Legal

Privacy Policy

What personal data SimplCRM holds, why we hold it, and what you can ask us to do about it. Effective 2 September 2026.

In short

SimplCRM holds two different kinds of personal data, and the distinction decides who is responsible for it. For your own account — your name, work email and sign-in — we are the data fiduciary. For the customer records you put into the CRM, you are the fiduciary and we act as a data processor on your instructions. We do not sell either, do not share either for advertising, and do not use the contents of a customer workspace to train machine-learning models.

At a glance

Effective: 2 September 2026
Data fiduciary: TechSlide IT Solutions, India
Registered office: [to be completed]
Grievance Officer: [to be completed]
Privacy contact: support@simplcrm.cloud
Applicable law: Digital Personal Data Protection Act, 2023 (India)

Which role we are in

Your account: we are the data fiduciary

When you sign up, ask for a demo, contact support or sign in, we decide why and how that data is processed, and we answer for it. This is the data described under "Your account" below.

Your CRM records: we are a processor for you

The leads, contacts, companies, quotations and correspondence inside your workspace are about your customers and your staff, not ours. You decide what goes in and why; we process it on your instructions to run the features you use. If one of your customers asks about their data, they should ask you — and we will help you answer.

What that means in practice

We do not decide what to do with the contents of your workspace, do not mine them, and do not disclose them except as this policy sets out or as you instruct. Where you end the agreement, we delete them on the timetable below rather than keeping a copy.

What we collect

Your account

Your name, work email address, the workspace you belong to, your role in it, and a password stored only as a scrypt hash — we never hold the password itself and cannot recover it, only reset it. Where you enable it, the settings for how you would like to be notified.

How the service is used

Server logs of requests, including your IP address, the time, and what was requested, kept to run and secure the service. An audit trail inside your workspace records who changed which record and when — by field name, never by value, so the trail does not become a second copy of your data with a longer retention period.

What you put into the CRM

Whatever your team enters: names, phone numbers, email addresses, company details, GSTINs, notes on conversations, quotations and their line items, and any custom fields your administrator adds. We do not require any particular field, and how much personal data a workspace holds is your decision.

A connected mailbox, if you connect one

If somebody connects Gmail or Microsoft 365, we read message headers and bodies to attach correspondence to the right record, and calendar events to show meetings. A new mailbox starts on known contacts only: a message is stored when it is to or from somebody already in the CRM, and personal mail is never read into it. That default can be widened, per mailbox, by an administrator who chooses to.

Leads from a connected Facebook or Instagram Page

If somebody connects a Page for Meta lead ads, we receive the answers a person voluntarily submits through that Page’s lead forms — typically their name, email address and phone number, plus whatever else the form asks — together with the ad, campaign and form the submission came from. We receive it only for Pages that have been explicitly connected, only for as long as the connection is in place, and it goes into that workspace as an ordinary lead. We hold no other Facebook or Instagram data: not a profile, not friends, not posts, not ad spend. Disconnecting the Page deletes the stored access token and stops anything further arriving.

Billing

Company name, billing address, GSTIN and the invoice history. Card and bank details are handled by our payment processor and are not stored on our systems. Our payment processor is [to be completed].

What we do not collect

We do not use advertising trackers or third-party analytics that profile you across sites, do not buy personal data from brokers, and do not attempt to enrich the records in your workspace from outside sources.

Why we process it

To provide the service

To create and run your workspace, authenticate people, render the screens they ask for, send the notifications they have configured, produce quotations and reports, and keep backups where you have asked for them. This is the performance of our agreement with you.

To keep it secure and working

To detect and investigate abuse, diagnose faults, and maintain the audit trail. Logs are read when something is wrong, not routinely.

To bill you and meet our own obligations

To raise invoices, account for GST, and keep the records Indian law requires us to keep.

To talk to you

To answer a support request, tell you about a change to the service or these documents, and — where you asked for it — send product news. Product news always carries a way to stop it; service and security notices do not, because they are part of running your account.

Who else processes it

The whole list. Each is engaged under terms that require them to protect the data and to process it only on our instructions.

Processor	What it does	When it is involved
Cloud hosting provider	Runs the application servers and the databases behind them.	Always, for the hosted service. Not involved in an on-premise deployment.
Google	OAuth sign-in for a connection; Google Drive for backups; Gmail and Calendar for mailbox sync.	Only when somebody in your workspace connects a Google account, and only for what that connection covers.
Microsoft	OAuth, Outlook mail and calendar.	Only when somebody connects a Microsoft 365 account.
Meta	Facebook and Instagram lead ads: the Page connection, and the lead a person submitted.	Only when somebody in your workspace connects a Page, and only for that Page. Data flows from Meta to us, not the other way — we send it nothing about your workspace.
Email delivery provider	Delivers password resets and service notices from SimplCRM.	Always, for mail we send. Mail you send from your own server or mailbox does not pass through it. Currently [to be completed].
Payment processor	Takes payment and holds the card or bank details.	On paid plans. Currently [to be completed].

How it is protected

Separated at the database, not in the code

Every customer has their own database rather than a shared table with a customer column. One customer’s query cannot read another customer’s rows even if the application has a bug, because the boundary is one the database enforces rather than one the code has to remember.

Credentials and passwords

Passwords are stored as scrypt hashes and are never recoverable. Integration credentials — the token that lets us write a backup to your Drive, or read a connected mailbox — are encrypted with a key derived per workspace, so a copy of the database alone does not yield a usable credential. No endpoint returns them.

In transit

All traffic between your browser and the service is encrypted with TLS, as is traffic between the service and the processors listed above.

Inside your workspace

Who sees what is yours to set: roles carry explicit permissions, branch visibility limits records to the branches a person belongs to, and a shared workspace can be divided so each collaborating business sees only its own work. Every change to a significant record is recorded with who made it and when.

If something goes wrong

We will notify the Data Protection Board of India and every affected user of a personal data breach, in the manner and within the timeframe the DPDP Act requires. We will tell you what happened, what data was involved, and what we are doing about it.

How long it is kept

While your workspace is open

For as long as you keep it. We do not silently delete a customer’s records on a schedule of our own — deciding what to keep and for how long inside your CRM is yours, and the product gives you the means to delete records individually or to empty a workspace entirely.

After you close it

A deleted workspace is locked and held for thirty days, during which it can be restored in full. After that it is permanently destroyed along with its database.

Backups

Scheduled backups are written to your own Google Drive, in your account, and are kept according to the retention you set — by default the fourteen most recent. We do not hold a copy of them; deleting them is yours to do.

What we keep longer

Invoices and the accounting records behind them, for the period Indian tax law requires. Security and access logs for a limited period for the purpose of investigating incidents.

Where the data is

The hosted service runs on managed cloud infrastructure. Some processors listed above operate outside India, so personal data may be processed abroad; where that happens it is under terms that require the same protection, and we do not transfer to a country the Central Government has restricted. An on-premise deployment keeps everything on your own infrastructure, which is why it exists.

Your rights

What you can ask for

Under the DPDP Act you may ask us for a summary of the personal data we hold about you and how it is processed; ask us to correct or complete anything inaccurate; ask us to erase it where we no longer need it; and nominate somebody to exercise these rights on your behalf if you die or become incapacitated.

What you can do without asking

Most of it is in the product. You can correct your own details, change your password, set how you are notified, export any list to CSV, download the whole workspace, and — as an administrator — remove a person’s access or delete a record outright.

If the data is about your customer, not about you

Ask the business whose CRM it is. Where you are the customer of one of our customers, they are the data fiduciary and we act on their instructions; we will pass your request to them and help them answer it, but we cannot act on it ourselves.

How to ask, and how long we take

Write to support@simplcrm.cloud from the address we hold for you. We will answer within thirty days, and will tell you if we need longer and why. There is no charge for a reasonable request.

Withdrawing consent

Where we rely on your consent — product news, for instance — you may withdraw it at any time, as easily as it was given. Withdrawing consent does not affect processing already carried out, and does not affect what we need to do to run your account or meet a legal obligation.

Grievances, children, and changes

Raising a grievance

If you are unhappy with how we have handled your personal data, write to our Grievance Officer, [to be completed], at support@simplcrm.cloud. We will acknowledge within seven days and respond substantively within thirty. If you remain unsatisfied you may complain to the Data Protection Board of India.

Children

SimplCRM is a business tool and is not directed at children. We do not knowingly create accounts for anybody under eighteen, and we do not use personal data for tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child’s data has reached us, tell us and we will remove it.

Changes to this policy

When this policy changes we update the effective date at the top and, where the change is material, notify the workspace owner by email before it takes effect. Previous versions are available on request.

How to reach us

Write to support@simplcrm.cloud, or to TechSlide IT Solutions, [to be completed].

FAQ

Questions people ask

Does SimplCRM use my data to train AI models?

No. The contents of a customer workspace are not used to train machine-learning models, are not sold, and are not shared for advertising. They are processed to provide the features that workspace uses, and nothing else.

Can SimplCRM read my Google Drive?

No. Backups request the drive.file permission, which grants access only to files the application itself created. Your existing documents are outside what the permission covers, which is visible on the Google consent screen before you agree to it.

What happens to my data if I close my account?

The workspace is locked and held for thirty days, during which it can be restored in full, and is then permanently destroyed along with its database. Invoices and the accounting records behind them are kept for the period Indian law requires.