Privacy Policy

1. Introduction

SANAYAD CRMis a CRM platform that lets a business (an “Account”) manage contacts, sales pipelines, a shared inbox, and automated conversations, and connect and manage supported messaging channels, including WhatsApp through Meta’s APIs. This policy covers the instance ofSANAYAD CRM hosted by Sanayad Tech at crm.sanayadtech.com and describes what data it processes, why, and how it is protected.

2. Who We Are / Data Controller

Sanayad Tech operates and hosts this instance of SANAYAD CRM. For account, billing, and login data, Sanayad Tech acts as the data controller. Where a business uses this Service to store and message its own customers, that business is the data controller of its customers’ contact and conversation data, and Sanayad Tech acts as a data processor on that business’s behalf, providing the underlying software and infrastructure.

3. Information We Collect

The Service processes the following categories of data, based on how a given Account is configured and used:

• Account and profile information: full name, email address, a bcrypt hash of your password (never the plaintext password), avatar image, and your role within the Account (owner, admin, agent, or viewer).
• Team and invitation information: email addresses and invitation tokens when an Account admin invites a teammate, and API keys an admin generates for programmatic access (only a one-way hash of each key is stored).
• Contact / customer information: names, phone numbers, tags, and custom fields that an Account enters manually or imports (e.g. via CSV) about its own customers.
• WhatsApp-related information: for Accounts connected through the official Meta Cloud API, the WhatsApp Business Account (WABA) ID, phone number ID, and an access token (stored encrypted). See Section 5.
• Messages and conversation data: message text, message type, delivery/read status, timestamps, quoted-reply references, interactive button/list replies, and emoji reactions exchanged between an Account and its contacts.
• Media and files: images, video, audio, documents, and stickers sent or received over WhatsApp, retrieved through an authenticated proxy and stored on the Service’s file storage.
• Message templates: template name, category, language, header/body/footer text, and Meta’s approval status, for Accounts using the Meta Cloud API.
• Broadcast and delivery data: recipient lists and per-recipient sent/delivered/read/ replied/failed status and timestamps for bulk messages.
• Automation and flow configuration: trigger rules and chatbot-style flow definitions an Account configures, and the progress of a contact through them.
• Authentication / session information: a session cookie issued after sign-in to keep you logged in.
• Technical / security information: request metadata processed transiently to rate-limit and block abusive requests, and standard server error logs used for troubleshooting.
• Presence information: whether a signed-in teammate is currently online or away, shown to other members of the same Account in the shared inbox.

4. How We Use Information

• To provide and operate the CRM (contacts, pipelines, shared inbox, broadcasts).
• To send and receive WhatsApp messages, media, and templates on an Account’s behalf.
• To authenticate users and enforce account roles and permissions.
• To run automations and conversational flows that an Account has configured.
• To detect and prevent abuse, and to maintain the security of the Service.
• To troubleshoot and maintain the Service.
• To forward message events to an external webhook (e.g. n8n or Make), but only if an Account admin has explicitly configured one.

5. WhatsApp / Meta Data

SANAYAD CRM is a CRM platform that can allow business customers to connect and manage supported messaging channels, including WhatsApp, through Meta’s APIs. When a business connects its own WhatsApp Business account, SANAYAD CRM processes data received through that connection to make the shared inbox, automations, and broadcasts work, including: WhatsApp Business Account information, phone number information, customer/contact information, message content, message metadata (type, timestamps, status), media, message templates, and delivery/read status.

Currently implemented: an Account connects WhatsApp through the official Meta Cloud API.

Under development: a “Coexistence” connection mode is shown in the product as coming soon but is not yet implemented or available in production.

6. How We Share Information

• Meta Platforms, Inc. — for Accounts using the Meta Cloud API, messages, media, and templates are sent to and received from Meta’s WhatsApp Business Platform, which processes them under Meta’s own terms and privacy policy.
• A webhook the Account configures — if an Account admin sets up outbound message forwarding (e.g. to n8n, Make, or a custom service), a copy of each message event is sent to that endpoint. This is off by default and entirely opt-in per Account.

We do not sell personal information, and we do not share it with any other third party. The Service does not integrate any analytics, advertising, or tracking services.

7. Data Storage and Security

• Passwords are hashed with bcrypt and never stored or logged in plaintext.
• WhatsApp access tokens and webhook verify tokens are encrypted at rest (AES-256-GCM).
• Incoming WhatsApp webhook requests are verified against Meta’s HMAC-SHA256 signature before being processed.
• Each Account’s data is isolated at the database level so one Account cannot read another’s data.
• The Service applies standard security headers (HSTS, X-Frame-Options, a Content-Security-Policy, and others) to every response.
• Data is stored on the infrastructure Sanayad Tech operates for this instance.

8. Data Retention

The Service does not currently enforce an automatic deletion schedule for account, contact, or message data: data is retained for as long as the Account remains active and for as long as is reasonably necessary for the operational purposes described in this policy. Rate-limit counters are held in memory only and expire automatically within minutes.

9. User Rights / Data Requests

The Service does not currently expose a self-service page for exporting or requesting a copy of your data. To ask about accessing, correcting, or deleting data associated with you or your Account, contact us at mouayad@sanayadtech.com.

10. Account and Data Deletion

An Account admin can remove a teammate from an Account at any time from Settings → Members; this revokes that person’s access to the Account but does not, by itself, erase their underlying login. The Service does not currently include a self-service “delete my entire Account and data” control or a data-export button. Until one is available, deletion requests are handled manually — contact us at mouayad@sanayadtech.com.

11. Cookies and Similar Technologies

The Service sets a single essential session cookie after sign-in, used only to keep you authenticated. It does not use analytics, advertising, or cross-site tracking cookies.

12. Third-Party Services

The only third-party service the Service integrates with is Meta’s WhatsApp Business Platform (Cloud API), used when an Account connects WhatsApp that way. An Account may additionally choose to forward message events to a webhook of its own choosing (see Section 6); Sanayad Tech does not operate that endpoint.

13. Children’s Privacy

The Service is a business tool and is not directed at, or knowingly used to collect information from, children. If you believe a child has provided personal information through the Service, contact us and we will address it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page reflects the most recent revision.

15. Contact Information

Questions about this Privacy Policy or how Sanayad Tech handles data can be sent to mouayad@sanayadtech.com.