Sahyak CRM Privacy Policy

1. Introduction and Scope

Welcome to Sahyak CRM ("Sahyak", "we", "our", or "us"). We provide an enterprise, mobile-first Customer Relationship Management platform purpose-built for real estate brokers, property developers, sales agents, and channel partners across 15 priority global markets.

This Privacy Policy sets out the principles and operational rules governing the collection, processing, storage, protection, and disclosure of information when you interact with our marketing website (https://sahyak.com), submit contact or sales inquiries, access downloadable resources, request product walkthroughs, or communicate with our team via email, telephone, or authorized messaging integrations.

This policy does not govern third-party platforms that you may choose to link to or integrate with Sahyak CRM, which remain subject to their respective independent privacy notices.

2. Identity of the Operating Entity

The Sahyak CRM website, intellectual property, brand assets, and platform services are developed and operated by Sahyak Real Estate Technologies Private Limited.

* Note: Specific statutory corporate filing numbers (CIN and GSTIN) are maintained within verified internal business records and are formally provided on commercial contracts and service invoices.

3. Categories of Individuals Covered

This Privacy Policy distinguishes between four distinct categories of individuals whose information may be processed:

• Website Visitors: Individuals who browse public web pages, review feature descriptions, compare multi-currency pricing plans, or read educational guides on sahyak.com.
• Prospective Customers & Enquirers: Individuals who voluntarily complete our contact forms, request live platform demonstrations, ask pricing questions, or initiate communication via our verified WhatsApp hotline.
• Customer Account Users & Administrators: Licensed brokers, developers, sales managers, and telecallers who are provisioned with authorized user accounts to access administrative and operational workspaces on the Sahyak CRM platform (crm.sahyak.com).
• Third-Party Real Estate Leads & Prospects: Home buyers, property investors, tenants, and site visit attendees whose names, phone numbers, or property preferences are entered into a customer's private workspace. (See Section 7 for the legal distinction regarding this category).

4. Information Collected Directly from You

We collect personal information directly when you choose to provide it through web forms or direct electronic communications:

• Full Name: To address you professionally and establish identity during inquiries.
• Work Email Address: Used to respond to your questions, provide platform proposals, and deliver scheduled trial information.
• Phone Number: Used to arrange scheduled product demonstrations, provide telephonic assistance, or respond via WhatsApp when requested.
• Company / Brokerage Name: To understand your business context, team structure, and applicable real estate market.
• Inquiry Type & Message Contents: Specific information regarding your requirements, such as requested team seats, integration needs, or feature questions.

5. Account, Authentication and Workspace Information

For authorized customer users and platform administrators accessing management interfaces:

• Administrative Authentication: Credentials are verified against server-side authorization controls. Successful login generates a cryptographically signed HMAC-SHA256 session token stored in an essential, secure, HttpOnly cookie named sahyak_admin_session with a strict 24-hour expiration lifetime.
• Role-Based Access Control (RBAC): We record assigned organizational roles (such as Superadmin, Administrator, Team Lead, Telecaller, or Viewer) to enforce strict boundary checks and prevent unauthorized data modifications.
• Session Revocation: Active sessions are tracked in our Cloudflare D1 database (admin_sessions table). Logout actions immediately invalidate session records.

6. Contact Form Processing & Anti-Abuse Defenses

When you submit our contact form (processed by the /api/contact backend endpoint):

1. Honeypot Anti-Bot Filter: Submissions contain a hidden anti-spam field (website_url). Automated spambots that populate this field are silently dropped without writing data to our database.
2. IP Hash Rate Limiting: To safeguard our infrastructure against Denial of Service (DoS) and form flooding, client IP addresses are immediately transformed into an irreversible one-way SHA-256 cryptographic hash (ip_hash). Rate limits allow up to 5 inquiries per 10-minute window per IP hash. Raw IP addresses are discarded from volatile memory.
3. D1 SQL Database Storage: Validated inquiries are stored in our secure Cloudflare D1 contacts table with status markers (e.g. new, in-progress, resolved).

7. Customer CRM Data & Third-Party Lead Information

Sahyak does not own, sell, rent, monetize, or use customer lead data for our own marketing purposes, nor do we cross-profile leads between separate customer workspaces. All customer-uploaded CRM records remain confidential to the subscribing organization.

8. Real Estate Operational Data Handling

Within the operational scope of Sahyak CRM, customers may manage specific categories of real estate operational data:

• Property Inventory & Listings: Project names, unit configurations, floor areas, pricing sheets, and unit availability statuses.
• Site Visit Coordination: Scheduled tour dates, site visit attendance verification, agent assignments, and client feedback notes.
• Communication Timestamps: Automated follow-up reminders, call schedules, and WhatsApp dispatch logs initiated by sales representatives.
• Deal Pipeline Statuses: Negotiation stages, booking forms, token payment confirmations, and sales cycle progress.

9. Technical Logs, Geolocation, and Pseudonymized Identifiers

To optimize site performance and deliver localized pricing across 15 priority real estate markets, our serverless edge handlers collect technical metadata:

• Edge Geolocation: Derived at the Cloudflare network edge via HTTP headers (cf-ipcountry, cf-ipcity, cf-region). This allows our multi-currency engine to suggest appropriate local currencies (e.g. INR for India, AED for UAE, USD for United States, GBP for United Kingdom).
• Device & Browser Diagnostics: Cleaned User-Agent metadata (browser family, operating system, screen width) to ensure responsive rendering across mobile and desktop devices.
• Irreversible IP Hashing: Raw IP addresses are processed in volatile memory only to generate a 16-character SHA-256 hash slice (ip_hash) for fraud prevention, rate limiting, and unique session aggregation. Raw IP addresses are not stored in database tables.
• Dwell Time Tracking: Dwell durations and section view counts are recorded via client-side IntersectionObserver to analyze feature interest and optimize documentation readability.

10. Cookies, Local Storage, and Client Storage Practices

Sahyak CRM adheres to a minimal, privacy-first storage architecture on our public website:

Zero Third-Party Advertising Trackers: We do NOT inject Google AdSense, Meta/Facebook tracking pixels, Hotjar, or third-party behavioral tracking cookies on our marketing site.

11. Lawful Grounds for Processing

Under applicable data protection frameworks (including the Digital Personal Data Protection Act, 2023 in India, and the General Data Protection Regulation in the EU/UK), we process personal data under the following legal bases:

• Consent: When you voluntarily submit a contact form, request a demo, or message us via WhatsApp, you provide explicit affirmative consent for us to respond to your specific request.
• Contractual Performance: Processing required to establish your customer workspace, deliver licensed software functionality, and fulfill subscription agreements.
• Legitimate Interests: Securing our network infrastructure, mitigating spam and automated brute-force attacks, debugging edge errors, and measuring aggregate platform reliability.
• Legal Obligation: Retaining mandatory financial and billing records as required under applicable tax and commercial legislation.

12. How Information is Used to Operate and Improve the Service

We use collected data solely for legitimate business operations:

• Responding promptly to sales, pricing, and enterprise demo inquiries.
• Managing customer onboarding, account setup, and user provisioning.
• Providing 24/7 technical customer support via verified electronic channels.
• Preventing automated bot abuse, scraping, and unauthorized penetration attempts.
• Evaluating which real estate sales playbooks and resources deliver the highest utility to brokers and property developers.

13. Customer Instructions & Workspace Boundaries

For all customer CRM workspaces, Sahyak processes data strictly under the customer's instruction. Subscribing organizations maintain autonomous control over:

• Which team members are invited and what role permissions they possess.
• What lead databases and contact records are imported into the workspace.
• When lead records are updated, archived, or deleted.

Customers are strictly prohibited from attempting to bypass logical workspace boundaries or access data belonging to other tenant organizations.

14. Data Sharing and Verified Subprocessors

We do not sell, rent, trade, or broker your personal information. We share data only with verified infrastructure subprocessors strictly necessary to deliver the Sahyak CRM service:

• Cloudflare, Inc. (Cloudflare Pages, Workers, & D1 Database): Provides global Content Delivery Network (CDN) caching, serverless edge compute runtimes, DDoS mitigation, and distributed serverless SQL database storage.
• Google LLC (Google Fonts): Static typeface stylesheets (Playfair Display, Inter, Caveat) are retrieved from Google CDN to render visual typography. Google does not receive personal contact records.
• Meta Platforms, Inc. (WhatsApp): When you click our direct WhatsApp communication links (e.g. wa.me/918796475107), communication occurs directly through Meta's WhatsApp infrastructure subject to Meta's privacy policy.

15. Disclosures for Legal Obligations & Rights Protection

We may disclose personal data only if required to do so by applicable law, or in the good-faith belief that such action is necessary to:

• Comply with valid judicial warrants, court orders, or enforceable statutory orders issued by competent government authorities.
• Enforce our Terms of Service and investigate suspected security incidents or unauthorized platform abuse.
• Protect the vital safety, rights, and property of Sahyak CRM, our customers, or the public from fraudulent or malicious activities.

16. Cross-Border Data Processing & International Transfers

Sahyak CRM utilizes Cloudflare's globally distributed edge network, spanning data centers in over 300 cities across 100+ countries, to terminate TLS connections near the end user and minimize latency.

Where data is transferred across international borders in connection with our 15 global priority markets (including India, UAE, United States, United Kingdom, Australia, and European nations), we ensure that appropriate technical, administrative, and contractual protections are applied in accordance with applicable data privacy regulations.

17. Retention Periods and Deletion Practices

We adhere to purposeful data minimization and defined retention cycles:

• Contact Form Inquiries: Retained in our D1 contacts database for the duration of the active business conversation and up to 24 months thereafter for prospective client follow-up, after which records are archived or deleted.
• Visitor Analytics Sessions: Session telemetry in analytics_sessions is retained for operational metrics and aggregate traffic reporting, with periodic pruning.
• Administrative Authentication Sessions: Expire automatically after 24 hours and are purged from admin_sessions upon logout or expiry.
• Customer CRM Workspace Data: Retained for the active duration of the customer's subscription agreement. Upon account cancellation, data is subject to export and deletion procedures as set out in Section 18.

18. Account Closure, Deletion Requests, and Data Portability

Customers and individual enquirers may exercise data management rights at any time:

• Data Export: Customer organizations may export their contacts, properties, and lead records in standard machine-readable formats (e.g. CSV).
• Deletion Requests: If you wish to delete your contact inquiry or request the erasure of your personal data from our marketing databases, submit an email to support@sahyak.com. We verify requester identity before processing deletion.
• Post-Termination Purge: Following account closure, customer workspace records are scheduled for complete deletion, subject only to records required to be preserved under statutory tax, financial, or dispute resolution requirements.

19. Technical and Organizational Security Architecture

Sahyak CRM enforces substantiated, modern software engineering defenses to safeguard all managed information:

• In-Transit Encryption: Enforced modern TLS 1.3 encryption across all public web and API endpoints, preventing network eavesdropping.
• Cryptographic Token Signatures: Administrative session tokens use HMAC-SHA256 signatures generated via the native WebCrypto API.
• Timing-Attack Defenses: Security credentials and session components are compared using constant-time string equality algorithms (timingSafeEqual) to prevent timing side-channel attacks.
• Cross-Site Request Forgery (CSRF) Defenses: State-mutating administrative APIs enforce strict Origin verification and Sec-Fetch-Site header inspection.
• Cloudflare Edge WAF & DDoS Protection: Edge firewalls and rate limiters actively mitigate brute-force attempts and anomalous traffic floods.

20. Security Limitations & Inherent Internet Risks

While we deploy rigorous technical and organizational controls, no electronic transmission over the internet and no automated database system can be guaranteed as 100% immune from security breaches, zero-day vulnerabilities, or unauthorized interception.

Users and customers are responsible for maintaining the confidentiality of their credentials, utilizing strong passwords, and notifying us immediately at support@sahyak.com if they suspect any unauthorized access to their workspace.

21. Data Subject Rights (India DPDP Act, GDPR, and Global Rights)

Depending on your jurisdiction, you possess specific statutory rights regarding your personal information:

• Right of Access & Summary: You have the right to request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Updating: You have the right to request correction of inaccurate, outdated, or incomplete personal data.
• Right to Erasure: You have the right to request deletion of your personal data where continued retention is no longer necessary for the purpose collected or required by law.
• Right to Grievance Redressal: You have the right to readily accessible grievance redressal mechanisms regarding our data processing.
• Right to Nominate (DPDP Act 2023): Under Indian law, individuals have the right to nominate another individual who shall, in the event of death or incapacity, exercise data rights on their behalf.

To exercise any of these rights, contact us at support@sahyak.com with the subject line "Data Subject Rights Request".

22. Consent Withdrawal and Practical Implications

Where processing is based upon your consent (such as voluntary contact form submissions or demo bookings), you have the right to withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing undertaken prior to the withdrawal. If consent is withdrawn, we will cease communications, which may mean we cannot proceed with scheduling your requested demo or providing customized proposals.

23. Customer Responsibilities Concerning Uploaded Lead Data

Customer organizations utilizing Sahyak CRM bear sole legal responsibility for the personal data they collect and import into the system. Customers represent and warrant that:

• They have acquired prospective buyer and client records through lawful, compliant means (e.g. voluntary real estate portal inquiries, website forms, site visit registrations).
• They have obtained all requisite consents and comply with telemarketing regulations, including National Do Not Call (DND) registries under Telecom Commercial Communications Customer Preference Regulations (TCCCPR) in India, or equivalent regulations in their operating jurisdictions.
• They will not upload scraped, stolen, or illicitly aggregated personal data into Sahyak CRM.
• They comply with applicable Real Estate Regulatory Authority (RERA) disclosure and record-keeping mandates.

24. Children's Privacy

Sahyak CRM is exclusively an enterprise, business-to-business (B2B) real estate software service. Our marketing website and platform applications are neither directed at nor intended for individuals under the age of 18.

We do not knowingly solicit or collect personal information from minors. If you believe that a minor has provided us with personal information, please notify us immediately at support@sahyak.com so we can investigate and promptly delete such records.

25. Third-Party Links and External Platforms

Our website may contain links to external third-party platforms, such as WhatsApp click-to-chat links, LinkedIn company profiles, or educational real estate references.

We do not control and are not responsible for the privacy practices, content, or policies of third-party websites. We encourage you to review the privacy notices of any third-party service you visit.

26. Amendments and Updates to this Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in our platform features, adjustments in our infrastructure subprocessors, or evolutions in applicable data protection legislation.

When updates occur, we will revise the "Effective Date" and "Document Version" at the top of this page. We encourage you to review this page periodically to stay informed regarding how we protect your information.

27. Contact Information and Grievance Procedures

If you have questions, concerns, comments, or grievances regarding this Privacy Policy or our data protection practices, please reach out through our verified contact points:

28. Regulatory Notice & Legal Approval Status