Data Protection Terms

You are the Data Fiduciary / Controller of the contact data you upload (your customers' names, phone numbers, emails, categories, notes and similar). SprigoCRM is your Data Processor and processes that data only to provide the service, on your documented instructions (your use of the product and API settings), and as required by law.

• No sale or misuse. We will not sell, rent, or share your CRM contacts, and will not use them for our own marketing or to build profiles, advertising or competing datasets.
• Purpose limitation. We process your contact data solely to host it, display it to your authorised team, and send the campaigns you instruct us to send.
• Confidentiality. Our personnel with access are bound by confidentiality obligations and access is limited to what is necessary.
• Security. We maintain reasonable safeguards including encryption in transit, hashed credentials, role-based access, private storage with expiring access links, session controls and audit logging.
• Assistance. We will reasonably help you respond to access, correction and erasure requests from your contacts, and with your compliance obligations under the DPDP Act, taking into account the nature of processing.
• Return and deletion. On termination you may export your data; we delete or anonymise it within a reasonable period afterwards unless the law requires retention.

You confirm you have a lawful basis and any required consent to collect and message your contacts, you will honour unsubscribe and opt-out requests, and your instructions comply with applicable law, including our Anti-Spam & Telecom Policy.

You authorise us to use the following sub-processors, each bound by written data-protection terms: Vercel and Railway (hosting, database, storage), Razorpay (payments — account holder billing data only), our SMTP email provider (message delivery), and, if you use the AI Assistant, OpenAI (text you submit for drafting). We will update our Privacy Policy before adding a new sub-processor that processes your contact data, and you may object on reasonable grounds.

Our hosting and processing providers may store or process data in data centres outside India. We transfer personal data only to jurisdictions not restricted by the Government of India under the DPDP Act, and require sub-processors to apply protection no less protective than this Addendum. Contact us for the current hosting regions applicable to your account.

• We will notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your contact data.
• The notice will describe, as far as known, the nature of the breach, categories and approximate volume of data affected, likely consequences, and the measures taken or proposed.
• We will cooperate with you so you can meet your own duties to inform the Data Protection Board of India and affected individuals.
• Where a cyber-security incident is reportable to CERT-In, we will report it within the timeline prescribed by CERT-In's directions (currently six hours of noticing the incident) and keep the relevant logs as those directions require.

On reasonable written notice, and not more than once a year unless a breach has occurred, we will provide information reasonably necessary to demonstrate compliance with this Addendum.

Liability under this Addendum is subject to the limits in the Terms of Service. If this Addendum conflicts with the Terms on the processing of personal data, this Addendum prevails.

Data-protection questions: sprigocrm@gmail.com. To request a countersigned copy of this Addendum, email the same address.