Privacy Policy

1 Summary at a glance

• We do not sell your data, ever.
• We do not use third-party advertising trackers or share data with ad networks.
• Data we collect is used only for the CRM to function — leads, bookings, deliveries, service jobs, field tracking, and team management.
• Field staff (sales reps, technicians) share their location with their own manager during work hours. Location is never shared with anyone outside your dealership.
• You can request access, correction, or deletion of your data at any time — contact your Dealer Admin first, or email info@saskey.in if your Dealer Admin can't help.

2 Data we collect

Data we do NOT collect

• Browsing history outside the app.
• Contacts from your phone's address book.
• Photos from your library that you didn't explicitly attach to a record.
• Health, fitness, financial, or biometric data.
• Children's data — the app is not designed for users under 18.

3 How we use this data

Every piece of data we collect is used to make the CRM work for your business. Specifically:

• Contact info — to sign you in, identify which records belong to you, and let your manager assign work.
• Customer records — to populate the leads, customers, bookings, quotations, deliveries, and service-job sections of the app.
• Location — to power the Field Tracking module so your manager can see live positions and visit history during work hours. Location updates pause when the app is closed or you log out.
• User identifiers — to authenticate you and enforce role-based access (e.g. Sales Executive vs Dealer Admin) so people only see what they should.
• User content — to attach photos and signatures to specific records (job card, customer, delivery) for compliance and proof.
• Diagnostics — to fix bugs and improve app performance. Crash data does not contain customer information.

4 Who can see your data

Inside your dealership

• You — every record you created.
• Your manager and anyone above you in the reporting hierarchy — your leads, customer records, location, and job cards (within their assigned team scope).
• Dealer Admin / Branch Manager — all records in their dealership.

Outside your dealership

Nobody, except:

• Saskey Innovations support engineers — only when investigating a bug or support ticket you raised, and only the minimum data needed.
• Server-side infrastructure — Amazon Web Services (Mumbai, India region, used for hosting), Cloudflare (used for DNS + edge caching), Zoho Books (only for customers who have explicitly enabled Zoho item sync in Settings).
• Lawful requests — if compelled by a valid Indian court order.

We do not sell, rent, or share your data with advertisers, data brokers, or analytics platforms.

5 Permissions used by the mobile app

The iOS / Android app requests these permissions at runtime. You can revoke any of them in your phone's Settings; the app will continue to work but the corresponding feature will be disabled.

• Location (When in Use + Always) — used by Field Tracking. "Always" is needed only if you're a field-staff role whose manager actively monitors live positions; sales-only or admin users can grant "When in Use" only.
• Camera — used to capture vehicle photos, KYC documents, odometer readings, and proof-of-delivery photos for job cards.
• Photo Library (Read & Add) — to attach a previously-saved photo to a record, and to save captured photos so you have a local copy.
• Microphone & Speech Recognition — used only when you tap a mic button: for voice commands, for dictating notes, and to record short voice notes attached to leads and follow-ups. Voice commands and dictation are turned into text by your phone's built-in speech service (Google on Android, Apple on iOS); we store only the resulting text, not that audio. Voice notes you choose to record are uploaded to our servers, attached to the lead and visible to your dealership's managers.
• Push Notifications — to alert you when work is assigned, follow-ups are due, or stages forward to you.

6 Facebook, Instagram & WhatsApp data

A Dealer Admin can connect the dealership's own Facebook Page, linked Instagram Business account and WhatsApp Business number to SasFlow CRM (Social module). We only access accounts the dealership manages and has explicitly connected, and only for the purposes below.

• Lead Ad submissions — when someone submits the dealership's Facebook or Instagram Lead Ad form, we receive the submitted fields (such as name, phone number, email and the product they are interested in) and create a sales lead for that dealership only.
• Posts, comments & insights — we read the connected Page's and Instagram account's own posts, comments and performance figures (likes, comments, reach, views) to show them inside the CRM, let staff reply to comments, and let staff turn an interested commenter into a lead.
• Publishing — when staff click Publish, we post the text and image they composed to the connected Page / Instagram account.
• WhatsApp — we receive messages customers send to the dealership's WhatsApp Business number (including Click-to-WhatsApp ad enquiries) to create leads, and send approved template messages that staff choose to send.
• Access tokens — the tokens Meta issues for the connected accounts are stored on our secured servers, per dealership, and used only for that dealership's accounts.

We do not sell this data, use it for advertising, share it with other dealerships, or access Pages, profiles or accounts the dealership has not connected.

Data deletion instructions

To remove data received from Facebook, Instagram or WhatsApp:

1. Disconnect — a Dealer Admin opens Social → Social Leads in SasFlow CRM and clicks Disconnect on the account. We immediately stop receiving data and delete the stored access token.
2. Remove the app on Facebook — on Facebook go to Settings & privacy → Settings → Business integrations (or Apps and websites), select Saskey CRM and click Remove.
3. Delete stored records — email info@saskey.in with the subject "Meta data deletion" and the Page / Instagram / WhatsApp account name. We delete the stored comments, post data and lead-ad data received from Meta within 30 days and confirm by email. Leads your dealership has already worked on become part of its business records and are deleted by the Dealer Admin or on account closure.

7 How long we keep your data

• Active dealer accounts — for the life of your dealer's subscription, plus 90 days after expiry (to allow time for renewal or data export).
• Deactivated user accounts — data the user created stays with the dealer (it belongs to the business). The user's personal login credentials are removed within 30 days.
• Voice-note audio — deleted automatically 12 months after recording (the note's text is kept with the lead). A user can delete their own note within 24 hours; managers can delete any note.
• Crash diagnostics — 90 days.
• Field-tracking location pings — 90 days, then auto-purged.
• Customer / lead / booking records — for the life of the dealer's subscription, unless the Dealer Admin deletes them earlier.
• Backups — encrypted, retained 30 days.

8 Your rights

Under Indian data protection norms, you have the right to:

• Access — request a copy of the data we hold about you.
• Correct — fix anything inaccurate.
• Delete — request deletion of your data (subject to business records that your employer is required to retain).
• Object / restrict — to specific uses, e.g. opt out of location tracking when your role doesn't require it.
• Portability — get an export of your data in a structured format.
• Withdraw consent — for permissions like location and camera, at any time via your phone settings.

How to exercise these rights

To delete your SasFlow account and its data, see How to delete your account.

First, raise the request with your Dealer Admin — they can usually action it within the app. If they can't, email info@saskey.in with the subject line "Data request" and we'll respond within 30 days.

9 Security

• All traffic between the app and our servers uses HTTPS (TLS 1.2+).
• Passwords are bcrypt-hashed; we never see them in plaintext.
• Server infrastructure runs in a hardened Linux environment with database access locked to private network only.
• Multi-tenancy is enforced at the database layer with row-level security — each dealer's data is isolated.
• Daily encrypted backups, 30-day retention.
• Access to production data by Saskey staff is logged and limited to debugging needs.

No system is 100% secure. If you believe your account has been compromised, change your password immediately and email info@saskey.in.

10 Children

SasFlow CRM is a business tool intended for users 18 years and older. We do not knowingly collect data from anyone under 18. If you believe a child has provided data to us, email info@saskey.in and we will delete it.

11 Changes to this policy

If we change anything material — what we collect, how we use it, who we share it with — we'll post the updated policy at this URL and bump the "Last updated" date at the top. For significant changes we'll also push an in-app notice the next time you sign in.

12 Contact

Questions, requests, complaints — we want to hear them.

• Email: info@saskey.in
• Phone / WhatsApp: +91 84892 56789
• Postal address: Saskey Innovations, No 81/3/2, 2nd Floor, L.R. Tower, Above Anand Sweets, Opp Meenakshi Mall, Doddamma Layout, Hulimavu Village, Begur Hobli Bannerghatta Road, Bangalore 560076
• Business details: PAN AFCFS2312E · GSTIN 29AFCFS2312E1ZB