Legal

Privacy Policy

Last updated: 5 October 2026

1. Who we are

MisterCRM ("MisterCRM", "we", "us") is a customer relationship management (CRM) service for businesses, available at mistercrm.com and its sub-domains. Businesses use it to capture enquiries from their website, Meta (Facebook and Instagram) lead ads, Google Ads lead forms and WhatsApp, and to follow them up by phone, WhatsApp, email and SMS.

This policy explains what personal data we handle, why, and the choices you have. It applies to our website, the MisterCRM application and our integrations with Meta, WhatsApp and Google.

2. Our two roles

  • For our own visitors and customers (people who visit mistercrm.com, request a demo, or sign up for an account), MisterCRM decides how the data is used.
  • For the leads and contacts our customers store in MisterCRM, the business that uses MisterCRM decides how that data is used. We process it only on that business's instructions, to provide the service. If you are a lead or contact of a business that uses MisterCRM, please contact that business first; we will help them respond to you.

3. What we collect

From our website and account holders

  • Name, work email, phone number, company name, industry and team size that you enter in our demo, contact or sign-up forms.
  • Account details: login email, encrypted password, role, and sign-in history (time, IP address, browser).
  • Billing details such as plan, invoices and payment status. Card and bank details are entered on Razorpay's pages and are never stored by us.
  • Technical data: IP address, browser type, pages visited and error logs, used to run and secure the service.

Data our customers store in MisterCRM

  • Lead and contact details such as name, mobile number, email, city, course or product of interest, notes, follow-ups, documents and application details.
  • Messages sent and received through the service: WhatsApp messages and media, emails (with open and click tracking where the business turns it on) and SMS.

From connected platforms

  • Meta Lead Ads (Facebook and Instagram): the answers a person submits in a lead form (for example name, phone, email, city), the lead ID and time, and the form, campaign, ad set and ad it came from. We also store the Page ID and the access token the business provides to connect its Page.
  • WhatsApp Business Platform: the WhatsApp phone number and profile name of people who message the business, the messages and media exchanged, message delivery and read status, and, where a chat starts from a click-to-WhatsApp ad, the ad reference Meta provides.
  • Google Ads lead forms: the answers submitted in the lead form and the campaign details Google sends with them.

Cookies

We use only the cookies needed to run the service: a session cookie to keep you signed in, and a security (CSRF) cookie. The app may also remember display settings, such as a collapsed menu, in your own browser. We do not use advertising or third-party tracking cookies.

4. How we use it

  • To provide MisterCRM: create leads, assign them to the right person, show conversations, send the messages a business asks us to send, and produce reports.
  • To reply to demo and contact requests, provide support and send service notices (for example security alerts, billing and changes to the service).
  • To keep the service secure, prevent abuse and fraud, and fix problems.
  • To meet legal, tax and accounting obligations.

We do not sell personal data, and we do not use our customers' CRM data for our own marketing or advertising.

5. Meta, WhatsApp and Google data

When a business connects its Facebook Page, WhatsApp Business account or Google Ads account to MisterCRM:

  • We access only the data needed for the features that business turned on: receiving leads, sending and receiving WhatsApp messages, and managing message templates.
  • Data received from Meta or Google is used only to provide MisterCRM to that business. It is not sold, not shared with data brokers, not used to build advertising profiles, and not used to train AI models.
  • Access tokens and app secrets are stored encrypted and are never shown in full again after they are saved.
  • A business can disconnect an integration at any time from its MisterCRM settings. After that we stop receiving new data from that platform. You can also remove MisterCRM's access from Facebook under Settings & privacy → Settings → Business integrations.
  • We follow the Meta Platform Terms, the WhatsApp Business policies and the Google API Services User Data Policy, including their limited-use requirements.

6. Who we share it with

We share personal data only with service providers that help us run MisterCRM, and only as far as needed:

  • Amazon Web Services - hosting, database, file storage and content delivery (Mumbai, India region).
  • Meta Platforms - to receive lead ads and to send and receive WhatsApp messages for the business that connected them.
  • Google - to receive Google Ads leads for the business that connected them.
  • Email and SMS providers chosen by each business (for example its own SMTP server, Amazon SES or an SMS gateway), to deliver the messages it sends.
  • Razorpay - to process payments.

We may also disclose data when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy will continue to apply.

7. Storage and security

  • Data is stored on Amazon Web Services in India (Mumbai region).
  • All traffic is encrypted with HTTPS. Passwords are hashed, and third-party credentials such as access tokens are encrypted.
  • Each business's data is kept separate from every other business's data, and staff see only what their role allows.
  • Uploaded documents are served only through short-lived signed links.

No system is perfectly secure, but we work to protect your data and will notify affected customers and authorities of a data breach as the law requires.

8. How long we keep it

  • CRM data is kept for as long as the business keeps its MisterCRM account, or until the business deletes it.
  • When an account is closed, its data is deleted within 30 days, except records we must keep by law (such as invoices).
  • Demo and contact requests are kept for up to 24 months.
  • Backups are overwritten on a rolling cycle of no more than 35 days.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023 and other laws that apply to you, you can ask to:

  • see a summary of the personal data we hold about you;
  • correct or update it;
  • delete it;
  • withdraw consent you have given; and
  • raise a grievance with us, and if you are not satisfied, with the Data Protection Board of India.

Write to hello@mistercrm.com. We reply within 30 days. If your data was added by a business that uses MisterCRM, we will pass your request to that business and help them act on it.

10. Deleting your data

You can ask us to delete data we received about you, including data from Facebook, Instagram or WhatsApp. See our data deletion instructions for the steps.

11. Children

MisterCRM is a business service and is not meant for children. We do not knowingly collect data from children for our own purposes. Businesses that store data of people under 18 (for example, school or college applicants) are responsible for getting the consent the law requires.

12. Changes to this policy

We may update this policy. We will change the date at the top, and tell account holders about important changes by email or in the app before they take effect.

13. Contact and grievance officer

For any privacy question, request or complaint, contact our grievance officer at hello@mistercrm.com.