Legal · Privacy
Privacy Policy
This policy applies to the CRM Master web app (crmaster.in) and the CRM Master Android & iOS mobile app. By using our services you agree to the practices described below.
Last updated September 3, 2026
Your data is encrypted
AES-256-CBC for credentials, HTTPS/TLS in transit, SecureStore on devices.
Never sold
We don't sell, rent, or trade your data or your leads' data to any third party.
You're in control
Request access, correction, deletion, or export of your data at any time.
Who We Are
CRM Master is an independent platform providing a cloud-based Customer Relationship Management (CRM) solution designed for businesses to manage leads, campaigns, calls, and customer communications.
Contact: [email protected]
Information We Collect
2.1 Information You Provide
- Account information – name, email address, phone number, password (stored hashed), profile photo.
- Lead / contact data – names, phone numbers, email addresses, locations, and custom fields you enter for your leads or customers.
- Campaign & task data – campaign names, task descriptions, follow-up dates, and notes.
- Payment information – transaction IDs and amounts processed via Razorpay. We do not store raw card or bank details.
- Integration credentials – API keys for CallerDesk, AiSensy. Stored encrypted (AES-256-CBC) and never exposed in plain text.
2.2 Information Collected Automatically
- Device information – device model, OS version, app version, unique device identifiers.
- Usage data – pages visited, features used, session duration, IP address, browser type.
- Call logs (Android app) – with your explicit in-app consent, the CRM Master Android app reads your device call log — phone number, date and time, duration, and direction (incoming, outgoing, missed, rejected) — and uploads the entries that match a lead in your CRM workspace to our servers at crmaster.in. Calls to numbers that are not leads are discarded on your device and never uploaded. Collection runs automatically in the background while the app is installed, including for calls made while the app is closed, and the first sync covers the previous 7 days; you may also choose to import older calls yourself. Turn it off at any time in the app under Settings → Calls & Overlay → Call log sync.
- Call events (telephony providers) – when CallerDesk or another telephony provider is active: timestamps, duration, direction (inbound/outbound), and recording URLs.
- Error & performance data – crash reports and traces sent to Sentry. Never includes passwords, OTPs, or raw payment payloads.
2.3 Permissions Requested by the Mobile App
| Permission | Why it is needed |
|---|---|
| READ_CALL_LOG | Read the device call log and upload calls made to your CRM leads (number, time, duration, direction) to crmaster.in, so they are logged against the right lead even when the app is closed. Requested only after you accept the in-app disclosure. |
| READ_CONTACTS / WRITE_CONTACTS | Import contacts or save CRM leads as device contacts |
| CALL_PHONE | Initiate click-to-call from a lead's profile |
| READ_PHONE_STATE | Detect when a call to a CRM lead starts and ends, to log it and show the lead's card during the call |
| ANSWER_PHONE_CALLS | Allow in-app call management via CallerDesk |
| READ_MEDIA_AUDIO / READ_EXTERNAL_STORAGE | Play back call recordings stored on device |
| SYSTEM_ALERT_WINDOW | Show an overlay with caller details during an active call |
Permissions are requested at runtime and only when you use the relevant feature. Revoke at any time in Android Settings → Apps → CRM Master → Permissions.
How We Use Your Information
- Provide, maintain, and improve the CRM platform.
- Authenticate your account and protect against unauthorized access.
- Link incoming/outgoing calls to the correct lead record automatically, and show call activity and duration in reports visible to your workspace's admins and teammates.
- Send transactional notifications (OTPs, email verification, password reset).
- Deliver WhatsApp messages through AiSensy on your instruction.
- Process payments via Razorpay on your instruction.
- Diagnose bugs and crashes using Sentry error monitoring.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell, rent, or trade your personal data or your leads' data to third parties.
Third-Party Services
We integrate with the following third-party services. Each has its own privacy policy.
| Service | Purpose | Data shared |
|---|---|---|
| CallerDesk | VOIP calling & call logs | Agent phone numbers, call events |
| AiSensy | WhatsApp messaging | Lead phone numbers, message content (you compose) |
| Razorpay | Payment processing | Transaction amount, order ID |
| Sentry | Error monitoring | Stack traces, user ID (no passwords or OTPs) |
| Google OAuth | Sign-in (optional) | Google profile name & email |
Data Storage & Security
- PostgreSQL database – hosted on a private server within a Docker container.
- AES-256-CBC encryption – for sensitive integration credentials (API keys) at rest.
- HTTPS / TLS – all communication between the app and our servers is encrypted in transit.
- Expo SecureStore – mobile session tokens stored in Android Keystore / iOS Keychain.
- Role-based access control – Owner, Admin, Manager, Agent, and Viewer roles limit access to workspace data.
Data Retention
We retain your data for as long as your account is active. If you delete your workspace or request account deletion, all personal data and lead records associated with that workspace are permanently deleted within 30 days.
Call recording URLs are hosted by CallerDesk and subject to their retention policy.
Children's Privacy
CRM Master is a business tool intended for users 18 years of age or older. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it promptly.
Your Rights
You have the right to:
- Access – request a copy of the personal data we hold about you.
- Correction – update inaccurate information in your profile or lead records.
- Deletion – request deletion of your account and associated data.
- Portability – export your lead data via the dashboard CSV export feature.
- Withdraw consent – revoke app permissions at any time via device settings.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify workspace owners by email. Continued use of the service after the effective date constitutes acceptance of the revised policy.
Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please reach out:
CRM Master — an independent customer relationship management platform.