This policy is written to be read, not to be impressive. It describes what WTS CRM does with personal data under India’s Digital Personal Data Protection Act, 2023 and the Rules made under it, whose obligations are being phased in. It is a starting point rather than finished legal advice — have a professional confirm it covers your obligations, including in any other country your users live in.
Who we are
WTS CRM is operated by Web Total Solution, Kolkata, West Bengal, India. You can reach us at support@webtotalsolution.com.
Two different kinds of data
This distinction decides who is answerable for what, so it comes first.
- Your account: your name and email. We decide how this is used — to sign you in, to keep the service secure, and to contact you about it. For this, we are the data fiduciary.
- Your workspace: the clients, leads, projects, tasks, notes, invoices and payments you put in. Much of this is other people’s personal data — their names, phone numbers, email addresses, billing addresses and GSTINs. You decided to collect it and you decide what happens to it. We hold it on your behalf and act on your instructions.
That second point carries a duty: you are responsible for having a lawful basis to hold your clients’ details, for telling them you do, and for answering them if they ask. Putting data into WTS CRM does not move that responsibility to us.
In the DPDP Act’s terms: for your workspace, you are the Data Fiduciary and your clients are the Data Principals — you decide the purpose and means of processing their data, and their rights of access, correction, erasure and grievance run against you, not us. We act only as your service provider, processing that data solely on your instructions and for no purpose of our own. If your business is itself a “ significant data fiduciary” under the Act, the extra obligations that come with that — a data protection officer, an independent data audit — are yours to meet, not ours.
What else we collect
- Technical data: the logs needed to keep the service running and secure — request times, error traces, and the address a request came from.
- Sign in with Google: if you use it, Google gives us your name and email address to create and identify your account. We never receive your Google password.
We do not sell personal data, we do not use your workspace content to advertise to you, and we do not use it to train models.
Why we are allowed to hold it
For your account details, our basis is your consent, given when you create the account and withdrawable at any time by deleting it — withdrawal ends the service, because the account is the service. Where the law lets us process without consent, it is for the narrow purposes it names: keeping the service secure, and complying with an obligation we are under.
For your workspace content, the basis is not ours to claim. You collected that data and you must be able to point to the ground on which you hold it. We process it solely on your instructions.
Cookies and what is stored in your browser
WTS CRM sets no advertising or tracking cookies, and runs no third-party analytics. What it does use is short:
- A session cookie holding your access token. Without it you cannot stay signed in, so it is strictly necessary and is not something you can turn off and still use the app. Signing out clears it.
- Your theme choice (light or dark), kept in your browser’s local storage. It never reaches our servers.
Because neither is used to profile you or to follow you across other sites, there is no consent banner to click through.
Where your data lives, and who else touches it
We use a small number of processors. Each holds data to run the service and for no purpose of its own, and each is bound to protect it.
- InsForge — the hosted backend platform that stores the database and files on our behalf, in its Asia-Pacific (Singapore) region.
- Vercel — serves the application itself and keeps short-lived request logs.
- Google — only if you choose Sign in with Google, and only to authenticate you.
Separately, if you save your own Razorpay credentials to collect payments, your invoices and payment links reach Razorpay under your account and their terms with you, not ours. We store those keys so the feature works — the secrets write-only, so they can be replaced but never read back out of the app.
Storage in Singapore means your data leaves India. The DPDP Act permits that except to a country the government has restricted; if one of our processors is ever affected, we will move the data or tell you before it becomes a problem. We add no processor without updating this list.
How your workspace is kept separate
WTS CRM is multi-tenant, and isolation is enforced in the database itself through row-level security keyed to your account — not merely by what the app chooses to show you. Other users cannot read your workspace.
How we protect it
Reasonable security safeguards are a legal duty, not a courtesy. Ours are:
- Traffic encrypted in transit, and the database and file storage encrypted at rest.
- Tenant isolation enforced in the database by row-level security, as described above, so a bug in the app cannot leak one workspace into another.
- Payment secrets kept write-only and out of every read path, so they cannot be retrieved even by someone holding a valid session.
- Passwords stored only as hashes; we never see yours, and we will never ask you for it.
- Access to production limited to the people who need it, and logs kept to notice misuse.
No system is perfectly secure, and we will not pretend otherwise. If you find a weakness, the contact page says how to report it.
If there is a breach
If personal data we hold is lost, exposed or accessed without authorisation, we will tell the Data Protection Board of India and every affected person without delay, as the DPDP Act requires. Our notice to you will say plainly what happened, what data was involved, what we have done about it, and what you should do — not a euphemism about an incident. Where the data affected is your workspace content, you will need to notify the people it is about; we will give you what you need to do that.
How long we keep it
- While your account exists: we keep your workspace so the service works.
- When you delete your account: your clients, projects, tasks, notes, invoices, payments, billing details and login are erased immediately and irreversibly. We cannot recover them afterwards.
- Backups and logs: may retain traces for a short period before they age out on their normal cycle.
Note that your invoices and payment records are documents you may be legally required to keep for several years after the financial year they belong to. Deleting your account here does not satisfy that obligation, and does not undo it. Export your data first.
Children
WTS CRM is a business tool and is not for anyone under 18. We do not knowingly open accounts for children, and we do not track or profile them or advertise to them. If you believe a child has an account here, write to us and we will delete it. If your own workspace holds a child’s personal data, the DPDP Act’s stricter rules — verifiable parental consent, no tracking, no targeted advertising — fall on you as the one who decided to collect it.
Your rights
- Access and portability: download everything in your workspace, as JSON, from your account settings at any time.
- Correction: edit your own details in settings, and your workspace content wherever it appears in the app.
- Erasure: delete your account and its data from settings, as above.
- Grievance redressal: complain to the officer named below, and escalate to the Data Protection Board of India if we do not resolve it.
- Nomination: you may nominate someone to exercise these rights on your behalf if you die or become incapacitated. Write to us to arrange it.
Grievance officer
Piyush Thakur — piyus@webtotalsolution.com. We aim to acknowledge complaints within 24 hours and resolve them within 15 days.
Changes to this policy
If we change it materially we will say so in the app before the change takes effect. The date at the top always reflects the current version.