Privacy Policy

1. Who this policy covers

Vyavastha is used by organizations. An organization's administrators decide who joins their workspace and what business data they store in it. For that business data the organization is the owner and we process it on the organization's behalf to provide the service. For account, billing and security information about people who use the service, Nugro Tech is responsible for how it is handled.

2. Information we collect

Account and organization information

• Name, work email address, phone number, role, timezone and password (stored only as a salted hash — we cannot read it).
• When a company registers: organization name, company size, industry and country, and the plan selected.
• Which organization you belong to, the products and roles you were given, and when you last signed in.

Business data you or your team enter

• Leads, contacts, companies, notes, follow-ups, meetings and email activity in Sales & BDE.
• Projects, tasks, milestones, timesheets and documents in Project Management.
• Clients, estimates, invoices, payments and expenses in Finance & Invoicing.
• Employee records, attendance, leave, payroll and employee documents in HR & Payroll.
• Files you upload, which are stored in our cloud file storage.

Google user data (only if you connect Google)

See section 4 — this is described separately because Google requires it.

Billing information

Subscription payments are processed by Razorpay. We do not receive or store your card number, UPI PIN or bank credentials. We store the identifiers Razorpay returns (customer and subscription IDs), your plan, the amount, the status of each payment and the next billing date.

Technical information

• IP address, browser and device type, and security and audit logs (for example sign-ins, role changes and settings changes).
• Cookies needed to keep you signed in (see section 9).

3. How we use information

• To provide, operate and secure Vyavastha: authenticate you, apply your organization's roles and permissions, and show you the data you are allowed to see.
• To send service emails such as invitations, password resets, security notices, billing notices and the notifications you have enabled.
• To process subscription payments and manage your plan.
• To detect abuse, investigate problems and keep the service reliable.
• To meet legal obligations, such as tax and accounting records.

We do not sell personal information, and we do not use it for advertising.

4. Google user data and Limited Use

Vyavastha lets each person, if they choose, connect their own Google account to use Gmail and Google Calendar inside the CRM. Connecting is optional, is done by you on Google's consent screen, and can be removed at any time. We request only the access below.

How Google data is handled

• Your mailbox stays in Gmail. We read your messages live from Google when you open them. We store a copy inside Vyavastha only for messages that match a lead or contact in your CRM, and for messages you send from the CRM, so the conversation appears on that record. We do not copy your whole mailbox.
• Attachments and images are fetched on demand and held only briefly in temporary memory (minutes); files you choose to save to a lead are stored as CRM files.
• Drafts you write in the CRM composer are kept so you don't lose them, and unfinished drafts expire automatically.
• Calendar events that you create from the CRM are written to your calendar. Events created outside the CRM that involve you are shown only to you — they are never shared with other members of your organization.
• Each connection belongs to one person. Your Google account is linked to your user, not to the organization. Organization administrators can see only whether you are connected — never your tokens, your private mailbox or your private calendar. A colleague sees an email in Vyavastha only when it has been linked to a CRM record they are permitted to view.
• Tokens are protected. Google access and refresh tokens are encrypted at rest (AES-256-GCM), are kept only on our servers, and are never sent to your browser.

Limited Use disclosure

Vyavastha's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above that you asked for.
• We do not sell Google user data and do not transfer it to third parties, except as necessary to provide those features, to comply with law, for security or abuse prevention, or as part of a merger or sale with notice to you.
• We do not use Google user data for advertising, including retargeting or interest-based advertising.
• We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models, and we do not send it to AI providers.
• Our staff do not read your Google data unless you ask us to for support and consent, it is necessary to investigate abuse or a security issue, or the law requires it.

Disconnecting and deleting Google data

• You can disconnect at any time in Settings → Integrations → Google. Disconnecting revokes our access at Google, erases your stored tokens and stops all syncing.
• You can also remove Vyavastha at myaccount.google.com/permissions.
• If an administrator removes you from an organization, your Google connection to that organization is disconnected automatically.
• To have the CRM copies of linked email removed as well, contact us at info@nugrotech.com (or ask your organization administrator, since those copies are part of your organization's CRM records).

5. Who we share information with

• People in your organization, according to the roles and permissions your administrators set. A member sees only what their role allows; organization administrators cannot read another member's personal Gmail or Google Calendar.
• Service providers that help us run Vyavastha, under confidentiality and security obligations: cloud hosting and database services, file storage (Amazon Web Services), payment processing (Razorpay) and email delivery. They receive only what they need to perform their service.
• Authorities or other parties where required by law, to protect rights and safety, or in a merger, acquisition or sale of assets (we will notify you and this policy will continue to apply).

We do not sell your information.

6. Storage, retention and deletion

• We keep account and business data while your organization has an account, so that you can keep using the service.
• Records we must retain for legal, tax or accounting reasons (for example invoices and payment records) are kept for the period the law requires.
• Temporary data has short lifetimes — for example password-reset links, login codes and unfinished email drafts expire automatically.
• When a member is removed, they lose access and their historical work stays in the organization's records (for example "created by") so that history remains accurate.
• You can ask us to delete your personal information, or an organization administrator can ask us to delete the organization's workspace, by contacting info@nugrotech.com. We will delete or anonymise it, normally within 30 days of a verified request, except where the law requires us to keep it. Backups are overwritten on their normal cycle.

7. Security

• All traffic to Vyavastha uses HTTPS.
• Passwords are stored as salted hashes; Google tokens are encrypted; session cookies are HttpOnly and Secure.
• Every request is checked for authentication, organization, subscription, product access and role permission on our servers, and each organization's data is isolated from others.
• Sensitive administrative actions are recorded in an audit log.

No system is perfectly secure. If we become aware of a breach affecting your information we will notify you as required by law.

8. Your choices and rights

Depending on where you live you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can update your profile in Settings → My profile, control notification emails in your settings, and disconnect Google at any time. To exercise any right, contact info@nugrotech.com. If the information is business data held by your organization, we may direct your request to your organization's administrator.

9. Cookies

Vyavastha uses only the cookies it needs to work: a secure, HttpOnly cookie that keeps you signed in, a small non-sensitive cookie that tells the app whether a session exists, and short-lived cookies used during sign-in with Google and during company registration. We do not use advertising or cross-site tracking cookies.

10. Children

Vyavastha is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 18.

11. International processing

Our service providers may process information in countries other than your own. Where we do so, we take steps to protect it in line with this policy and applicable law.

12. Changes to this policy

We may update this policy as Vyavastha changes. We will post the new version here with a new "last updated" date, and notify account owners of material changes by email or in the app.

13. Contact us

Questions or requests about this policy or your data: info@nugrotech.com.
Nugro Tech · Vyavastha · https://crm.nugrotech.com