Be12 CRM Privacy Policy

01Who we are

Be12 CRM is a customer relationship management application operated by Be12 Media (“Be12 Media”, “we”, “us” or “our”), a digital marketing and software company based in Chennai, Tamil Nadu, India. Be12 CRM is available at crm.be12media.com.

Contact us about anything in this policy at mk@be12media.com.

02Our role and yours

Businesses create a workspace in Be12 CRM to manage their own leads and customers. For the personal data of those leads and customers, the business is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023, and Be12 Media processes that data on the business’s behalf and only on its instructions.

For the account details of the people who sign up and use Be12 CRM (name, email, phone and login activity), Be12 Media is the Data Fiduciary.

03Data we collect

Account data

Name, email address, phone number, workspace name and business details, and a one-way hash of your password. We also record logins and an audit log of changes made in each workspace.

Data your business adds or connects

Leads and customers (name, phone, email, company, notes and custom fields), tasks, calls, invoices, quotations and payment records, entered by your team, imported from a file or received from a channel you connect.

Data received from Meta

When a business connects its Facebook or WhatsApp accounts using Facebook Login for Business or Embedded Signup, we receive only what that business approves:

• Facebook Pages and Lead Ads: the list of Pages the person manages and their names and IDs, Page access tokens, and the submissions to the business’s lead ad forms (the fields the form asks for, such as name, phone and email, plus the form, ad and campaign names). We use these to subscribe the Page to new lead notifications and to create each lead in the business’s workspace within seconds.
• Ad accounts: read-only campaign spend, impressions and clicks, so the business can see the cost per lead and return on ad spend in its reports. We do not create, edit or pause ads.
• Business portfolio: the business portfolio and the assets inside it that the person chooses to share, so the right Pages, ad accounts and WhatsApp accounts can be connected.
• WhatsApp Business Platform: the WhatsApp Business Account and phone number details, display name, quality rating and messaging limit, message templates and their review status, and the messages the business sends and receives with its customers, including delivery and read statuses. If the business connects the WhatsApp Business app (coexistence), we also receive its contacts and recent chat history when the business chooses to import them.
• Basic profile: the name and Meta ID of the person who connects the account.

04How we use data

• To provide Be12 CRM to the business that owns the workspace: show leads, assign them to team members, send and receive WhatsApp messages, send approved template messages to customers who opted in, track replies and payments, and produce reports.
• To keep the service secure, prevent misuse and fix problems.
• To contact account holders about their account, billing and important changes.

We do not sell or rent data, use data received from Meta for advertising or for any purpose other than providing the features the business asked for, combine one business’s data with another’s, or use it to train artificial intelligence models.

05Who we share data with

Each business’s data is visible only to the members of its own workspace. We share data only with the providers that help us run the service, under confidentiality obligations:

• Hosting: Hostinger, in its Asia (India) data centre, where the application and database run.
• Meta: messages a business sends through the WhatsApp Business Platform are delivered by Meta.
• Services a business chooses to connect, such as a payment gateway or a calling provider, receive only what is needed for that feature.

We may disclose data if Indian law requires it.

06How we protect data

• Every record carries its workspace ID and every read and write is filtered by it, so one business cannot see another’s data.
• Access tokens and API keys for Meta, WhatsApp and other connected services are encrypted at rest with AES-256-GCM.
• Passwords are stored only as one-way hashes. Connections use HTTPS.
• Webhooks from Meta are verified with their signature before they are processed.
• Only Be12 Media platform administrators can access a workspace for support, and changes are recorded in the workspace audit log.

07How long we keep data

• Workspace data is kept while the workspace is active, so the business can keep its records.
• When a business disconnects a Facebook Page, ad account or WhatsApp number in Be12 CRM, the access token for that connection is deleted immediately. Leads and messages already received stay in the workspace as the business’s records until the business deletes them.
• When a business closes its account, we delete its workspace data within 30 days, except invoices and payment records that Indian tax law requires us to keep.

08Deleting your data

Businesses can delete individual leads, erase a lead’s personal data, disconnect channels, or ask us to delete the whole workspace. Full step-by-step instructions are on our data deletion page.

If you are a customer of a business that uses Be12 CRM and want your data deleted, please contact that business first, as it controls your data. You can also write to mk@be12media.com and we will pass on and help with your request.

09Your rights

Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent and nominate another person to exercise your rights. Write to mk@be12media.com. We reply within 7 days and complete requests within 30 days.

Be12 CRM is meant for businesses and is not directed at children under 18.

10Changes to this policy

We will post any change on this page with a new “last updated” date, and tell account holders by email about important changes.