Deal Flow CRMThis policy explains what personal data Deal Flow CRM collects, why, who it is shared with, how long it is kept and the choices you have. It applies to the Deal Flow CRM web app, its mobile and desktop versions, the Deal Flow Call Box for Windows, and the public pages, forms and booking links that Deal Flow CRM serves for its customers (together, the Service).
1. Who we are
The Service is provided by Momentum Marketing & Software Technologies ("we", "us"). For questions about this policy or your data, write to support@dealflowcrm.co.in.
Businesses use Deal Flow CRM to manage their own leads, customers, deals and conversations. For that customer data, the business (our customer) decides what is collected and why: it is the data fiduciary / controller, and we process the data on its behalf as a data processor. For the account data of the people who sign in to Deal Flow CRM, and for billing, we are the data fiduciary / controller. If you are a lead or customer of a business that uses Deal Flow CRM, please contact that business first about your data; we will help them respond.
2. What we collect
Account and workspace data
- Your name, email address, mobile number (used for one-time-password sign-in and verification), password (stored only as a secure hash by our sign-in provider) and, if you sign in with Google, your Google profile name, email and photo.
- Workspace details you enter: business name, legal name, GSTIN, address, phone, email, website, logo, team members, roles and settings.
Customer data you add or connect
- Leads, contacts, companies, deals, tasks, notes, files, quotes, invoices, custom fields, forms and form submissions, and booking requests.
- Email: if a team member connects Gmail, Outlook or another mailbox (IMAP/SMTP), the Service reads messages exchanged with that workspace's contacts to show them on the contact's timeline, and sends the emails the member writes from the CRM.
- Calendar: if a member connects Google Calendar or Microsoft Outlook calendar, the Service reads and writes the events needed to show and schedule meetings and follow-ups.
- WhatsApp: messages sent and received through the WhatsApp Business Platform (Cloud API) or a WhatsApp account the business links, together with the names and numbers of the people in those chats.
- Phone calls: if the business uses the Deal Flow Call Box, details of calls on its paired phone (numbers, times, duration, outcome) and, where the business enables it, call recordings, transcripts and summaries, including calls handled by the AI calling agent.
Billing data
Payments are processed by Cashfree Payments. We receive and keep the plan, number of seats, amounts, order and payment identifiers and status. We do not receive or store full card numbers, CVV, UPI PINs or net-banking passwords.
Technical data
IP address, browser and device type, operating system, pages and features used, error logs, notification tokens (to send you push notifications you enable), and security logs. We use the browser storage needed for sign-in, preferences and offline use, and the Meta Pixel to measure our own advertising; see the Cookie Policy.
3. How we use it
- To provide the Service: store and show your records, sync email, calendars and WhatsApp, place and log calls, send notifications and reminders, and run the automations you set up.
- To provide the AI features you use (see section 5).
- To create and manage your account, verify your mobile number, and keep workspaces separate and secure.
- To bill subscriptions, prevent fraud and meet tax and accounting requirements.
- To give support, send service and security messages, and tell you about important changes.
- To find and fix problems and improve the Service, using aggregated or de-identified information where possible.
- To comply with law and enforce our Terms of Service and Acceptable Use Policy.
We do not sell personal data. We do not use customer data, email, calendar or WhatsApp content for advertising, and we do not show ads in the Service. To measure and improve our own ads on Facebook and Instagram, our website uses the Meta Pixel, which tells Meta about page visits, new workspace sign-ups and plan payments (amount and currency) from your browser; it does not receive the contents of your CRM.
4. Google user data (Limited Use)
When you connect a Google account, Deal Flow CRM requests only the access needed for the features you turn on:
| Google data | What Deal Flow CRM does with it |
|---|---|
| Google Sign-In (name, email, profile photo) | Creates and signs in to your Deal Flow CRM account. |
| Gmail messages | Shows emails exchanged with your CRM contacts on their timeline, and sends the emails you write from the CRM. Messages with people who are not in your CRM are not stored. |
| Google Calendar events | Shows your meetings in the CRM and creates or updates the meetings and follow-ups you schedule there. |
Deal Flow CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: Google user data is used only to provide and improve the user-facing features described above; it is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you; it is not used for advertising; it is not used to develop, improve or train generalised AI or machine-learning models; and no person reads it unless you give consent for specific messages, it is needed for security purposes (such as investigating abuse), it is needed to comply with law, or the data is aggregated and anonymised for internal operations. Access for each connected account is limited to the team member who connected it. You can disconnect at any time in Settings → Integrations, and revoke access at myaccount.google.com/permissions.
5. AI features
Deal Flow CRM uses Google's Gemini models to draft messages and replies, summarise conversations and calls, read details from visiting cards you scan, transcribe recorded calls, and power the AI calling agent. To do this, the content involved (for example the conversation, the call audio or the card image) is sent to Google's Gemini API for processing, using either our API key or a key your workspace adds. Its handling by Google is governed by Google's terms for the Gemini API. We do not use your content to train our own AI models.
AI output can be wrong; please review drafts and summaries before relying on them. When the AI calling agent talks to people, the business using it is responsible for any notice and consent the law requires (see section 7).
6. Microsoft and WhatsApp data
Microsoft (Outlook mail and calendar) data is used in the same limited way as Google data in section 4, only for the features you connect, and can be disconnected at any time in Settings → Integrations or at account.live.com/consent/Manage. WhatsApp messages sent through the WhatsApp Business Platform are also processed by Meta under its own terms. Messages from people who are not yet in your CRM are not turned into leads unless your team chooses to.
7. Calls and recordings
The Deal Flow Call Box runs on the business's own Windows computer, paired with its own phone. Call recordings are saved in the storage the business chooses on that computer (such as its Google Drive, OneDrive or Dropbox folder). If the business enables it, a copy is also kept in the CRM for a period it sets, at most 30 days, and then deleted automatically. Transcripts and summaries are kept with the contact's record. The business is responsible for informing callers and obtaining any consent required for recording and for automated calls.
8. Who we share data with
We share personal data only with the service providers we use to run the Service (our sub-processors), with the third-party services you choose to connect, when the law requires it, or with your instructions:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, sign-in, file storage, background processing, push notifications | India (Mumbai region) for stored data |
| Google (Gemini API) | AI features described in section 5 | Google's global infrastructure |
| Cashfree Payments | Payments | India |
| Meta (WhatsApp Business Platform) | Sending and receiving WhatsApp messages, when connected | Meta's global infrastructure |
| Meta (Meta Pixel) | Measuring our own ads: page visits, sign-ups and plan payments, from your browser | Meta's global infrastructure |
| Google Workspace, Microsoft, other mail providers | Email and calendar sync, when you connect them | Per provider |
We may also disclose data if required by law or a valid legal request, to protect the rights, safety and security of our users, the public or us, or as part of a merger, acquisition or sale of assets, in which case we will tell you and this policy will continue to protect your data.
9. Where data is stored
Workspace data is stored on Google Cloud in India (Mumbai). Some providers listed above may process data outside India when you use their features; where they do, we rely on their contractual and security commitments, and we transfer data only to countries permitted under Indian law.
10. How long we keep it
We keep account and workspace data while the account or workspace is active. When a workspace or account is deleted, its data is removed from the live systems; residual copies in backups and logs are deleted in the normal backup cycle. Call recording copies in the CRM are deleted after the period the business sets (at most 30 days). We keep billing records for as long as tax and accounting laws require. See Data Deletion for how to delete your data.
11. Security
Data is encrypted in transit (HTTPS/TLS) and at rest. Mailbox passwords and similar credentials you give us are stored encrypted. Each workspace's data is kept separate, team access follows the roles set by the workspace owner, and a connected mailbox or calendar can be read only by the member who connected it. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the authorities as the law requires.
12. Your rights
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you can ask to access, correct, update or erase your personal data, withdraw consent you gave (this does not affect processing already done), nominate someone to exercise your rights in case of death or incapacity, and raise a grievance. Many changes can be made directly in the app; otherwise write to support@dealflowcrm.co.in. We may need to verify your identity. If your data is held by a business that uses Deal Flow CRM, we will pass your request to that business. If you are not satisfied with our response, see Grievance Redressal.
13. Children
The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.
14. Changes to this policy
We may update this policy. We will post the new version here with a new effective date and, for significant changes, tell account owners by email or in the app before they apply.
15. Contact
- Company
- Momentum Marketing & Software Technologies
- support@dealflowcrm.co.in
- Grievance Officer
- Arjun Jha, support@dealflowcrm.co.in