This policy is written to be read, not to be impressive. It describes what WTS CRM does with personal data under India’s Digital Personal Data Protection Act, 2023 and the Rules made under it, whose obligations are being phased in. It is a starting point rather than finished legal advice — have a professional confirm it covers your obligations, including in any other country your users live in.
Who we are
WTS CRM is operated by Web Total Solution, Kolkata, West Bengal, India. You can reach us at support@webtotalsolution.com.
Two different kinds of data
This distinction decides who is answerable for what, so it comes first.
- Your account: your name and email, and the phone number, job title and company size you give when you set up your workspace. We decide how this is used — to sign you in, to keep the service secure, and to contact you about it. For this, we are the data fiduciary.
- Your workspace: the clients, leads, projects, tasks, notes, invoices and payments you put in. Much of this is other people’s personal data — their names, phone numbers, email addresses, billing addresses and GSTINs. You decided to collect it and you decide what happens to it. We hold it on your behalf and act on your instructions.
That second point carries a duty: you are responsible for having a lawful basis to hold your clients’ details, for telling them you do, and for answering them if they ask. Putting data into WTS CRM does not move that responsibility to us.
In the DPDP Act’s terms: for your workspace, you are the Data Fiduciary and your clients are the Data Principals — you decide the purpose and means of processing their data, and their rights of access, correction, erasure and grievance run against you, not us. We act only as your service provider, processing that data solely on your instructions and for no purpose of our own. If your business is itself a “ significant data fiduciary” under the Act, the extra obligations that come with that — a data protection officer, an independent data audit — are yours to meet, not ours.
What else we collect
- Technical data: the logs needed to keep the service running and secure — request times, error traces, and the address a request came from.
- Sign in with Google: if you use it, Google gives us your name and email address to create and identify your account. We never receive your Google password.
We do not sell personal data, we do not use your workspace content to advertise to you, and we do not use it to train models.
WhatsApp and Meta
If you connect your WhatsApp Business app number (Settings, then WhatsApp), WTS CRMreceives your customers’ WhatsApp conversations through Meta’s WhatsApp Business Platform, and can send replies on your number. Nothing is connected unless an owner or admin of the workspace does it, and it can be disconnected at any time.
What we receive, and what we do with it:
- Messages to and from the connected number — the text, the time, the delivery status and who in your team sent a reply — with the customer’s phone number and WhatsApp profile name. They are shown on that customer’s lead, and are as visible as the lead itself: to whoever can open it, and to owners and admins.
- Photos, documents, voice notes and video are not copied to our storage. We keep only a reference, and fetch the file from Meta when someone on your team opens it. Meta keeps them for a limited time, around 30 days, after which they can no longer be opened here.
- Your phone book and chat history, if you let WhatsApp share them when you connect. Contacts are kept aside and become leads only if an owner or admin chooses them. History is attached only to leads you already have. Neither creates leads on its own, because the phone also holds personal chats.
- New leads: when someone you have never spoken to messages you, a lead is created with their number, name and message, so you can follow it up.
- Your access to Meta — a token that lets us read and send messages on the WhatsApp Business account you connected, and nothing else. It is stored apart from everything else, no signed-in user can read it back, and it is deleted when you disconnect. We do not receive your Facebook password or any of your personal Facebook activity.
We use this only to show the conversation, create and update leads, and run the automations your workspace has switched on. We do not sell it, use it for advertising or train models on it, and no other customer can see it. Meta handles WhatsApp traffic under its own terms with you; messages sent from WTS CRM are billed by Meta to your account.
Writing to people on WhatsApp is your responsibility as much as any other message you send: have their consent, follow WhatsApp’s business and commerce policies, and do not send unsolicited or bulk messages. WTS CRM only lets you reply within the 24 hours WhatsApp allows after a customer’s last message.
Disconnecting stops new messages and deletes the token; messages already saved stay on their leads until you delete them. Deleting a lead deletes its WhatsApp messages, and deleting your account erases all of it. To have a customer’s WhatsApp data removed, or your own, see how to delete your data.
Why we are allowed to hold it
For your account details, our basis is your consent, given when you create the account and withdrawable at any time by deleting it — withdrawal ends the service, because the account is the service. Where the law lets us process without consent, it is for the narrow purposes it names: keeping the service secure, and complying with an obligation we are under.
For your workspace content, the basis is not ours to claim. You collected that data and you must be able to point to the ground on which you hold it. We process it solely on your instructions.
Cookies and what is stored in your browser
WTS CRM sets no advertising cookies. Inside the app, once you are signed in, there is no third-party analytics at all. What the app itself uses is short:
- A session cookie holding your access token. Without it you cannot stay signed in, so it is strictly necessary and is not something you can turn off and still use the app. Signing out clears it.
- Your theme choice (light or dark), kept in your browser’s local storage. It never reaches our servers.
The public pages of this website — the home page, features, pricing, the blog and these legal pages — use Google Analytics to count visits. It sets cookies (_ga and one beginning _ga_) that tell a returning browser from a new one, and it sends Google the page you opened, the page that referred you, your browser and device type, and an approximate location derived from your IP address, which Google does not store. We have switched off Google’s advertising features, so this feeds no advertising profile. It does not run on the sign-in page, inside the app, or on the invoice and quotation links your customers open. You can block it with your browser’s cookie settings or Google’s opt-out add-on.
Where your data lives, and who else touches it
We use a small number of processors. Each holds data to run the service and for no purpose of its own, and each is bound to protect it.
- InsForge — the hosted backend platform that stores the database and files on our behalf, in its Asia-Pacific (Singapore) region.
- Vercel — serves the application itself and keeps short-lived request logs.
- Google — only if you choose Sign in with Google, and only to authenticate you.
- Google Analytics — visit statistics for the public pages of this website, as described under cookies above. It never sees your workspace.
- Meta Platforms — only if you connect WhatsApp. Meta runs WhatsApp and delivers the messages and files described above; it processes them as the operator of WhatsApp, under its own terms with you.
Separately, if you save your own Razorpay credentials to collect payments, your invoices and payment links reach Razorpay under your account and their terms with you, not ours. We store those keys so the feature works — the secrets write-only, so they can be replaced but never read back out of the app.
Storage in Singapore means your data leaves India. The DPDP Act permits that except to a country the government has restricted; if one of our processors is ever affected, we will move the data or tell you before it becomes a problem. We add no processor without updating this list.
How your workspace is kept separate
WTS CRM is multi-tenant, and isolation is enforced in the database itself through row-level security keyed to your account — not merely by what the app chooses to show you. Other users cannot read your workspace.
How we protect it
Reasonable security safeguards are a legal duty, not a courtesy. Ours are:
- Traffic encrypted in transit, and the database and file storage encrypted at rest.
- Tenant isolation enforced in the database by row-level security, as described above, so a bug in the app cannot leak one workspace into another.
- Payment secrets kept write-only and out of every read path, so they cannot be retrieved even by someone holding a valid session.
- Passwords stored only as hashes; we never see yours, and we will never ask you for it.
- Access to production limited to the people who need it, and logs kept to notice misuse.
No system is perfectly secure, and we will not pretend otherwise. If you find a weakness, the contact page says how to report it.
If there is a breach
If personal data we hold is lost, exposed or accessed without authorisation, we will tell the Data Protection Board of India and every affected person without delay, as the DPDP Act requires. Our notice to you will say plainly what happened, what data was involved, what we have done about it, and what you should do — not a euphemism about an incident. Where the data affected is your workspace content, you will need to notify the people it is about; we will give you what you need to do that.
How long we keep it
- While your account exists: we keep your workspace so the service works.
- When you delete your account: your clients, projects, tasks, notes, invoices, payments, billing details and login are erased immediately and irreversibly. We cannot recover them afterwards.
- WhatsApp messages: kept on the lead for as long as the lead exists. Deleting the lead deletes them; disconnecting WhatsApp does not. Technical delivery logs for the connection are trimmed regularly.
- Backups and logs: may retain traces for a short period before they age out on their normal cycle.
Note that your invoices and payment records are documents you may be legally required to keep for several years after the financial year they belong to. Deleting your account here does not satisfy that obligation, and does not undo it. Export your data first.
Children
WTS CRM is a business tool and is not for anyone under 18. We do not knowingly open accounts for children, and we do not track or profile them or advertise to them. If you believe a child has an account here, write to us and we will delete it. If your own workspace holds a child’s personal data, the DPDP Act’s stricter rules — verifiable parental consent, no tracking, no targeted advertising — fall on you as the one who decided to collect it.
Your rights
- Access and portability: download everything in your workspace, as JSON, from your account settings at any time.
- Correction: edit your own details in settings, and your workspace content wherever it appears in the app.
- Erasure: delete your account and its data from settings, as above, or follow the data deletion steps, which also cover WhatsApp.
- Grievance redressal: complain to the officer named below, and escalate to the Data Protection Board of India if we do not resolve it.
- Nomination: you may nominate someone to exercise these rights on your behalf if you die or become incapacitated. Write to us to arrange it.
Grievance officer
Piyush Thakur — piyus@webtotalsolution.com. We aim to acknowledge complaints within 24 hours and resolve them within 15 days.
Changes to this policy
If we change it materially we will say so in the app before the change takes effect. The date at the top always reflects the current version.