Jump to a section
1. Who we are
Omm CRM is a multi-tenant SaaS customer relationship management platform operated by Omm Digital Solution Pvt. Ltd. ("Omm CRM", "we", "us", "our"). We are the entity responsible for the platform described at ommdigitalsolution.com and the CRM application at crm.ommdigitalsolution.com.
This policy applies to everyone who interacts with us: visitors to our marketing website, administrators who sign up a company account, team members invited into that account, and the leads, contacts and clients whose records are stored inside a customer's CRM workspace.
2. Our two roles — controller and processor
Because Omm CRM is business software, the same platform holds two very different kinds of personal data, and our obligations differ for each. Reading this section first will make the rest of the policy clearer.
Account data — we are the data fiduciary / controller
Data about our own customers: the admin who registers a company, the users invited to it, billing and subscription records, support tickets, and usage logs. We decide why and how this data is processed, and this policy governs it directly.
Workspace content — we are the data processor
The leads, contacts, clients, quotations, invoices, meetings, tasks and files that a customer uploads into their own workspace. The customer decides what to collect and why; we only process it on their documented instructions to run the service. If you are a lead or client of one of our customers, contact that business first — see Section 12.
Each company account is a separate tenant. Every record is scoped
to a company_id
and access is enforced on the server for every request, so one
customer's workspace data is never returned to another customer.
3. Data we collect
a. Account and identity data
- Full name, work email address, phone number, role and access permissions for every admin and user.
- A one-way cryptographic hash of your password. We never store, log or transmit your password in readable form and cannot recover it for you.
- One-time passcodes (OTPs) generated for email verification and password reset, which expire after a short validity window.
- Session metadata — last login timestamp, the IP address recorded against your active session, and refresh tokens used to keep you signed in.
b. Company and billing data
- Company name, business email, phone, website, registered address, GSTIN and company logo — used on your invoices, quotations and workspace branding.
- Bank account details you enter for display on your own outgoing invoices.
- Subscription records: the plan you chose, billing cycle, renewal dates, payment status, and the payment identifiers returned by our payment gateway.
- We do not collect or store your card number, CVV, UPI PIN or net-banking credentials. Payments are captured entirely on the payment gateway's own infrastructure.
c. Workspace content you enter
When you use the CRM you enter personal data about third parties — your leads and clients. This typically includes their name, company, email, phone number, address, deal value, pipeline stage, tags, notes, follow-up history, meeting logs, quotations, invoices, project tasks, comments and any files you attach. We hold this on your behalf; we do not mine it, sell it, or use it to build profiles or train models.
d. Technical and usage data
- IP address, browser type and version, device and operating system, referring page and timestamps.
- Application activity logs — which record was created, updated, assigned or deleted, by which user and when. These exist for audit and accountability inside your own workspace.
- Server and error logs used to diagnose faults and detect abuse.
e. Communications
If you email us, request a demo, or raise a support request, we keep that correspondence and any attachments so we can respond and maintain a record of the issue.
4. How we use data
- To provide the service — authenticate you, render your workspace, run pipelines, generate quotations and invoices, deliver notifications, and sync the integrations you have enabled.
- To bill you — create and reconcile subscriptions, apply the quota and seat limits of your plan, issue receipts, and handle renewals, pauses and cancellations.
- To secure the platform — detect suspicious logins, rate-limit abuse, investigate incidents and enforce our terms.
- To support you — respond to tickets and, where strictly necessary and with your knowledge, access your workspace to reproduce a reported fault.
- To improve the product — analyse aggregated, de-identified usage patterns to decide what to build and fix.
- To communicate — send service notices, security alerts, billing reminders and, where you have opted in, product announcements. Service and billing messages are transactional and cannot be unsubscribed from while your account is active.
- To meet legal obligations — retain tax and accounting records and respond to lawful requests.
We do not sell personal data, we do not rent contact lists, and we do not use your workspace content for advertising or to train machine-learning models.
5. Legal basis for processing
Where the DPDP Act, 2023 applies, we process personal data on the basis of your consent or for the "certain legitimate uses" permitted by the Act. Where the GDPR applies, we rely on:
- Performance of a contract — to deliver the subscription you signed up for.
- Legitimate interests — to secure the platform, prevent fraud, and improve the service, balanced against your rights.
- Legal obligation — tax, accounting and statutory retention.
- Consent — for optional marketing communications and non-essential cookies, withdrawable at any time.
7. Integrations you choose to enable
Some data reaches Omm CRM only because you connect an external service. These connections are optional, are turned on by an administrator, and can be disconnected at any time from your settings.
Meta / Facebook Lead Ads
If you connect a Facebook Page, we store the Page ID and a page access token so we can receive lead-form submissions. Incoming leads carry the name, email, phone and any custom form fields the person filled in on Facebook, mapped into your pipeline according to the field mappings you configure. Revoking the connection stops the sync; leads already imported remain in your workspace until you delete them.
Outbound email (SMTP)
You may supply your own SMTP credentials so that quotations, invoices and notifications are sent from your own domain. Those credentials are stored for your tenant and used solely to relay mail you trigger. Email sent this way travels through your chosen mail provider, under that provider's privacy terms.
Public API keys
API keys you generate allow external systems — a website form, a lead marketplace, an internal tool — to push records into your workspace. You are responsible for keeping those keys secret and for the lawfulness of the data pushed through them. Keys can be revoked instantly.
9. Sub-processors
We use a deliberately small set of third parties to operate the service:
| Provider | Purpose | Data involved |
|---|---|---|
| Razorpay | Subscription payments and billing webhooks | Name, email, phone, plan and payment identifiers. Card and bank credentials stay with Razorpay. |
| Meta Platforms | Facebook Lead Ads sync (only if you connect a Page) | Lead form fields submitted on Facebook |
| Email / SMTP provider | Transactional and workspace email delivery | Recipient address, subject, message body, attachments |
| Cloud hosting provider | Application servers, database and encrypted backup storage | All service data, at rest and in transit |
We review each sub-processor's security posture before onboarding and require contractual confidentiality and security commitments. We will update this list before adding a new sub-processor that handles personal data.
10. Retention, backups and deletion
- Active accounts — we keep your data for as long as your subscription is active, so the service works as expected.
- Records you delete — leads, clients, invoices and files deleted from the interface are removed from the live database immediately.
- Backups — the database is backed up automatically every night. Backups are retained on a rolling schedule, so a deleted record may persist in an encrypted backup for a short period before that backup is rotated out. Backups are restored only to recover from a failure, never to resurrect individually deleted records.
- Account closure — when a subscription ends, your workspace is retained for a grace period so you can reactivate or export. After that it is scheduled for permanent deletion.
- Statutory records — invoices, tax records and payment evidence are retained for the period Indian tax and company law requires, even after account closure.
- Logs — security and server logs are kept for a limited window for incident investigation, then discarded.
11. How we protect data
Encryption in transit
All traffic to the website, the application and the API is served over HTTPS/TLS.
Hashed credentials
Passwords are stored only as salted one-way hashes and are never recoverable in plain text.
Tenant isolation & RBAC
Every query is scoped to your company, and section-level read/write permissions are enforced server-side per user.
Session controls & audit trail
Sessions are token-based with expiry and IP tracking, and record changes are written to an activity log.
No system is perfectly secure. If a breach affects your personal data, we will notify the affected customers and the relevant authority without undue delay and within the timelines the law requires, describing what happened, what data was involved, and what we are doing about it.
12. Your rights
Subject to the law that applies to you, you may exercise the following rights:
- Access — obtain a summary of the personal data we hold about you and how it is processed.
- Correction — have inaccurate or incomplete data corrected or completed.
- Erasure — request deletion of data we no longer need for the purpose it was collected for, or for a legal obligation.
- Portability — receive your data in a structured, machine-readable format. Most workspace modules also offer a direct export.
- Withdraw consent — where processing rests on consent, withdraw it at any time. Withdrawal does not affect processing already carried out.
- Object or restrict — object to processing based on legitimate interests, or ask us to restrict it while a dispute is resolved.
- Nominate — under the DPDP Act, nominate another individual to exercise your rights in the event of death or incapacity.
- Complain — escalate to us first via Section 17, and thereafter to the Data Protection Board of India or your local supervisory authority.
If you are a lead or client of a business that uses Omm CRM: that business — not Omm CRM — decides what data about you is stored and why. Please direct your request to them. If you approach us directly, we will refer you to the relevant customer and assist them in responding, but we cannot alter or delete their workspace data on our own initiative.
To exercise a right, write to us at the address in Section 17. We will verify your identity before acting and respond within the timeframe the applicable law prescribes. There is no fee unless a request is manifestly unfounded or repetitive.
13. Your responsibilities as a customer
If you operate a workspace, you are the data fiduciary / controller for the records inside it. That means you are responsible for:
- Having a lawful basis — consent or otherwise — to collect and store data about your leads, contacts, clients and employees.
- Giving your own privacy notice to the individuals whose data you enter.
- Responding to their access, correction and deletion requests, using the tools the CRM provides.
- Configuring roles and permissions so your team sees only what it needs to.
- Keeping credentials, API keys and SMTP secrets confidential, and deactivating users who leave your organisation.
- Not uploading sensitive categories of data — health records, biometric identifiers, government ID numbers or payment card data — into free-text fields, notes or attachments. The platform is not designed to hold them.
14. International data transfers
Our servers and database backups are located in India. Some sub-processors — notably payment and email providers — may process limited data outside India. Where that happens we rely on appropriate safeguards, including contractual data protection terms, and we transfer only what the service needs. We do not transfer personal data to any territory restricted by the Central Government under the DPDP Act.
15. Children's data
Omm CRM is business software sold to organisations. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child's data has been entered into our systems, tell us and we will delete it promptly.
16. Changes to this policy
We may update this policy as the product, our vendors or the law change. The "Last updated" date at the top always reflects the current version. For material changes — a new category of data, a new purpose, or a new sub-processor handling personal data — we will notify account administrators by email or an in-app notice before the change takes effect. Continuing to use the service after that date means you accept the revised policy.
17. Contact and grievance redressal
For any question about this policy, to exercise a right, or to raise a complaint, reach us at:
Grievance Officer
grievance@ommdigitalsolution.com
Appointed under the DPDP Act, 2023 and the IT Rules.
Omm Digital Solution Pvt. Ltd.
Bhubaneswar, Odisha, India
crm.ommdigitalsolution.com
If you are not satisfied with our response, you may escalate to the Data Protection Board of India or, in the EEA/UK, to your local data protection supervisory authority.