Privacy Policy
We care about your data, and we would rather be plain about it than hide behind twelve pages of legal language. This policy says what we collect, why we collect it, who else can see it, and how to make us delete it.
The short version.
We collect only what the CRM needs to work. We do not sell your data, we do not sell your customers' data, and we do not use it to advertise to anyone. There are no tracking or analytics scripts in the application. Your data is kept separate from every other company's. You can export it at any time, and you can ask us to delete it — see section 10.
1. Who we are
Growvanta CRM ("Growvanta", "we", "us") provides customer relationship management software for property sales, at growvantacrm.online.
You can reach us on +91 99109 74785 or at alert@growvantacrm.online. If you have a privacy question, that email address reaches a person, not a queue.
2. Two different kinds of data
This distinction matters, so it comes before everything else.
Your data
Information about you and your company as our customer — your name, your work email, your phone number, your company's details, and what you do inside the application. We decide how this is handled, so we are responsible for it.
Your customers' data
The leads you put into the CRM — the names, phone numbers and enquiries of people interested in your properties. This data is yours. You decide what to collect, who in your team sees it, how long to keep it and when to delete it. We only store and process it on your instructions, as the software you are using.
Practically, this means: if a buyer asks you to delete their details, you can do that yourself inside the CRM. If they contact us directly, we will point them to you, because it is not our data to remove on our own initiative.
3. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email, phone number, job role, company name | You, when we set up your account or when you add a colleague |
| Sign-in records | Time of sign-in, IP address, browser and device description | Recorded automatically each time someone signs in |
| Activity log | Who changed a lead's status, who reassigned it, who exported data, and when | Recorded automatically as you use the application |
| Lead data | Buyer name, phone, email, enquiry notes, project of interest, site visits, follow-ups | Your ad forms, your website forms, your imports, or typed in by your team |
| Integration credentials | Facebook page access tokens, your own email-sending credentials | You, when you connect an integration. Stored encrypted; never shown back to you in full |
| Support correspondence | Emails, calls and messages you send us | You |
We do not collect payment card details. We never ask for one to start a trial, and subscriptions are invoiced separately — no card number passes through this application at all.
4. Why we collect it
- To run the service — you cannot have a CRM without storing the leads in it.
- To keep your account secure — sign-in records let us and you spot access that should not have happened.
- To answer "who did that?" — the activity log exists because sales teams need to settle exactly this question.
- To send the emails you asked for — new-lead alerts, follow-up reminders and the daily summary go to your own staff.
- To support you — when you report a problem, we may need to look at the relevant records to find it.
- To meet legal obligations — invoicing and tax records, where the law requires them.
That is the complete list. We do not build advertising profiles, we do not enrich your data from outside sources, and we do not train anything on your leads.
5. Cookies
The application sets exactly two cookies, and both are necessary for it to work. There are no advertising cookies and no analytics cookies.
| Cookie | What it does | Life |
|---|---|---|
| gv_session | Keeps you signed in. It cannot be read by JavaScript, and it is only sent over HTTPS. | 12 hours, or 30 days if you chose "remember me" |
| gv_csrf | Stops another website from making requests to the CRM using your signed-in session. | Until you close the browser |
Because neither cookie tracks you, there is no consent banner to click through.
One thing worth naming: these public pages load fonts from Google Fonts, which means Google sees the IP address of anyone reading them. The application itself, once you sign in, loads nothing from Google.
6. Facebook and Instagram lead ads
If you choose to connect a Facebook page, you authorise Growvanta on your own Facebook account. We then receive:
- the list of pages you administer, so you can pick which ones to connect;
- an access token for the pages you picked;
- the lead forms on those pages, and the leads submitted through them.
We ask for nothing beyond that. We do not read your posts, your messages, your friends, your ad spend or your audiences. Page access tokens are encrypted before they are stored and are never displayed back to you.
You can disconnect a page from the Integrations screen at any time, or revoke Growvanta's access from Facebook directly under Settings & Privacy → Settings → Business Integrations. Disconnecting stops new leads arriving; leads already delivered stay in your CRM until you delete them.
7. Who else can see it
We do not sell your data to anyone, ever. It is shared only with:
| Who | Why | What they get |
|---|---|---|
| Hostinger (hosting provider) | The servers and database the application runs on | Everything, at rest, as any host necessarily does |
| Meta (Facebook / Instagram) | Only if you connect a page, to deliver your lead ads to you | Nothing from us. Data flows from them to you |
| Your own email provider | Only if you configure your own outgoing email for buyer messages | The messages you choose to send |
| Government or courts | Where we are legally compelled | Only what is specifically required |
Our own staff access your data only when you ask us to — a support request, or a fault we are fixing. Every such access is recorded.
8. How we protect it
- Encrypted in transit. The whole site is HTTPS. There is no unencrypted way in.
- Passwords are never stored. We store a bcrypt hash, which cannot be reversed into your password. If you lose it, we can reset it — we cannot tell you what it was.
- Integration secrets are encrypted at rest using AES-256-GCM, with a key held outside the database. A stolen database copy does not yield working Facebook tokens.
- Session tokens are stored hashed, for the same reason.
- Companies are separated at the query level. Every request is bound to one company; a lead belonging to another company is not merely hidden from the screen, it is not returned by the database at all.
- Inside your company, people see only their scope — their own leads, their team's, their region's, or everything, according to the role you give them.
- Everything significant is logged with the person and the time.
No system is beyond compromise, and we will not claim otherwise. If a breach ever affects your data, we will tell you what happened, what was affected and what we are doing — promptly, and without waiting for you to ask.
9. How long we keep it
- Lead data — for as long as your account is active. You control it; delete any of it whenever you like.
- Account details — for as long as your account is active, then up to 90 days, so an account closed by mistake can be restored.
- Sign-in and activity logs — up to 12 months.
- Invoices and tax records — as long as Indian tax law requires.
- Trial accounts that never became customers — deleted within 90 days of the trial ending.
10. Deleting your data
You can have your data deleted, and you do not have to give a reason.
Deleting part of it yourself
Any lead, contact or document can be deleted from inside the CRM by anyone with the right permission. That takes effect immediately.
Deleting all of it
Email alert@growvantacrm.online with the subject "Data deletion request" from the email address on your account, or call +91 99109 74785.
- We confirm within 2 working days that we have received it.
- We complete deletion within 30 days.
- We tell you when it is done.
- Backups are overwritten on their normal cycle, within 90 days.
- We keep only what law requires us to keep, such as invoices — nothing else.
Export before you delete. Deletion cannot be undone. You can export your leads to Excel at any time from inside the CRM, and we will help you do it if you ask.
If you connected Facebook
To remove the data associated with a Facebook connection, either disconnect the page from the Integrations screen, or remove Growvanta from Settings & Privacy → Settings → Business Integrations on Facebook. Both remove our access and our stored token for that page. To also delete the leads already delivered to your CRM, use the deletion request above.
11. Your rights
You may ask us at any time to:
- Show you what we hold about you.
- Correct anything that is wrong.
- Delete it, as described above.
- Export it in a format you can take elsewhere.
- Object to a particular use of it.
Write to alert@growvantacrm.online. We reply within 30 days, and we do not charge for any of this.
12. Children
Growvanta CRM is a business tool. It is not directed at anyone under 18, and we do not knowingly collect their information. If you believe a child's data has reached us, tell us and we will remove it.
13. Changes to this policy
If we change this policy we update the date at the top. For a change that materially affects you, we will email the account administrators at least 30 days before it takes effect, rather than quietly editing the page.
14. Contact us
Any question about your data, this policy, or something you are not comfortable with:
- Phone and WhatsApp: +91 99109 74785
- Email: alert@growvantacrm.online
A note on this document.
This policy describes honestly how the software actually behaves, and it is written to be read rather than to be impressive. It is not legal advice, and it has not been reviewed by a lawyer. Before relying on it commercially — particularly for customers outside India, or under the DPDP Act or GDPR — have a qualified advisor check it against your own circumstances.