Privacy Policy

What we collect

Account data: name, email, phone and role of people who use SunFlow CRM.

Customer data you store: details of your leads and customers (name, phone, address, electricity bill, site photos, documents). You are the data fiduciary for this data; we process it on your behalf.

Usage data: sign-in times, IP address and technical logs needed to run and secure the service.

Website enquiries: details you submit in our demo or contact forms.

How we use it

To provide and support the service, secure accounts, send service messages, bill subscriptions and improve the product.

We do not sell personal data and do not use your customers' data for our own marketing.

Sharing

With service providers we need to run the platform (hosting, WhatsApp Business API providers you connect, payment providers), under contracts that protect the data.

When required by law or to protect rights and safety.

SunFlow CRM Field (mobile app)

The Android/iOS field app is for employees of companies that use SunFlow CRM. They sign in with the account their company created; the app has no public sign-up.

Location: precise location is read only while the app is open, when the employee checks in at a customer site or takes a site photo. It is saved with that visit or photo so the company can verify the work. The app does not track location in the background.

Camera and photos: used only when the employee adds site, survey or installation photos.

Customer signature: captured on screen at project handover and stored with that project.

Device sign-in: a sign-in token is kept in the phone's secure storage (Android Keystore / iOS Keychain). The company owner can sign a device out at any time.

This data is sent over an encrypted connection (HTTPS) to the employer's SunFlow CRM workspace. The app shows no ads and does not share data with advertisers.

Security

Each company's data is isolated at the database level; integration keys are stored encrypted; access is logged.

Retention

We keep account data while your subscription is active and for a limited period afterwards for legal and billing needs, then delete or anonymise it.

Your rights

You may access, correct or delete your personal data, withdraw consent, and nominate a representative. See Data Protection (DPDP) and Grievance Redressal for how to contact us.