Privacy Policy

1. Introduction & Scope

SmoothSales.ai Technologies Private Limited ("SmoothSales", "we", "us", or "our") provides a multi-tenant sales CRM, automated lead distribution engine, channel partner portal, and conversational messaging management platform (the "Service").

This Privacy Policy explains how we collect, store, process, transfer, and protect personal data when you interact with our websites, subscribe to our software services, or when your business enters lead, customer, or partner data into the SmoothSales ecosystem.

2. Data We Collect

We process personal data in two primary capacities: as a Data Controller for our direct customers/account holders, and as a Data Processor on behalf of our business tenants.

• Account & Administrative Data: Names, business email addresses, mobile telephone numbers, billing addresses, tax identifiers (GSTIN/PAN), and password hashes for tenant administrators, sales agents, and channel partners.
• Tenant Customer & Lead Data (Processed on Tenant's Behalf): Information ingested through webhook connectors, Meta Lead Ads, IndiaMART, Justdial, Google Forms, or manual entry, including customer names, phone numbers, email addresses, property/product preferences, budget brackets, and call outcome notes.
• Telephony & Communication Logs: Call attempt timestamps, duration, disposition status (e.g., Interested, RNR, Site Visit Scheduled), SMS dispatch logs, and official WhatsApp Business API conversation metadata.
• Technical & Telemetry Data: IP addresses, browser types, operating systems, session identifiers, audit log records, and error telemetry used for security verification and load balancing.

3. Purpose and Legal Basis for Processing

We process personal information under the following legitimate grounds:

• To provide, operate, and maintain high-velocity lead ingestion and round-robin distribution algorithms;
• To execute SLA tracking, stale-lead auto-reassignment timers, and escalation alerts;
• To deliver transactional WhatsApp and SMS messages requested by tenants and their leads;
• To accurately attribute channel commissions, broker referral payouts, and partner ledger statements;
• To detect and prevent fraudulent account creation, unauthorized cross-tenant data access, or API abuse.

4. Third-Party Sub-Processors & Data Sharing

We do not sell, rent, or trade your personal data or your leads' personal data to third parties. We share data solely with trusted infrastructure sub-processors essential to delivering our services:

• Cloud Infrastructure: Amazon Web Services (AWS ap-south-1 Mumbai Region) and Cloudflare for edge security and SSL termination.
• Payment Processing: Razorpay and Cashfree Payments for PCI-DSS compliant subscription billing and partner commission disbursements.
• Official Messaging Gateways: Meta Platforms, Inc. (WhatsApp Cloud Business API) and registered Indian Telecom DLT SMS aggregators for transactional communication.
• Identity & Audit Tools: In-house role-based access control with encrypted session tokens.

5. Tenant Data Ownership & Logical Isolation

Every tenant operates within a strictly partitioned logical environment. Lead databases, partner hierarchies, and deal pipelines belonging to Tenant A are cryptographically and query-level isolated from Tenant B.

You own your data. SmoothSales claims no intellectual property, commercial, or resale rights over customer and lead contacts uploaded by your sales team or partners.

6. Data Retention & Deletion

We retain personal data only for as long as your workspace subscription remains active and in good standing. Upon account cancellation or written request:

• Tenants are granted a 30-day grace period to export full lead lists, deal records, and commission ledgers in CSV format;
• Following the grace period, tenant database partitions and associated webhook caches are purged from production clusters within 60 days;
• Backups are rotated out of archive storage in accordance with standard 90-day retention policies.

7. Compliance with India's DPDP Act 2023

SmoothSales is designed to adhere to India's Digital Personal Data Protection Act, 2023 (DPDPA). We uphold the statutory principles of purpose limitation, data minimization, accuracy, reasonable security safeguards, and mandatory breach notification procedures.

8. Your Rights as a Data Principal

Under applicable data protection laws, you and your data subjects have the right to:

• Request confirmation, access, and copies of personal data stored in your workspace;
• Request correction of inaccurate or outdated lead profiles;
• Request erasure or withdrawal of consent where processing is based on voluntary consent;
• Nominate a representative in the event of death or incapacity as provided under Indian law.