Privacy Policy

Our two roles

For your account and billing details, we are the data fiduciary (we decide how they are used).

For the customer data you put into the CRM (your leads, contacts, deals), we are a data processor acting on your instructions. You are the fiduciary for that data.

What we collect

Account data: your name, work email, phone, company, GSTIN and address.

Usage data: logs, device/browser info and actions, to run and secure the service.

The CRM content you create or import.

Payment data is handled by our payment provider; we do not store full card details.

Why we use it

To provide and secure the service, process payments, give support, and meet legal duties. We do not sell your data.

Sharing

With service providers who help us run the service (hosting, payments, email, messaging), bound to protect it; and where the law requires. AI features may send the needed text to a model provider to generate a reply.

Where it lives and how long

Data is hosted on servers we control in India. We keep account data while your account is active and for a short period after closure, then delete or anonymise it, unless the law requires us to keep it longer.

Your rights (DPDP)

You can ask to see, correct, or erase your personal data, and withdraw consent. Account admins can export and erase data from within the service, and we will help with any request we can't do in-app.

Grievances: contact our grievance officer at grievance@toshiconsulting.com.

Security

We use encryption in transit, encrypted secrets, access controls, two-step sign-in, backups and monitoring. No system is perfectly secure, but we work to protect your data and to notify you of a breach that affects you.