Privacy Policy

Last Updated: May 27, 2026

1. Introduction and Scope

Welcome to Bifur CRM ("we," "us," or "our"). We are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our Customer Relationship Management (CRM) platform, website, and associated applications (collectively, the "Service").

Because our Service is a B2B multi-tenant SaaS platform, we generally act as a Data Processor (or Data Processor / Intermediary) regarding the customer data, contacts, and messaging content you process through our platform. You, the Client, act as the Data Controller (or Data Fiduciary). However, we act as a Data Controller regarding the account, billing, and organizational information you provide directly to us to create and manage your Workspace.

2. Information We Collect

We collect information through three primary channels:

A. Information You Provide to Us directly:

Account Registration: Workspace name, administrator names, professional email addresses, and passwords.
Billing Information: Payment details, billing addresses, and documentation required for international transactions and regulatory compliance (e.g., FIRA documentation).
Support Communications: Records of your requests for technical support or customer service.

B. Information Collected via Third-Party Integrations:

Messaging Providers (Meta/WhatsApp): When you utilize the Embedded Signup flow to link your communications, we securely process and store your Meta Graph API access tokens, WhatsApp Business Account (WABA) IDs, Phone Number IDs, and approved message templates.
Enterprise Identity Providers (SSO/SAML): If your organization uses our Enterprise Single Sign-On integration, we receive authentication payloads (such as user ID, name, email, and corporate profile assertions) from your Identity Provider (e.g., Okta, Azure AD) via our SAML bridge architecture.
Standard OAuth Providers: Basic profile information (name, email, avatar) when users authenticate via Google or Microsoft OAuth flows.

C. Information Collected Automatically:

Device and Network Data: IP addresses, browser types, operating systems, and device identifiers.
Log and Usage Data: Telemetry data on how you interact with the CRM, features accessed, API request volumes, and edge network routing logs.

3. How We Use Your Information

We process your data strictly to deliver a premium, secure enterprise service. Specifically, we use your information to:

Provision, isolate, and maintain your multi-tenant Workspace environment.
Route and synchronize automated broadcasts and service conversations via the Meta Graph API.
Authenticate your users statelessly at the Edge and enforce Role-Based Access Control (RBAC).
Process international subscription payments and manage financial compliance.
Detect and prevent security incidents, domain hijacking attempts, or unauthorized network access.
Analyze platform performance to optimize our database querying and user interface responsiveness.

4. Cookies and Tracking Technologies

We utilize cookies and similar cryptographic tracking technologies essential for the operation of the Service. This includes secure, HttpOnly session cookies (e.g., w_crm_session) used for stateless authentication and maintaining user sessions across your Workspace. We do not use third-party advertising trackers inside the CRM dashboard.

5. Third-Party Services and Sub-Processors

To provide the Service, we securely share necessary data with trusted third-party sub-processors:

Meta Platforms, Inc.: For executing WhatsApp Business messaging, webhook subscriptions, and template synchronization.
Payment Gateways: For processing global B2B subscription billing safely and compliantly.
Cloud Infrastructure Providers: For hosting our serverless edge functions, isolated PostgreSQL database environments, and Enterprise SAML SSO containers.

All sub-processors are bound by strict Data Processing Agreements (DPAs) and confidentiality obligations.

6. Data Storage and Retention

Your data is stored with logical isolation enforced by Row-Level Security (RLS) to ensure absolute separation between tenant Workspaces.

Account Data: Retained for the lifespan of your active subscription.
User Content (Messages/Contacts): Retained according to your Workspace configurations. Upon termination of your account, we will delete or anonymize your data within a standard operational timeframe, wiping connected OAuth links, SAML configurations, and WABA credentials via automated cascading database deletions.

7. Security Practices and Safeguards

We implement enterprise-grade security protocols designed to protect your data from unauthorized access, alteration, or destruction. Our safeguards include:

In-transit and at-rest encryption for all database environments.
Cryptographic Edge safety mechanisms (e.g., Web Crypto AES-GCM) to prevent runtime session hijacking.
DNS TXT record verification challenges to prevent corporate domain spoofing during SSO configuration.
Automated token self-healing lifecycles to maintain secure connections to external APIs.

Note: While we maintain robust infrastructure, no electronic transmission over the internet is completely secure. You are responsible for maintaining the confidentiality of your credentials and your internal Identity Provider (IdP) configurations.

8. User Rights and Data Access

Depending on your global jurisdiction (including the GDPR, CCPA, and India's Digital Personal Data Protection Act), you and your authorized users may possess the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Request corrections to inaccurate or incomplete data.
Erasure (Right to be Forgotten): Request the deletion of your personal data.
Restriction/Objection: Limit or object to how we process your data.
Data Portability: Receive your data in a structured, commonly used, machine-readable format.
Withdraw Consent: Withdraw consent previously granted for specific data processing activities.

To exercise these rights, please contact our Data Protection Officer using the information provided in Section 15.

9. International Data Transfers

Our core engineering operations are based in India, but our infrastructure and clients span the globe. Your personal data may be transferred to, processed, and stored in regions outside of your home jurisdiction. We rely on legally recognized transfer mechanisms, such as Standard Contractual Clauses (SCCs) and adherence to prevailing international data frameworks, to ensure your data receives adequate protection globally.

10. Children’s Privacy

Our Service is intended strictly for professional B2B use. We do not knowingly collect, solicit, or process personal data from individuals under the age of 18. If we learn that we have collected personal data from a minor, we will delete that information immediately.

We will never sell your personal data. We may disclose your information outside of our sub-processors only in the following circumstances:

Legal Compliance: To comply with a valid subpoena, court order, or lawful request by public authorities, including national security or law enforcement agencies.
Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
Protection of Rights: To enforce our Terms of Service, defend against legal claims, or protect the rights, property, and safety of [Company Name], our users, or the public.

12. Changes to the Policy

We may update this Privacy Policy periodically to reflect changes in our technology, legal obligations, or business operations. If we make material changes, we will notify Workspace administrators prior to the changes taking effect via email or a prominent notification within the CRM dashboard. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

13. Contact Information & Grievance Officer

If you have any questions, concerns, or requests regarding this Privacy Policy, or if you need to escalate a privacy grievance, please contact us at:

Bifur CRM Attention: Data Protection / Grievance Officer Email: [EMAIL_ADDRESS] Mailing Address: [Insert Corporate Address, India]