Privacy Policy

1. Introduction

Welcome to Nutaan CRM ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclosure, and safeguard your information when you use our application.

2. Information We Collect

We collect personal information that you voluntarily provide to us when you register on the application, specifically:

Name and Contact Data (Email address).

Authentication data, including hashed passwords and connected sign-in identifiers.

Payment Data (if applicable).

2A. Nutaan CRM Mobile App

The Nutaan CRM mobile app for Android and iOS shows the leads and follow-ups that already exist in your Nutaan CRM account, and lets you update them. It is a window onto your account, not a separate collection of data.

Device storage: the app stores a sign-in key in secure device storage and account settings such as the server address. Selected import files may be copied to a temporary device cache. Signing out removes the sign-in key.

What the app sends us: your email and password when you sign in, and the changes you make (lead status, stage, follow-up dates, notes). All traffic is encrypted with HTTPS.

Your phone's contacts: when you choose "Pick from phone contacts", the app explains contact access before asking your phone for permission. It reads the selected contact's name, phone and email into an editable form. Details are uploaded to your CRM workspace only after you tap Save. We do not upload your full address book or read it in the background. You can decline and enter details manually.

Company calls and microphone: direct company calling requests microphone access to transmit your voice through our calling service and its telephony providers. Call history includes participants, the team member placing the call, time, duration and outcome. Where recording or transcription is enabled, audio and conversation text are processed by the calling service and made available to authorised workspace users.

Notifications: if you enable notifications, the app registers a device push token with our server and notification delivery providers to deliver lead assignments and other work alerts.

Imports and messaging: files you explicitly select for contact import are uploaded to the CRM. WhatsApp, email and device calling actions may open another app where permitted by your workspace permissions. Company calls can instead run directly within the app.

Advertising: the mobile app contains no advertising and does not track you across other apps or websites for advertising.

Deleting your data: email business@nutaan.com from your account email, or see data deletion . Your account and its data are deleted within 14 days.

3. Google & Microsoft User Data

If you choose to connect your Gmail or Outlook account using our OAuth integrations, we strictly adhere to the following data practices:

Access: We request the profile and email permissions displayed when you connect the provider. Depending on the feature and permissions granted, these can include sending campaigns and accessing mailbox or conversation data for CRM email features.

Usage: This data is used to provide the email and CRM features you request, under the permissions you grant. We do NOT use your data for advertising, machine learning, or AI model training.

We are committed to the privacy of your data. We do NOT sell, trade, or rent your Google/Microsoft user data to any third parties.

No Sale of Data: We do not sell, trade, or rent your Google user data to third parties.

Third-Party Sharing: We do not share your data with third-party tools, AI models, advertising networks, or data brokers.

Service Providers: We transfer data to the following secure cloud infrastructure providers strictly for the purpose of hosting and operating the service: MongoDB Atlas: Database hosting and storage.

Microsoft Azure: Cloud infrastructure and app hosting.

Legal Disclosure: We may disclose data only if required by law, such as to comply with a subpoena or similar legal process.

Storage: We do NOT store the contents of your emails. We securely store OAuth tokens to maintain your connection.

Google Limited Use Compliance

4. Data Protection & Security

We implement industry-standard security measures to protect your personal and sensitive information:

Encryption: All data is encrypted in transit using SSL/TLS protocols and encrypted at rest in our secure databases.

Access Control: Access to your data is strictly limited to authorized personnel and is protected by strong authentication mechanisms.

Security Audits: We regularly review our security practices to ensure the safety of your data.

GDPR: Where the GDPR applies, workspace controllers and processors must assess their respective obligations and applicable agreements. You can request access to, export, correction or deletion of your personal data, and delete your account from the web dashboard or the mobile app.

Healthcare: A signup acceptance does not establish HIPAA compliance. US covered entities and business associates must confirm a signed BAA and verified safeguards before uploading PHI. No verified HIPAA-ready status is represented here.

5. Data Retention & Deletion

We retain your google user data only for as long as necessary to provide our services to you:

Retention Period: Your data is retained while your account is active. Upon account termination, we delete your data within 30 days.

Deletion Request: You can request the deletion of your data at any time by contacting us at business@nutaan.com or through your account settings. Once a request is received, we will delete your data within 14 days and confirm the deletion via email.

6. How We Use Your Information

We use your information to:

Facilitate account creation and logon process.

Send you administrative information.

Fulfill and manage your orders.

Post testimonials (with your consent).

7. Contact Us

If you have questions or comments about this policy, you may email us at business@nutaan.com.

8. Corporate Information

TECOSYS AI PRIVATE LIMITED

CIN (Corporate Identification Number): U62011WB2025PTC278112

Date of Incorporation: 04 April 2025

Registered Office Address:

117/2559, 64 Pally, Mondalpara Barrackpur-I, North 24 Parganas West Bengal – 743127 India

9. International rights, legal bases and business processing

TECOSYS AI PRIVATE LIMITED is the account-data controller for Nutaan CRM. We use account data to provide the service and perform our contract, comply with legal duties and protect the service under legitimate interests where applicable. Optional promotional messages require a separate preference; refusing or withdrawing that preference does not affect account access.

For personal data you upload about your customers or staff, your organisation determines the purposes of processing; Nutaan CRM processes it on your documented instructions. Where a data processing agreement and transfer safeguards are required, contact business@nutaan.com to arrange them before uploading personal data. Signup does not execute a DPA or certify your organisation as compliant.

Depending on the law that applies, you may request access, correction, deletion, restriction, portability, object to processing or withdraw optional consent. EEA users may complain to their supervisory authority. US state privacy rights depend on the applicable state law and its thresholds. Send requests to business@nutaan.com; we verify identity before disclosing account data.

Service providers process data necessary for hosting, storage, notifications, communications and connected services. Integrations can involve international transfers; the relevant provider, service configuration and any applicable transfer mechanism must be checked before use. We do not promise EU-only or US-only storage.

We keep account and workspace information while needed to provide the service, meet legal duties and resolve disputes. Acceptance records include account ID, server timestamp, document versions and content hashes, declared country, source and limited technical evidence. Withdrawing promotional consent is recorded separately. Review account deletion options for deletion requests.