Privacy Policy
This policy explains what OSSCRM does with personal data, in the terms India's Digital Personal Data Protection Act, 2023 uses. Where you use OSSCRM to process your own customers' data, you are the Data Fiduciary and OSSCRM is a Data Processor acting on your instructions.
Last updated: 2026-08-28
The two roles, kept apart
For your own account — your name, work email, billing details — OSSCRM is the Data Fiduciary. For the leads and contacts you load or generate inside your workspace, you are the Data Fiduciary and we process that data only to run the features you use.
What we collect
Account: name, work email, organisation, and billing records. Usage: which features you use, campaign runs, and clicks on your tracked links, which is what your invoice is based on. Technical: IP address and browser, for security and abuse prevention.
Approximate location
We never ask your browser for your location — there is no permission prompt anywhere on this site. Like most websites we can see roughly where a visit came from, at city level, from the network address, and the map on our contact page draws those as anonymous dots. What is kept for that map is rounded to about 11 kilometres — enough to place a dot on a world map and not enough to place you — carries no IP address and no identifier, and the database deletes it 30 days later on its own.
Your workspace data
Leads, contacts, email content and campaign results belong to you. We do not sell it, we do not use it to train models, and we do not share it with other customers. Email provider credentials are encrypted with AES-256 and are never returned to a browser.
Your rights as a Data Principal
You may ask for access to your personal data, correction of it, erasure, and the identity of anyone it has been shared with. You may withdraw consent as easily as it was given. Write to the address below and we will respond within the period the DPDP Act allows.
Retention and erasure
Workspace data is kept while your account is active. On closure it is deleted within 90 days, except records we are legally required to keep — invoices and tax records among them. Suppression entries are the deliberate exception: an address that asked never to be contacted is kept precisely so that it is never contacted again.
Breach notification
A personal data breach is reported to the Data Protection Board and to affected Data Principals within 72 hours of becoming aware of it.
Sub-processors
Hosting and database infrastructure, and payment processing. Your email provider is not a sub-processor of ours — that account is yours, contracted directly with them.
Contact
Questions, or a request about your personal data: [email protected]. We answer within the period the DPDP Act allows.