Privacy Policy

01Who we are

TracelyCRM ("TracelyCRM", "we", "us") is a CRM service based in India. This policy covers the website at tracelycrm.com, the app at app.tracelycrm.com, our API and MCP connections, and our emails and support (together, the "Service").

We play two roles:

• For your account (you, your teammates, billing and website visitors), we decide how personal data is used. We are the controller (data fiduciary).
• For the leads and contacts in your workspace, our customer decides how their data is used, and we process it for them as a processor. If you are a lead with a question about your data, please contact the business that collected it as well; we will help them respond.

02What we collect

You give us

• Account details: name, email, phone number, company, country, timezone and password. Passwords are stored only as a one-way bcrypt hash.
• Workspace content: leads and their form answers, notes, tasks, pipeline stages, emails and replies, calendar events, templates, agent instructions and files you upload.
• Connected accounts: access tokens for Meta and other sources, and the SMTP/IMAP login for any mailbox you connect to send and receive email.
• Billing details: plan, invoices, billing name, address and GST number. Card and bank details are handled by our payment partner, not stored by us.
• Support: what you write to us and any details you share to get help.

Collected automatically

• Usage and device data: IP address, browser and device type, pages and features used, and timestamps, recorded in server logs to run, secure and debug the Service.
• Cookies: see section 8.

From third parties

• Lead sources you connect, such as Meta lead ads, Google, LinkedIn, website forms, portals, Zapier and webhooks, which send us the leads you collect.
• Ad platforms, such as campaign, ad set, ad and spend data used for campaign ROI.
• Publicly available sources used by Lead Finder (see section 7).

03How we use it

• To provide the Service: capture and route leads, send the emails and messages you ask us to, run your agents, show reports and keep your workspace in sync.
• To create and secure your account, prevent fraud and abuse, and enforce our Terms.
• To bill you and keep the records the law requires.
• To send you service emails, such as sign-in, security, billing and product changes that affect you. Marketing emails are optional and every one has an unsubscribe link.
• To answer support requests and to understand, fix and improve the Service using aggregated usage data.
• To comply with the law and respond to valid requests from authorities.

We rely on our contract with you, your consent where we ask for it (you can withdraw it at any time), our legitimate interest in running a secure and useful service, and our legal obligations. We do not use your workspace content for advertising, and we never sell personal data.

04AI processing

When you use Tracely AI, AI agents, AI drafts, lead scoring or Lead Finder, we send the parts of your workspace needed for that request (for example, a lead's details and email thread) to AI model providers through our AI gateway, OpenRouter. The response comes back to your workspace.

• We send only what the task needs, and only when an AI feature is used.
• We do not use your data to train AI models.
• Reps' AI requests can only reach the leads that rep is allowed to see.

05Meta & ad platforms

If you connect Meta, we receive leads from your lead ad forms and, if you turn on Meta signals, we send Meta a conversion event for the pipeline stages you choose (for example contacted, qualified or converted, with the deal value). Events are linked by Meta's lead ID. Email, phone, name, city and similar details are SHA-256 hashed on our server before they are sent, so Meta can match them without receiving them in readable form.

You can disconnect Meta or switch off signals in your workspace settings at any time. Meta's use of the data it receives is governed by Meta's Privacy Policy and your agreements with Meta.

06Who we share it with

We share personal data only with the service providers who help us run TracelyCRM, the services you connect, and when the law requires it. Our providers may use the data only to provide their service to us.

If TracelyCRM is involved in a merger, acquisition or sale of assets, personal data may move to the new owner under the same protections. We will tell you before that happens.

07Lead Finder & public data

Lead Finder helps our customers find businesses and business contacts using only information that is openly published, such as company websites, public business listings and public posts. It shows business details like names, job roles, company names and published business email addresses. We do not use private or leaked data.

If you think your details appear in Lead Finder and you want them removed, write to [email protected] with the details or address concerned. We will stop showing them in new results and tell you once it is done.

08Cookies

Website: tracelycrm.com sets no analytics, advertising or tracking cookies. Our fonts are loaded from Google Fonts, which receives your IP address to deliver them, under Google's Privacy Policy.

App: app.tracelycrm.com uses only essential cookies and browser storage to keep you signed in securely and remember settings such as your theme. They are needed for the app to work, so they cannot be switched off.

09Security

• Data is encrypted in transit with HTTPS.
• Tokens and passwords for connected accounts are encrypted with AES-256. Your own password is stored only as a bcrypt hash.
• Every workspace's data is kept separate, every action is permission-checked, and reps see only the leads assigned to them.
• Sign-in and sensitive endpoints are rate-limited, and our staff access production data only when needed to support you or secure the Service.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

10Retention & deletion

We keep your data for as long as your account is active. You can delete leads, connected accounts or your whole workspace at any time.

To delete your data: a workspace owner can delete a workspace in the app (Agency → workspace menu → Delete workspace). To delete your whole account, email [email protected] from your account's email address and we will do it within 7 days. To remove only the data received from Meta, disconnect Meta in your workspace settings and delete those leads; you can also remove TracelyCRM under Settings & privacy → Business integrations in Facebook.

When an account is closed, you can ask for an export for 30 days. After that, we delete the workspace data from our live systems, and it is removed from backups on their regular rotation. We keep invoices and payment records for as long as tax and accounting laws require, and limited security logs for a short period.

11Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and, for people in the EU and UK, the GDPR, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct or update it;
• delete it;
• withdraw consent you have given, without affecting what happened before;
• object to or restrict some processing, and receive your data in a portable format;
• nominate someone to exercise your rights if you die or become unable to (in India);
• complain to us, and then to the Data Protection Board of India or your local data protection authority.

Most account data can be viewed, changed, exported or deleted directly in the app. For anything else, write to us at the address below. We will reply within 30 days, and may need to confirm your identity first. If you are a lead in a customer's workspace, we will pass your request to that customer and help them answer it.

12International transfers

Some of our providers, including AI model providers, may process data outside India or outside your country. When that happens, we use providers that protect it to the standard this policy describes and, where required, standard contractual clauses or similar safeguards.

13Children

TracelyCRM is a business tool for people aged 18 and over. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.

14Changes to this policy

We will update this policy when our practices or the law change, and change the "last updated" date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.

15Contact & grievance officer

For privacy questions, requests or complaints, contact our Grievance Officer, as required by India's Information Technology Act, 2000 and its rules and by the DPDP Act, 2023:

Grievance Officer, TracelyCRM
[email protected]

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.