Privacy Policy

The distinction below decides which of your rights apply and who you should approach, so it comes first rather than buried in a later clause.

• As a controller. For people who visit this website, request a demo, contact us, or sign up for an account, we decide why and how their personal data is used. This policy governs that data.
• As a processor. VKomak CRM is a multi-tenant CRM. The records a subscribing organisation (a “tenant”) puts into it — its leads, contacts, companies, tickets, call logs and the people named in them — belong to that organisation. We store and process those records only on that organisation’s instructions. If you are a customer, employee or contact of a business that uses VKomak CRM, that business is the controller of your data and its own privacy policy applies; please direct requests to it, and we will support it in responding.

We collect only what a form asks for. Specifically:

• Account signup. Username, first and last name, email address, mobile number, and a password. The password is transmitted to our API and stored only as a cryptographic hash; it is never written to browser storage and we cannot read it.
• Demo requests and enquiries. The name, work email, company and message you submit through our demo and contact forms.
• Subscription details. The plan, currency, billing cycle and seat count you select, and the resulting subscription and invoice records.
• Technical data. Server logs recording IP address, user agent, the pages requested and timestamps, kept for security and diagnostics.

Payment card data is never collected by us. Card, UPI and net-banking details are entered directly into Razorpay’s checkout and handled by Razorpay. We receive only the outcome of a payment and a transaction reference.

• To create and administer your account and subscription (performance of a contract).
• To take payment, issue invoices and meet tax and accounting obligations (legal obligation).
• To respond to demo requests and enquiries, and to send service messages such as sign-in details, billing notices and renewal reminders (legitimate interests, or your consent where required).
• To keep the service secure, investigate misuse and diagnose faults (legitimate interests).

We do not sell personal data, and we do not use tenant CRM data to train machine-learning models.

This website sets no advertising or tracking cookies. The only thing it stores in your browser is a single localStorage entry recording your light or dark theme preference. It contains no identifier and is never transmitted to us. Clearing your browser storage removes it and nothing else.

We share personal data only with service providers who process it on our behalf under contract, and only as far as their function requires:

• Razorpay Software Private Limited — payment processing.
• Amazon Web Services — hosting and file storage.
• Our email delivery provider — transactional email such as sign-in and billing notices.

We may also disclose data where the law requires it, or to establish or defend legal claims. If our business is transferred, personal data may transfer with it, and we will give notice before that happens.

TO CONFIRM: Confirm this list against your live infrastructure before publishing, and name the email provider. A sub-processor that is used but not listed is the most common defect in a SaaS privacy policy.

VKomak CRM data is hosted on infrastructure operated by our cloud provider. Where data is transferred outside India, we rely on contractual safeguards with the provider concerned.

TO CONFIRM: State the actual hosting region (for example ap-south-1, Mumbai). Customers in regulated sectors ask this before they buy, and a vague answer costs deals.

Account and subscription records are retained for as long as your subscription is active and afterwards for the period required by tax and company law. Enquiry and demo-request data is kept while we are in contact with you and for a reasonable period after. Server logs are kept on a short rolling window.

When a subscription ends, tenant data is retained for a defined recovery window and then deleted. A tenant may request export or earlier deletion at any time.

TO CONFIRM: Set the concrete figures: the post-cancellation recovery window in days, and the server-log retention period. This clause is not enforceable while the numbers are unstated.

Access to the application requires authentication, and permissions are enforced per tenant and down to the individual feature, so a signed-in user reaches only what their role allows. Passwords are stored as hashes. Traffic to the website and the API is encrypted in transit. No system is perfectly secure, and we do not claim otherwise; if a breach affects your personal data we will notify you and the relevant authority as the law requires.

Subject to applicable law — including the Digital Personal Data Protection Act, 2023 in India, and the GDPR where it applies — you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its use, or withdraw a consent you previously gave. Write to us at the address in section 11 and we will respond within the period the law allows.

If your data sits inside a tenant’s CRM, please approach that organisation first — see section 1.

VKomak CRM is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 18.

For any privacy question, or to exercise a right under section 9, contact us at contactus@vkomaktechnologies.com or +91 44 - 40066713, or write to VKomak Technologies Pvt Ltd, Chennai – Saidapet, Tamil Nadu, India.

TO CONFIRM: Indian law requires a named Grievance Officer with published contact details for a service of this kind. Add the name, designation and a dedicated email address here.

We may update this policy as the service changes. The revision date at the top always reflects the current version, and we will give notice of material changes to account holders.