Privacy Policy

Salzee is a customer relationship management (CRM) service operated by Tectot (“Salzee”, “we”, “us”). It helps small and mid-sized businesses in India capture enquiries, follow up over WhatsApp and calls, send quotations and collect payments.

This policy covers three groups of people:

• Customers — the businesses that sign up for a Salzee workspace, and the owners and admins who manage it.
• Users — the telecallers, field staff, managers and service teams a customer invites into its workspace.
• Leads and contacts — the people a customer records in Salzee: enquirers, buyers, suppliers and their staff.

For leads and contacts, the customer who entered the data is the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and we process it on their instructions. For customers and users, we are the data fiduciary for the account data described below.

Account and workspace data. Your name, mobile number, email, designation, role, company name, GSTIN, address, logo and the workspace settings you choose. Sign-in uses a one-time code sent to your mobile number; we do not store passwords.

Lead and customer records. Names, phone numbers, email addresses, business names, addresses, GSTINs, requirements, stage history, notes, tags, custom fields, and the source an enquiry came from (for example a web form, a Meta lead ad, IndiaMART or Justdial).

Conversations. WhatsApp, SMS and email messages sent and received through the shared inbox, message templates, and broadcast history.

Calls. Call outcomes, duration, notes and, where a customer turns recording on and the law allows it, call recordings. Recording is off by default and it is the customer’s responsibility to inform and obtain consent from the people they call.

Field and attendance data. For staff a customer marks as field users: check-in and check-out times, leave requests, and site-visit locations captured only during configured working hours. Location tracking can be switched off per workspace and per user.

Documents and payments. Quotations, invoices, line items, GST break-ups, payment links and payment status. Card, UPI and bank details are handled by our payment provider (Razorpay) and never stored by Salzee.

Data from Meta (Facebook, Instagram, WhatsApp). When a customer connects Meta: the name and app-scoped id of the Facebook account that connected; the Pages, Instagram professional accounts and WhatsApp Business accounts and numbers they chose (ids, names, usernames, profile pictures); access tokens, stored encrypted; lead-form submissions from their Lead Ads; and Instagram direct messages and WhatsApp messages to and from their customers. We use this only to deliver those features inside that customer’s own Salzee company. We never sell it, share it with other customers, or use it for advertising.

AI usage. Questions asked to the Dora assistant, the summaries and suggestions it produces, and lead scores. Prompts may include lead names and notes so the answer is useful.

Technical data. Session tokens, device and browser type, IP address, activity and audit logs, and error reports.

• To run the service: sign you in, show your leads, send the messages you compose, schedule follow-ups, issue documents and collect payments.
• To automate the work you configure: assignment rules, sequences, SLA timers, reminders and escalations run on the data in your workspace.
• To provide AI assistance: lead scoring, reply drafts, summaries and the Dora briefing. AI features can be disabled in Settings › WhatsApp AI & replies.
• To keep the service safe: fraud checks, rate limits, audit logs and row-level security that keeps each workspace’s data separate from every other.
• To support and bill you: usage counts, AI credits, invoices and support tickets.
• To improve Salzee, using aggregated and de-identified statistics only.

We do not sell personal data. We share it only with providers that are needed to deliver the service, under contracts that limit what they may do with it:

• Neon (PostgreSQL hosting, AWS ap-southeast-1, Singapore) — stores your workspace data, encrypted at rest and in transit.
• Meta Platforms — WhatsApp Business API messaging, Instagram and lead ads, when you connect them — governed by Meta’s Platform Terms.
• MSG91 — SMS delivery, including sign-in codes.
• Razorpay — payment links and settlements.
• Anthropic — the AI model behind Dora. Prompts are not used to train their models.
• IndiaMART, Justdial, TradeIndia, Google Sheets — only when you connect them as lead sources.

We also disclose data when the law requires it, to enforce our terms, or in a merger or acquisition, with notice to you.

• Workspace data is kept for as long as the workspace is active.
• Deleted leads, contacts and documents sit in a 30-day recycle bin where an admin can restore them, then are permanently removed.
• A deleted workspace can be recovered for 30 days, after which its data is erased from live systems and from backups within a further 30 days.
• Sign-in codes expire in minutes; sessions expire after 30 days of inactivity.
• Audit logs are kept for 12 months. Invoices and payment records are kept for the period Indian tax law requires.
• Meta access tokens are deleted and the connected Pages, Instagram accounts and WhatsApp numbers are disabled when the customer disconnects or removes Salzee from their Facebook settings; the connected account details themselves are erased when Meta sends us a data-deletion request (status at salzee.in/data-deletion). Leads and messages already filed remain the customer’s records under the rules above.

Under the DPDP Act you can ask us to access, correct, update or erase your personal data, to withdraw consent, and to nominate someone to exercise these rights for you.

• Customers can export every lead, note, document and recording from Settings › Import & exports at any time. There is no lock-in.
• Users can update their own profile from the account menu and ask their workspace admin to remove them.
• Leads and contacts should first contact the business that holds their record. If that business uses Salzee, we will help it respond within the time the law allows.

To exercise a right, write to [email protected]. We respond within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.

• Every workspace is isolated by database row-level security. The application connects with a role that cannot read outside the current tenant, even if application code has a bug.
• All traffic uses TLS. Data is encrypted at rest by our hosting provider.
• Sign-in is by one-time code to the registered mobile number; platform administrators must use two-factor authentication.
• Every change to settings, roles, plans and records is written to an audit log with who did it and when.
• API keys and webhooks are per workspace, can be rotated, and are revoked the moment a user is disabled.
• If we discover a breach affecting your data we will notify you and the Data Protection Board without undue delay.

The app keeps your session token, selected workspace, theme and menu preferences in your browser’s local storage so you stay signed in and the interface remembers your choices. The marketing site uses no advertising cookies. You can clear this data at any time from your browser; you will simply be signed out.

• You must be authorised to act for the business you sign up, and you are responsible for the people you invite and the data you enter.
• You must have a lawful basis to contact the leads you import and to record calls. Do not use Salzee to send unsolicited bulk messages; WhatsApp and TRAI rules apply.
• Plans are billed monthly or yearly in INR with GST. Free plans are limited to three users. AI credits are consumed per assistant call and can be topped up from the wallet.
• We may suspend a workspace for non-payment, abuse or legal reasons, with notice where possible. You can leave at any time and take your data with you.
• Salzee is provided as-is; our liability is limited to the fees you paid in the previous three months. These terms are governed by the laws of India, courts at Salem, Tamil Nadu.

We will post any material change here and notify workspace owners by email or in-app notice at least 15 days before it takes effect. Questions go to [email protected].