Privacy Policy
1. Two kinds of data, two roles
Data inside a customer's workspace (their leads, buyers, bookings): the subscribing business is the Data Fiduciary and we are its Processor. How we handle that data is governed by our Data Processing Agreement, including the full list of sub-processors. If you are a property buyer whose details are in a builder's ZevroCRM workspace, that builder is responsible for your data — direct your requests to them, and we will assist them in honouring your rights.
Data you give us directly (this website's demo form, your ZevroCRM account, billing and support): we are the Data Fiduciary, and this policy covers it.
2. What we collect and why
- Demo requests: name, company, phone, email, city, team size — to respond to your enquiry about ZevroCRM. Nothing else, and no follow-up beyond that conversation unless you ask for it.
- Accounts: name, email, phone, role — to operate sign-in, security (such as OTPs and two-factor authentication) and support.
- Operations: technical logs (IP address, timestamps, actions) — to keep the service secure, attribute changes, and diagnose faults.
3. What we do not do
- We do not sell personal data.
- We do not use workspace data for advertising or to train models of our own.
- We do not send workspace data to any AI provider unless the workspace has explicitly authorised it — see the DPA.
- This website runs no third-party advertising or analytics trackers.
4. Retention and security
Account and workspace data is kept while the subscription is active and deleted or returned after termination as the DPA describes. Data is transported over HTTPS, sensitive identifiers are encrypted at rest, each workspace has its own database, and every change is written to an audit log.
5. Messages we send — WhatsApp, SMS and email
ZevroCRM sends a small number of service messages, and only to people who have a reason to receive them:
- Sign-in codes (OTP): a one-time code sent to the phone number or email on an account when that person asks to sign in or reset a password. It is sent to that number only, contains nothing but the code and the workspace name, and is never used for anything else.
- Staff alerts: short notices to a workspace's own team members — for example, that a new enquiry has been assigned to them. Each workspace chooses which alerts its team receives and on which channel, and a team member can ask their workspace administrator to switch them off.
- Messages a workspace sends to its own customers: these go out only from that business's own WhatsApp Business account or sender ID, never from ours. The business is responsible for consent and content; we act as its Processor under the DPA.
To deliver these we share the recipient's phone number or email address and the message text with the delivery provider for that channel — Meta Platforms (WhatsApp Business Platform) for WhatsApp, an Indian DLT-registered SMS aggregator for SMS, and our email provider for email. Each provider processes that data under its own terms and only to deliver the message. We keep a delivery log (channel, time, outcome, and the last four digits of the number) for billing and fault-finding; the full number and the message body are not retained in that log. We do not send marketing on WhatsApp or SMS from ZevroCRM's own number.
6. Your rights and data deletion
Under the DPDP Act, 2023 you may request access to, correction of, or erasure of your personal data, and you may raise a grievance. Write to hello@zevrocrm.com — we respond within a reasonable time, and within any period the law prescribes.
To have your data deleted: email hello@zevrocrm.com from the address on your account, or ask your workspace administrator, with the subject "Delete my data". We confirm receipt, remove the account and its personal data from our systems within 30 days, and tell you when it is done. Data that we must keep by law (such as invoices) is retained only for the period the law requires.
7. Requests from public authorities
If a government body, regulator or law-enforcement agency asks us for personal data, we:
- Check that the request is lawful — that it is in writing, comes from an authority entitled to make it, and has a valid legal basis under Indian law — before acting on it.
- Disclose only the minimum necessary — the specific records the request lawfully requires, and nothing more.
- Keep a record of every such request, our response, the legal basis relied on and who handled it.
Where the data belongs to a workspace's customers, we refer the request to that business as Data Fiduciary and notify it before disclosure unless the law forbids us. We received no such requests in the twelve months to October 2026.
8. Contact
Ethereal Design Studio (OPC) Private Limited, Plot No 9, Srinivasa Palms, Medavakkam, Kancheepuram, Tamil Nadu 600100, India · hello@zevrocrm.com · +91 96771 13225