Privacy Policy

Ipercepts Creative Soft Tech Private Limited ("iPercepts", "we", "us" or "our") provides iCRM, a subscription-based customer relationship management service, together with related implementation and support services.

This policy explains how personal information is handled through ipercepts.com, our iCRM services and customer instances, and the mobile features described below. A separately agreed customer contract or data-processing agreement may provide additional details about a particular deployment.

Business address and privacy / grievance contact:
Business address: 109 Jagtap Layout, Amar Nagar, Hingna Road, Nagpur, Maharashtra – 440016
Privacy and grievance contact: Support and Grievance Team
Email for privacy concerns, grievances and deletion requests: support@ipercepts.com

For enquiries, our own account administration, billing and business communications, we determine how information is used for those purposes. When a customer organization adds information about its leads, customers or employees to iCRM, we handle that information on its behalf to provide the agreed service, subject to the contract and applicable law.

Your organization controls its users, permissions and business records. Its administrators may manage information within the access granted to them. If you are an employee, contact or customer of an organization using iCRM, contact that organization about its use of your information; we will assist it with appropriate privacy requests.

• Account and enquiry information: names, work contact details, company information, account identifiers, demo requests and correspondence that you provide.
• Customer business records: the leads, contacts, sales activities, meeting details, notes, files and other records that customers choose to enter or connect to the service.
• Subscription and billing information: plan and order details, billing contact information, invoices and payment references needed to administer your account. Payment-provider involvement is described in the service-provider section.
• Technical and support information: information generated when you access or troubleshoot the service, such as IP addresses, browser/device information, timestamps, error records and communications you send to support, to the extent recorded by the deployed service.
• Connected services and mobile information: the Google and mobile data specifically described in the following sections, when those features are used.

Please provide information that is necessary for your use of the service and that you are authorized to share. Additional categories introduced by custom modules should be described in the deployment-specific notice before collection.

We use information to provide the subscribed CRM features; create and manage accounts; respond to enquiries; perform agreed implementation, training and support; administer subscriptions and invoices; troubleshoot and protect the service; and meet applicable legal obligations.

We may send relevant service notices and respond to your requests. Marketing communications are subject to applicable consent and opt-out requirements. You can ask us to stop marketing messages using the contact details below. Google-derived information is subject to the stricter limitations in the next section and is not used for our marketing.

You can choose to connect multiple calendar accounts to your own CRM user profile. Google Calendar and, where configured and enabled, Microsoft Outlook / Microsoft 365 request authorization through the relevant provider. Connection is optional, and the provider displays the permissions requested.

We use connected-calendar information to provide these selected, visible calendar and meeting functions. The security and retention sections describe stored event copies, authorization credentials, access controls and deletion practices. A connection does not give other CRM users access to the account's password.

Google Limited Use commitment

Our handling of information obtained through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data and developer policy.

Google-derived information is not sold, used for advertising or credit decisions, or used to train generalized AI or machine-learning models. Transfers are limited to permitted service features with consent, security needs, legal obligations, or a qualifying business transfer with the required consent. Human access is limited to circumstances permitted by Google, such as your specific affirmative agreement, a necessary security investigation or a legal requirement. These limits also apply to derived information and to people or providers acting for us.

Your connection and sharing controls

Manage each connected account separately in Settings > Calendar. You can change the display, CRM-meeting and team-visibility options provided for the connection, or choose Disconnect to remove its configuration. You can also revoke Google access through your Google Account connections. For Microsoft, manage the app permissions available through your Microsoft account or organization administrator.

Using Disconnect in iCRM performs the synchronization, token deletion, provider revocation and cached-event deletion described above. Disconnection does not itself cancel meetings or withdraw invitations already created in external calendars. For deletion of other personal information held by iCRM, contact the Support and Grievance Team or your organization's administrator as appropriate; the retention section explains the one-day request process and the separate customer-deactivation process.

Mobile permissions and employee information depend on the features enabled for your organization. The current practices covered by this policy are:

Depending on the features enabled by the customer's organization and the permissions granted on the device, the iCRM mobile app may request GPS/location access, camera or photo access to capture attendance photos, file access or upload functionality, and notification permission for app/push notifications. These permissions support the related CRM features, such as location-based attendance and field activity, attendance photo capture, uploading files to CRM records, and notifications.
GPS tracking starts when the user punches in for attendance and stops when the user punches out. During that attendance period, the iCRM mobile app collects GPS location data both while in use and while running in the background, including when it is not visible on screen, subject to the location permissions granted on the device. Continuous GPS tracking is limited to the period between punch-in and punch-out. This location information supports the location-based attendance and field-activity features enabled for the organization.
The app can also support recording a meeting when the customer/participants provide consent through the in-app consent process. Meeting recordings may contain voices, images and statements of participants and should be made only after the required consent has been obtained.
Users can manage or withdraw device-level permissions in their device settings; disabling a permission may make the associated feature unavailable. The customer organization is responsible for informing its employees and other participants about its use of attendance, background location and meeting recording, and for providing any additional notices or obtaining permissions required by law.
Access to employee locations, attendance photos and meeting recordings is governed by the roles, permissions and hierarchy configured in the customer organization's CRM. Customer administrators have full access to this information within their own organization. Other users can access it only to the extent permitted by their assigned roles, access rights and configured hierarchy.

Your organization should provide its own appropriate employee notice and obtain any required permissions for workplace monitoring. Device permission settings can affect the availability of location, camera, file and notification features.

Information may be available to your organization's authorized users for the configured CRM functions; to the service providers identified below where needed to deliver, maintain or support the service; and to authorities or other parties where disclosure is required by law or necessary to address a lawful security issue.

Any business reorganization or transfer involving personal information must respect applicable law and the commitments in this policy. Google-derived information remains subject to the specific Limited Use, consent and human-access restrictions above; this general sharing section does not expand those permissions.

The providers involved, their roles and relevant processing locations are:

Our production iCRM service is hosted on Hostinger VPS servers in India. Backups of customer CRM data are also stored in India.
Our development and testing environment uses Vercel for the frontend, Render for the backend, and Hostinger for the testing PostgreSQL database. We do not use real customer data in the development or testing environment.
Email, SMS, WhatsApp, payment and file-storage integrations depend on the services selected by each customer. We connect the providers that the customer chooses and authorizes for its deployment. Information needed for an enabled integration is exchanged with that provider in accordance with the customer's configuration, instructions and granted permissions.
The enabled providers and their processing locations vary by customer deployment. Customers can consult their organization's administrator or contact our Support and Grievance Team for details of the integrations configured for their account. Connected providers handle information under their applicable terms, privacy policies and account settings, and may process information outside India. The India storage locations described above apply to our production CRM service and its backups.
Information obtained through Google APIs remains subject to the Google Limited Use commitments in this Privacy Policy, including when another integration is enabled.

Where information is processed outside your country, the applicable safeguards and contractual arrangements depend on the provider, location and relevant law. Contact us for information about the arrangement that applies to your customer deployment.

We retain information for the purposes described in this policy and the applicable customer agreement, subject to necessary legal retention. Our current retention and deletion practices are:

Customer CRM data is retained while the customer uses the subscribed service. When the customer's CRM services are deactivated, we retain their CRM workspace data for a 30-day cooling-off period so that they can request reactivation before permanent deletion.
As part of the exit process, we export the customer's CRM data to Excel and provide the export to the customer. Customers should request and verify their export before the cooling-off period ends.
If the services have not been reactivated by the end of the 30-day period, we permanently delete the customer's CRM instance and associated workspace data from our systems, including backups and logs, at the end of that period. We email the customer before permanent deletion and send a further email once deletion has been completed. After permanent deletion, the deleted data cannot be restored.
Application and database backups are taken every two days; customer data held in those backups is included in this deletion process. Information that must be retained to comply with law or resolve a legitimate dispute may be retained only as required for that purpose.
The 30-day cooling-off period applies to customer service deactivation. For a separate personal-data deletion request, our team completes deletion within one day of the request, subject to verifying the requester's identity or authority and any applicable legal-retention requirements.
When a user disconnects a connected calendar account, background synchronization stops immediately. We immediately delete the stored authorization tokens and cached calendar events for that connection and revoke the provider authorization.

Information retained for a specific legal purpose is restricted to that purpose and is not used for unrelated purposes. Any legal-retention exception does not permit unrelated reuse of Google-derived information. Cancelling a subscription, revoking Google access and requesting deletion are separate actions; contact us if you need assistance with any of them.

Subject to applicable law and our role in processing the information, you may request access, correction, an export or deletion of your personal information, withdraw consent where processing relies on it, or raise a privacy concern. Contact support@ipercepts.com with your account or organization name and enough detail to identify the request. We may take proportionate steps to verify your identity or authority.

For records controlled by your customer organization, send the request to its administrator first. We will support the organization as appropriate. Where a request cannot be fulfilled in full, we will explain the applicable reason and any available next steps. You may also have rights to contact the competent authority under the law that applies to you.

The website and service use the technologies and controls described below:

We do not use Google Analytics, Meta/Facebook Pixel, advertising trackers, third-party chat widgets, or embedded YouTube videos or Google Maps on our website or in the CRM. We do not use cookies or similar technologies for analytics, advertising or cross-site profiling. Any browser storage needed for sign-in, session continuity or security is used only for those essential functions. You can manage cookies and browser storage through your browser or device settings.

You can manage cookies through your browser and any available site consent controls. Blocking essential session or security technologies may affect sign-in or other features. Where you choose to use third-party embedded content, the relevant provider may also process information under its own privacy notice.

The storage and security practices used for our service, including Google authorization credentials, are:

Each customer receives a separate CRM application instance, codebase and database to keep customer environments isolated. Production is hosted on a Hostinger VPS. Our active production safeguards include HTTPS/TLS for data in transit; password hashing; token-based sessions with automatic expiry; secure password reset; role-based access controls; API rate limiting; CORS restrictions; secure HTTP headers; input validation; dependency updates; and a Hostinger firewall. The production database is not exposed to the public internet and is accessible through authorized server access by our team. Application activity logs record who accessed or changed information and when. Our team takes application and database backups every two days to support recovery. Access to customer environments and data is restricted to authorized personnel for service, support and maintenance purposes.

No internet service can eliminate every risk. Please protect your account credentials, limit access to authorized users and report suspected misuse promptly. When a security incident affects personal information, we will investigate, take appropriate remedial steps and provide notifications required by applicable law and our contractual commitments.

iCRM is offered as a business service for organizations and their authorized personnel. If an organization enters information about children or other information requiring special protection, it must establish the necessary lawful authority and work with us on suitable processing arrangements and notices. Contact us if you believe information has been collected or disclosed without appropriate authority.

We may update this policy to reflect changes to the service, data practices or legal requirements. The effective date identifies the current version. We will give appropriate notice of material changes and obtain additional consent when required, including before using Google information for a new purpose that requires it.

Ipercepts Creative Soft Tech Private Limited
Business address: 109 Jagtap Layout, Amar Nagar, Hingna Road, Nagpur, Maharashtra – 440016
Privacy and grievance contact: Support and Grievance Team
Email for privacy concerns, grievances and deletion requests: support@ipercepts.com

Email: support@ipercepts.com
Website: ipercepts.com

Please identify whether your request concerns the website, an iCRM customer account, the mobile app or a connected Google Account so that it reaches the appropriate team.