.

9. Third-Party Integrations

The Service integrates with third-party providers including telephony systems (PBX, WebRTC), WhatsApp Business API providers (e.g., Askeva, WATI, Meta), and SMS gateways. When you use these integrations, data may be transmitted to those providers. Their use of your data is governed by their own privacy policies.

10. Children's Privacy

The Service is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us for deletion.

11. Your Rights

As a user in India, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations.
• Portability: Request your data in a structured, commonly used format.
• Objection: Object to certain types of processing of your personal data.

To exercise your rights, contact us at privacy@nammaflow.in. We will respond within 30 days.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

• Company: Nammaflow Technologies
• Email: privacy@nammaflow.in
• Support: support@nammaflow.in