Privacy Policy & Data Processing Charter

Sahyak Technologies (referred to herein as “Sahyak”, “we”, “us”, or “our”) operates the Sahyak SalesCRM multi-tenant Software-as-a-Service (SaaS) web application accessible via mobile and desktop browsers. We are committed to protecting the privacy, security, and integrity of all personal, transactional, and customer data entrusted to our infrastructure.

To establish complete transparency, the following terms are defined:

• “Platform”: The Sahyak SalesCRM web application, API servers, background synchronization engines, and associated digital services.
• “User” or “Tenant”: The account holder, business owner, agency administrator, or designated sales representative who registers on the Platform to manage leads and communication workflows.
• “Leads” or “End-Customers”: Prospective clients, buyers, or individuals whose contact coordinates (names, phone numbers, deal notes) are uploaded, imported, or synchronized by Tenants into their isolated CRM workspace.
• “Data Controller vs. Data Processor”: Under applicable data protection frameworks, the Tenant acts as the Data Controller for all Lead records uploaded to their CRM workspace. Sahyak operates strictly as the Data Processor, handling Lead information solely pursuant to the Tenant’s direct instructions and software workflows.

We collect information strictly necessary to provide reliable CRM capabilities, billing verification, and anti-fraud platform security. The categories of collected data comprise:

Our WhatsApp Hub integrates multi-device WebSocket connectivity (via open-source Baileys socket libraries) to allow sales agents to send personalized templates, follow-up messages, and catalog brochures directly from their CRM dashboard.

Sahyak partners with globally recognized infrastructure providers to deliver maximum availability, security, and scalability. All sub-processors adhere to rigorous data privacy and encryption benchmarks:

Sahyak enforces defense-in-depth architectural safeguards to eliminate unauthorized data access or cross-tenant contamination:

• Strict Multi-Tenant Logical Separation: All database collections (Leads, Templates, Projects, Groups) enforce mandatory multi-tenant scoping via userId and companyIdcompound indexes. Tenant A cannot query, view, or modify Tenant B’s records under any circumstance.
• Cryptographic Bearer Authentication: Requests require digitally signed JSON Web Tokens (JWT) verified on every API invocation.
• HMAC SHA256 Gateway Verification: All payment callbacks and webhooks require raw-body HMAC SHA256 cryptographic verification against secret keys to prevent financial forgery.
• Time-based One-Time Passwords (2FA TOTP): Optional two-factor authentication provides hardware/authenticator app protection against unauthorized login attempts.

We retain CRM records only as long as an active subscription or legitimate business relationship exists. In the event of subscription expiration or non-renewal, our automated lifecycle engine executes the following protocol:

As a Sahyak tenant, you maintain full control over your business data:

• Data Portability & Export: You may export your entire customer lead database in structured Excel (.xlsx), CSV (.csv), or PDF formats at any time directly from the dashboard (subject to 90-day anti-churn tenure verification on annual plans).
• Right to Rectification: You can update personal profile information, regional currencies, phone codes, and custom CRM form schemas in real-time.
• Account Deletion: You may submit an explicit account erasure request by emailing support@sahyak.com. Upon verification, all active records will be permanently removed within 30 business days.

Sahyak does not utilize invasive third-party cross-site advertising cookies. We use essential local browser storage strictly for application operations:

• JWT Session Storage: Encrypted authentication tokens stored in browser localStorage to maintain authenticated sessions across page transitions.
• PWA Service Worker (/sw.js): Static asset caching to ensure rapid page load speeds on mobile networks and offline form resilience.

This Privacy Policy is framed in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (India), and general data protection principles governing enterprise SaaS platforms.

Any disputes arising under this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts in India.