Privacy Policy & DPDP Notice

Account holders: businesses and individuals who register for SprigoCRM. For their account data we act as the Data Fiduciary.

Our customers' contacts: the people whose details our customers store in SprigoCRM (their leads and customers). For that data our customer is the Data Fiduciary and we act as their Data Processor, under the terms of our Data Protection Terms. If you are one of those contacts, please direct requests to the business that holds your data.

• Account data: name, work email, password (stored only as a salted hash), company name, role, phone, address, logo.
• Verification (KYC) data: PAN, optional GSTIN, optional Aadhaar (only the last four digits are kept), and the verification document you upload.
• Billing data: plan, invoices, payment identifiers. Card and bank details are handled by our payment processor and are never stored by us.
• Customer-contact data you upload: names, phone numbers, emails, categories, addresses and notes about your own customers.
• Usage and technical data: log-in events, IP address, device/browser type, audit-log entries and campaign delivery statistics. If a WhatsApp message sent by one of our customers has a tracked website button, we also record whether, and when, that button was tapped, so the sender can see how many people responded.
• Communications: support tickets, emails you send us and responses to our forms.

• To create and operate your account and provide the SprigoCRM service.
• To verify your business and meet legal and regulatory obligations.
• To process payments, issue GST invoices and prevent fraud and abuse.
• To send service messages (verification codes, security alerts, billing notices).
• To keep the platform secure, debug problems and improve the product.

We process personal data on the basis of your consent and for the "legitimate uses" recognised by the DPDP Act (for example, performing the service you asked for and complying with law). We do not sell personal data.

We share data only with providers that help us run the service, under written confidentiality and security obligations:

• Cloud hosting and database: Vercel (application hosting) and Railway (database and file storage).
• Payments: Razorpay, to process subscription and top-up payments.
• Email delivery: our SMTP email provider, to deliver service and campaign emails.
• Bot protection: Google reCAPTCHA, on sign-in and registration forms.
• Website analytics: Google Analytics, on our public website pages only and only if you choose “Accept all” in the cookie banner. It is not used inside the signed-in application.
• AI drafting assistant: OpenAI, only when you choose to use the AI Assistant; the text you submit is sent to generate a draft.

We may also disclose data where required by law, court order or a competent authority, or to protect our rights and users.

You may withdraw your consent at any time, as easily as you gave it, by emailing sprigocrm@gmail.com or by closing your account. Withdrawal does not affect processing already carried out, and we may need to keep certain records where the law requires. If you withdraw consent that is necessary to provide the service, we may no longer be able to provide it.

To stop marketing emails from a business that uses SprigoCRM, use the "Unsubscribe" link in the message; the request is honoured automatically.

• Right to access a summary of the personal data we process and who we share it with.
• Right to correction and erasure of data that is inaccurate, incomplete or no longer needed.
• Right of grievance redressal — email sprigocrm@gmail.com; we acknowledge complaints within 24 hours and aim to resolve them within 15 days. If unresolved, you may complain to the Data Protection Board of India.
• Right to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. To nominate, email sprigocrm@gmail.com with the nominee's name and contact details.

Necessary cookies: we use a secure session cookie to keep you signed in and protect your account, and Google reCAPTCHA on sign-in and registration forms to block automated abuse. These are required for the service to work and cannot be switched off.

Analytics cookies (optional): if you choose “Accept all”, we use Google Analytics on our public website pages to understand which pages are visited and how people find us. IP addresses are anonymised and we turn off advertising and personalisation features. It does not run inside the signed-in application. You can withdraw consent any time with “Cookie settings” in the page footer; Google's cookies are then cleared and measurement stops.

Marketing cookies: we do not run advertising trackers.

We keep personal data only for as long as your account is active and for the period needed to meet legal, tax, audit and dispute-resolution obligations, after which it is erased or anonymised. Security measures include encrypted connections, hashed passwords, role-based access, private file storage with short-lived access links, session timeouts and audit logging. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as required by law.

SprigoCRM is a business service not directed at children. We do not knowingly process the personal data of anyone under 18 without verifiable parental consent.

This notice is provided in English. As required by the DPDP Act, we will make it available in any of the languages specified in the Eighth Schedule to the Constitution of India on request — email sprigocrm@gmail.com and tell us your preferred language.

Some of our providers may process data outside India. We transfer personal data only to countries and under conditions permitted by Indian law, and require equivalent protection from our providers.

We may update this notice from time to time. Material changes will be announced in the product or by email, and the "Last updated" date above will change.

SprigoCRM, Delhi, India
Privacy queries: sprigocrm@gmail.com