Privacy Policy

1. Introduction & Overview

Welcome to CrmFirst ("we", "our", "us", or "CrmFirst"), a cloud-based SaaS platform operated and registered under Subhaarambh Taxfeb. We provide a Lead Management System (LMS) and WhatsApp Cloud API Automation Platform designed to assist sales teams, institutes, businesses, and enterprises in organizing lead pipelines, capturing real-time leads from Meta advertising platforms (Facebook & Instagram Lead Ads), and automating customer engagement via Meta's official WhatsApp Business Cloud API.

This Privacy Policy explains how CrmFirst collects, processes, uses, stores, and protects personal data and lead records when you visit our website (https://crmfirst.in), register for an account, or connect your Meta Business accounts to our application (https://lead.crmfirst.in). We strictly comply with:

• India's Digital Personal Data Protection (DPDP) Act, 2023 and Rules thereunder.
• India's Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• CERT-In Security Directives under Section 70B of the IT Act, 2000.
• Meta Developer Policies (Section 4 & Section 5), Meta Business Terms, and Meta WhatsApp Business Messaging & Commercial Policies.
• Global data privacy regulations including the General Data Protection Regulation (GDPR).

2. Statutory Roles (Data Fiduciary vs. Data Processor)

Under the DPDP Act 2023 and applicable privacy laws:

• CrmFirst Subscribers & Customers: Act as the Data Fiduciaries responsible for obtaining prior explicit consent from prospective leads and end-users before importing contact lists or capturing leads.
• CrmFirst Platform: Acts as a Data Processor processing personal lead data strictly upon the documented instructions of the Data Fiduciary to deliver requested LMS features.
• For subscriber account registration, billing information, and direct website inquiries, CrmFirst acts as the Data Fiduciary for subscriber personal data.

3. Information We Collect

We collect information necessary to provide our Lead Management System and WhatsApp API automation services:

A. Account Registration Information

When you create an account or request a demo, we collect your Full Name, Business Email Address (info@crmfirst.in), WhatsApp/Phone Number, Company Name, and Account Password.

B. Meta Lead Ads Data (Facebook & Instagram Lead Ads)

When you connect Meta Facebook or Instagram Lead Ads webhooks to CrmFirst, our platform receives real-time HTTPS webhook payloads containing:

• Lead Contact Details: Full Name, Email Address, WhatsApp/Phone Number.
• Custom Form Responses: Qualifying answers configured on your Meta Lead Form.
• Ad Campaign Metadata: Form ID, Leadgen ID, Page ID, Campaign ID, Adset ID, Ad ID, and Submission Timestamp.

C. WhatsApp Business Cloud API Communication Data

Through our Meta WhatsApp Cloud API integration, we process:

• Recipient WhatsApp phone numbers and profile display names.
• Outbound Meta-approved message templates, broadcast delivery logs, and drip campaign execution statuses.
• Inbound message text, message timestamps, delivery status receipts (Sent, Delivered, Read), and sales agent response logs.

D. Technical & Usage Information

We automatically collect device IP addresses, browser types, operating systems, referring URLs, and session interaction metrics via standard web server logs and cookies to ensure system stability and fraud prevention.

4. How We Use Your Information

We process collected data strictly for lawful business purposes:

• To display, categorize, and manage incoming leads inside your CrmFirst visual Kanban pipeline.
• To execute subscriber-configured automated WhatsApp drip follow-ups and notification sequences.
• To compute AI lead quality scores (0–100) and campaign attribution ROI analytics.
• To route lead inquiries to designated sales team members.
• To process billing transactions and provide customer support.

5. Meta Developer Policy Compliance & Purpose Limitation

In accordance with Meta Developer Policy Section 4, Meta User Data obtained via Graph API webhooks or Lead Ads integrations is used EXCLUSIVELY to deliver the specific Lead Management System capabilities requested by the subscriber.

6. Meta User Data Deletion & Opt-Out Instructions

In accordance with Meta Developer Policy Section 4.b and Section 5, users and platform subscribers have the right to request deletion of their Meta-associated data:

• Self-Service Deletion: You can disconnect your Facebook Page or Meta WhatsApp Business Account at any time from your CrmFirst dashboard (Settings ➔ Meta Integration ➔ Disconnect). This immediately purges active access tokens.
• Email Deletion Request: You may submit a data deletion request by emailing info@crmfirst.in with the subject line "Meta Data Deletion Request". Upon verification, all cached lead records, tokens, and connected metadata will be permanently deleted within 48 hours.

7. WhatsApp Business Messaging & Consent Policy

CrmFirst enforces strict compliance with WhatsApp's Business Messaging & Commercial Policies:

• Prior Explicit Opt-In: Subscribers agree to send WhatsApp messages ONLY to contacts who have explicitly consented to receive communications from their business.
• Instant Opt-Out (STOP / UNSUBSCRIBE): Every WhatsApp message stream supports instant opt-out. Recipients can reply STOP or UNSUBSCRIBE at any time to halt all further messages.
• Zero Spam & Prohibited Categories: Use of CrmFirst for unsolicited bulk spam, adult services, gambling, illegal goods, or unauthorized financial trading schemes is strictly prohibited and results in immediate account termination.

8. Data Security & Infrastructure Safeguards

CrmFirst implements enterprise-grade technical and organizational security controls:

• Encryption in Transit: Mandatory HTTPS / TLS 1.3 encryption for all web traffic, webhooks, and API endpoints.
• Encryption at Rest: AES-256 bit encryption for all database storage, database backups, and Meta OAuth access tokens.
• Multi-Tenant Data Isolation: Logical separation ensuring subscriber lead records are strictly isolated.
• CERT-In Reporting Compliance: In accordance with CERT-In directives under Section 70B of the IT Act 2000, cybersecurity incidents are reported to CERT-In and affected Data Fiduciaries within statutory timelines.

9. Rights of Data Principals

Under the DPDP Act 2023 and GDPR, Data Principals possess:

• Right to Access: Request a summary of personal data being processed.
• Right to Correction & Erasure: Request updating or permanent deletion of personal records.
• Right of Grievance Redressal: Right to seek redressal from the designated Grievance Officer.
• Right to Nominate: Nominate an individual to exercise data rights in the event of incapacity.

10. Grievance Officer & Statutory Contact

In accordance with the Information Technology Act 2000 and IT Rules 2021, the contact details of the Grievance Officer for CrmFirst are provided below: