Privacy Policy

AD CRM · ALL DECISIONS · Last updated: 25 Oct 2026

1. Who we are

This CRM ("AD CRM") is operated by ALL DECISIONS (08 Ward No 06, Gadi Mohalla Betma BETMA). The company (our customer) that uses the CRM is the "data fiduciary" for its employees' and customers' data; we process that data on its behalf ("data processor"). For CRM account data (sign-up, billing) we are responsible ourselves.

2. What data is collected

• Employees: name, mobile, email, designation, login records (time, device, IP), attendance, visits, expenses, tasks.
• The company's customers/leads: company and branch name/address, contact person name, mobile, email, designation, orders/quotes, notes — entered by the company, imported from Excel, or received from Facebook Lead Ads / website forms.
• WhatsApp: sent and received messages, photos/PDFs/voice notes, message status (sent/read), consent (opt-in) and STOP, call time and duration.
• Payments: bill amount and payment status/transaction ID. We never see or store card numbers, UPI PINs or bank passwords.

3. Location and photos

Location is taken only when an employee presses punch in, punch out or save visit (and the company has enabled it). No location is taken after punch-out, on days off, or when the app is closed. Permission can be turned off anytime in phone settings.
• Duty-time location (when the company enables it): From punch-in to punch-out, while the app is open on the phone, location is taken at a set interval (5–30 minutes) — only if the team member turns it on themselves in "My data" (no pop-up), and they can turn it off anytime. Battery %: if the company keeps it on, the phone battery % and whether it is charging — nothing more — is saved at punch-in / punch-out / duty location, so the reason is known if a phone switches off. Only that company's admins / managers can see it, and it is deleted automatically after the company's chosen period (30–365 days, default 90).

4. Cookies and website analytics

Inside the CRM we use only essential cookies (keeping you signed in, language). Visitors on public pages are counted without storing IP addresses or names. Google Analytics and Meta Pixel run only if you tap "Accept" on the cookie bar — to improve the website and measure ads, and only on public pages, never inside the CRM. Tap "Decline" and they do not run; to change your choice, clear this site's data in your browser.

5. Employee home address (optional)

If the company turns this on, an employee may, with consent, add a home address and a one-time 📍 home pin under "My address" — only for emergency/HR contact. Only company admins can see it; it is not continuous tracking. The employee can delete it anytime; it is auto-deleted 180 days after the account is deactivated.

6. How data is used

Only for the purpose the company runs the CRM for: attendance, field visits, managing customers and leads, orders and payments, talking to customers on WhatsApp, reports, and keeping the CRM secure and improving it. Data is never sold or used for advertising.

7. WhatsApp and Meta

WhatsApp messages go through Meta's official WhatsApp Business Platform (Cloud API), so they pass through Meta's servers and Meta's policies also apply. Marketing messages are sent only to people who have consented; anyone can reply "STOP" to opt out. We do not call customers without their permission; call audio is not recorded — only time and duration are logged.

8. AI assistant (when enabled)

If the company turns on the "AI assistant", the recent part of a chat and the information provided by the company are sent to an AI service (Anthropic Claude, OpenAI ChatGPT or Google Gemini — whichever is chosen) to draft replies. Under their paid API terms these services do not use this data to train their models. When AI is off, no data is sent to any AI service. If asked, the AI says clearly that it is an AI assistant.
• AI bill reading (stock): If the company turns this on and an employee uploads a purchase bill, that bill (photo / PDF) is sent to the same AI service only to read products, quantities and rates. The employee can check and edit everything before saving. The bill file stays in the company's account and only authorised people can see it.

9. Service: photos, OTP and machine records

In a service ticket the engineer may add before / after photos — they stay in that company's account and only its authorised people can see them. When closing a ticket a one-time OTP may be sent to the customer's mobile (via WhatsApp) only to confirm the work is done; it expires within a few days. The company keeps the customer's machine serial number, warranty / AMC dates and service history to provide service and renewals.

10. Email from the CRM

An employee may email a quotation / order to a customer from the CRM. The email goes through our email delivery service, carries the company's name, and the customer's reply goes directly to the sending employee / company email. We do not use these emails for any other purpose.

11. Website chat ("💬 Help")

What you type in the "Help" chat on our website is sent to the AI service above to draft replies and is stored by us so our team can understand and help. We contact you only if you leave your name and number under "Talk to our team" — our team or our authorised Sales Partner (who sees only your name, number and request, for that purpose). Do not share passwords, OTP or bank details in the chat. Email us to have a chat deleted.

12. Who data is shared with

Only with services the CRM cannot run without: web hosting (Hostinger), Meta (WhatsApp, Facebook Lead Ads), payment gateways (Razorpay/PayU etc. — for payments only), an email delivery service, and the AI service (only when enabled). With government authorities when required by law. No one else.

13. Who can see it

Each company's data is kept separate; one company cannot see another's data. Within a company: employees see their own work, managers their team's, and admins the whole company's. Our team accesses it only for support or technical needs.

14. How long it is kept

As long as the company's account is active. Photos are deleted automatically after the period set by the company (Settings → "Auto-delete old photos"); login records 1 year; security backups are deleted automatically after a few days. When an account is closed, its data is deleted on the company's request (records required by law, such as GST invoices, are kept for the legal period).

15. Security

HTTPS (encrypted connection), encrypted passwords (no one can read them), security checks on every form, role-based access, secret keys hidden on screen, daily backups, and a log of every change.

16. Your rights (DPDP Act 2023)

You can ask to access, correct, complete or erase your data; withdraw consent at any time ("STOP" on WhatsApp); raise a grievance; and nominate someone. First ask your company admin; if unresolved, write to the contact below. We reply within 30 days. If not satisfied, you may complain to the Data Protection Board of India.

17. Children

This CRM is not meant for people under 18 and we do not knowingly collect their data.

18. Data deletion request

To delete your WhatsApp/Facebook-related data, ask your company admin, or email the address below with the subject "Data Deletion" and your mobile number. Data is deleted within 30 days after verification.

19. Contact & grievance officer

ALL DECISIONS, 08 Ward No 06, Gadi Mohalla Betma BETMA
Email: sales@alldecision.in

20. Changes

This policy may change; major changes will be announced in the CRM. Last updated: 25 Oct 2026.