Effective Date: 1st September 2026 | Last Updated: 13th September 2026 | Version: 1.0
1. About AGM CRM
AGM CRM ("we", "us", or "our") is a cloud-based, multi-tenant Customer Relationship Management platform developed and operated by AGM Techno Solutions Pvt Ltd. We provide sales pipeline management, lead tracking, SLA monitoring, WhatsApp Business Messaging integration, and team productivity tools to businesses.
Our platform is available at https://agmcrm.com and via dedicated tenant subdomains (e.g., yourcompany.agmcrm.com).
2. Information We Collect
We collect the following categories of information:
- Account Information: Business name, email address, name, phone number, role, and password (stored securely using bcrypt hashing).
- Lead & CRM Data: Lead details, contact information, call notes, timelines, assigned staff, pipeline stage, and SLA timestamps entered by your team.
- WhatsApp Business Data: When you connect your WhatsApp Business Account (WABA) via Meta Embedded Signup, we store your WABA ID, Phone Number ID, verified business name, and encrypted access token. Incoming and outgoing WhatsApp messages are stored in your tenant's dedicated database.
- Usage Data: Log data, browser/device type, IP addresses, and pages visited — collected for security, performance monitoring, and debugging.
- Files & Attachments: Files uploaded to lead profiles or tasks (stored securely in AWS S3).
- Payment Information: Subscription and billing details. We do not store full card numbers.
3. Meta WhatsApp Business API Data
AGM CRM integrates with the Meta WhatsApp Business Cloud API (WhatsApp Business Platform). In connection with this integration:
- Businesses connect their own WhatsApp Business Accounts (WABA) using Meta's official Embedded Signup flow.
- AGM CRM acts as a Tech Provider. Each tenant's WhatsApp credentials are stored exclusively in that tenant's isolated database and are never shared with other tenants.
- Inbound WhatsApp messages from customers are received via Meta's Cloud API Webhook and stored in the respective tenant's database to display in the AGM CRM WhatsApp Inbox.
- Outbound messages are sent only when initiated by authorized CRM staff on behalf of the business.
- Meta Platform Data Usage: We use WhatsApp Business API data solely to enable CRM messaging features. We do not use Meta Platform Data to advertise, train AI/ML models, or sell to third parties.
- WhatsApp message content is not processed, analyzed, or accessed by AGM Techno Solutions staff except for technical support purposes with your explicit consent.
4. How We Use Your Information
- Provide, operate, and improve the AGM CRM platform and its features.
- Authenticate users and enforce role-based access control (RBAC).
- Power the WhatsApp Inbox — routing inbound customer messages to the correct tenant and enabling outbound replies.
- Send SLA alerts, push notifications, and email notifications to authorized staff.
- Process billing, subscriptions, and invoicing.
- Ensure platform security, fraud prevention, and abuse detection.
- Comply with applicable laws, regulations, and Meta Platform Policies.
We do not sell your personal data to third parties.
5. Multi-Tenant Data Isolation
AGM CRM is built on a strict multi-tenant architecture. Each business (tenant) operates in a completely isolated database. Your CRM data, leads, staff records, and WhatsApp messages are never accessible to other tenants. Tenant subdomains (e.g., yourcompany.agmcrm.com) are isolated at the application and database level.
6. Third-Party Services & Data Sharing
We share limited data with the following trusted third-party services to operate AGM CRM:
- Meta (Facebook): For WhatsApp Business Cloud API integration, webhook delivery, and Embedded Signup OAuth.
- Amazon Web Services (AWS): For secure file storage (S3) and cloud hosting infrastructure.
- Payment Processors: For subscription billing (e.g., Razorpay or Stripe).
- Email Service Providers: For transactional email delivery.
We do not sell, trade, or rent user data to any third party for marketing purposes.
7. Data Retention
- CRM data is retained for the duration of your active subscription and for up to 90 days after account termination.
- WhatsApp OAuth state tokens are automatically deleted within 15 minutes of creation.
- System logs are retained for up to 30 days for security and debugging purposes.
- You may request early deletion of your account and data by contacting us.
8. Security
- HTTPS/TLS encryption for all data in transit.
- Encryption at rest for sensitive credentials such as WhatsApp access tokens.
- Role-Based Access Control (RBAC) limiting staff to only the data their role permits.
- bcrypt hashing for all user passwords — never stored in plain text.
- Webhook signature verification using Meta's HMAC-SHA256 app secret for all incoming WhatsApp events.
- One-time-use cryptographic state tokens with 15-minute TTL for OAuth flows.
In the event of a data breach affecting your information, we will notify affected users in accordance with applicable laws.
9. Your Rights
You may have the following rights with respect to your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data (subject to legal obligations).
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing of your personal data in certain circumstances.
- WhatsApp Disconnect: You can disconnect your WhatsApp Business Account from AGM CRM at any time from Settings → Integrations. This immediately revokes stored credentials.
To exercise any of these rights, contact us at agmtechnosolutions9@gmail.com.
10. Cookies & Tracking
AGM CRM uses session cookies to maintain authenticated sessions and remember user preferences. We do not use advertising or cross-site tracking cookies. The Meta JavaScript SDK (used for WhatsApp Embedded Signup) may set cookies as part of Meta's own authentication process — please refer to Meta's Privacy Policy for details.
11. Children's Privacy
AGM CRM is a B2B SaaS product intended for use by businesses and their adult employees. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will promptly delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the "Last Updated" date at the top of this page. For material changes, we will notify tenant administrators via email or an in-app notification. Continued use of AGM CRM after changes are posted constitutes acceptance of the updated policy.
13. Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us: