CRM Software of Winline Technologies Private Limited

• Provide and maintain the Service: user authentication, role-based access, multi-tenant data separation, invitation flows, token expiry, domain and SMTP configuration
• Security & integrity: detect/prevent fraud/abuse, maintain audit trails, investigate incidents
• Support & communications: respond to tickets, send service/transactional emails (e.g., invites, password resets), product updates
• Product improvement: diagnose issues, monitor performance, develop new features (aggregated/de-identified where possible)
• Compliance: meet legal, tax, accounting, and regulatory obligations

• Your organization (tenant): Admins may view/manage user activity, logs, and configurations within their tenant.
• Sub-processors/Service providers: hosting, email delivery, logging/monitoring, analytics (if enabled), backup and storage, customer support tools.
  Examples (subject to your actual setup): cloud infrastructure provider, email/SMS providers, error logging, backup service. We contractually require appropriate confidentiality and security measures. A current list of sub-processors is available on request.
• Legal & safety: to comply with law, enforce terms, or protect rights, property, or safety.
• Business transfers: in mergers, acquisitions, or asset sales, subject to this Policy.

If data is transferred outside your jurisdiction, we use appropriate safeguards (e.g., contractual clauses or comparable mechanisms) as required by applicable law. Details available upon request.

• Customer Data: retained for the subscription term. Upon tenant termination, we provide a [30–90] day window for export, then delete or irreversibly anonymize within [30] days unless law requires longer retention.
• Logs & security records: typically [90–180] days (shorter for high-volume logs).
• Backups: rolling backups are kept for [30] days and then aged out.

Your rights depend on your jurisdiction and role (end-user vs. tenant admin). We will honor requests in line with applicable law (e.g., India's DPDP Act, EU/EEA GDPR, UK GDPR, California CCPA/CPRA).

• Access/Portability: get a copy of your personal data.
• Correction: fix inaccurate or incomplete data.
• Deletion: request deletion (subject to our legal obligations and your organization's policies).
• Restriction/Objection: limit or object to certain processing.
• Consent withdrawal: where processing relies on consent.
• Grievance/Appeal: contact our grievance officer/DPO; you may also have the right to complain to a supervisory authority/Data Protection Board.

How to exercise:

• If your data is within Customer Data, contact your organization's admin.
• For Service Data or if you are unsure, email support@winlinetech.com.

• Required cookies: session, authentication, security (cannot function without these).
• Preferences: remember settings (e.g., language, UI options).
• Analytics (optional): usage metrics to improve reliability and performance (tenant-level toggle where applicable).

• TLS in transit; encryption at rest where supported by our infrastructure
• Least-privilege access, strong authentication, role-based permissions
• Audit logs for admin and critical actions
• Segregated multi-tenant architecture
• Regular backups and vulnerability/patch management
• Incident response procedures

If you enable integrations (e.g., email/SMS gateways, storage, calendars, reCAPTCHA on forms), those providers may process personal data under their own privacy terms. Your organization controls which integrations are enabled. Review third-party terms before use.

The Service is not directed to children under 18. We do not knowingly collect data from children. If you believe a child has provided personal data, you can delete it or contact us to delete it.

For customers requiring a DPA or region-specific terms (e.g., SCCs, India DPDP addendum), contact support@winlinetech.com. Signed DPAs become part of your subscription agreement.

We may update this Policy to reflect changes to the Service or the law. We'll post updates with a new "Last updated" date and, where required, notify admins by email or in-app message. Continued use after the effective date indicates acceptance.