How we handle your personal data

This Privacy Policy explains how Web Digital Mantra IT Services Private Limited ("WDM", "we", "us") collects, uses, discloses and safeguards personal data when you use OrbitoCRM (orbitocrm.in), OrbitoMeet (meet.orbitocrm.in), our mobile apps, our marketing website, or any other service that links to this policy (together, the "Services"). It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Who is responsible for your data

The data fiduciary (controller) is Web Digital Mantra IT Services Pvt Ltd, a company registered in Bengaluru, Karnataka, India (GST 29AAIFW4289G1ZH). For questions, exercise of rights or complaints, write to our Grievance Officer, Virendra Kumar, at info@webdigitalmantra.in or call +91 9620 805 972.

2. The data we collect

2.1 Information you give us

• Account data — name, work email, phone number, company, job title, time zone, password hash (bcrypt).
• Billing data — company address, GSTIN, payment-method token held by our payment processor (Razorpay). We never see or store your full card number.
• Content you upload — leads, clients, projects, tasks, meetings, chat messages, documents, candidate CVs, letters, invoices, and anything else you type or attach inside OrbitoCRM.
• Support submissions — anything you send through the help form, email or phone, including the message body and any attachments.
• Meeting content on OrbitoMeet — your display name when joining a public meeting; live audio/video streams while the call is in progress; a recording file only when a host explicitly starts the recorder.

2.2 Information we collect automatically

• Device and connection — IP address, browser type and version, operating system, referring URL, pages visited, action timestamps.
• Diagnostics — error reports, API latencies and feature-usage counters, used to run the service reliably.
• Cookies and local storage — see our separate Cookie Policy for the exact list.

2.3 Information from third parties

• WhatsApp (via Meta) delivers transactional messages you receive from us and sends us delivery/read status.
• Google / Microsoft Calendar, when you connect them, send us upcoming meeting metadata so OrbitoCRM can schedule video rooms.
• Payment status and signed webhooks from Razorpay.

3. Why we process your data

4. Who we share data with

We do not sell your personal data. We share it only with the processors we need to run the Service. Every sub-processor is bound by a written data-processing agreement.

• Infrastructure — Amazon Web Services (Mumbai region) for the CRM backend; MongoDB Atlas (Mumbai) for the primary database; our own servers in Bengaluru for OrbitoMeet video streams.
• Payments — Razorpay Software Private Limited (processor for cards, UPI, netbanking, and recurring mandates).
• Email delivery — SMTP services configured per tenant; our own mail servers for transactional messages that do not have a tenant SMTP.
• Communications — Meta Platforms (WhatsApp Business API) for WhatsApp messages; Mishtel for SMS/OTP delivery.
• Analytics — Google Analytics 4 on the public marketing site only; never on the authenticated CRM or on meet.orbitocrm.in.
• Lawful requests — competent Indian authorities when compelled by an order we are legally bound to answer.

5. International transfers

Your data is stored in India. We will only transfer personal data outside India if the destination country is notified by the Government of India for cross-border transfer under the DPDP Act, and the receiving processor has agreed to equivalent protection in writing. We do not currently rely on any such transfer for OrbitoMeet or OrbitoCRM core.

6. How long we keep it

• Account and content data — for the life of your subscription, then 90 days after cancellation for recovery, then permanent deletion unless an active legal hold applies.
• Tax invoices and payment records — eight years, as required by the GST Act and the Companies Act, 2013.
• Public OrbitoMeet rooms — the meeting slug and timestamp for four hours after creation (TTL in Mongo), then automatic deletion. The video stream itself is never recorded unless a host starts the recorder.
• Audit logs — one year, then anonymised.
• Support tickets — three years after closure.

7. Your rights

Under the DPDP Act you have the right to:

• Confirm whether we process your data, and ask for a copy.
• Correct or update anything that is wrong.
• Erase data we no longer need, subject to legal retention duties.
• Nominate another person to exercise these rights if you cannot.
• Withdraw a consent you previously gave (processing stays lawful up to that point).
• Raise a grievance with our Grievance Officer and, if unresolved in thirty days, escalate to the Data Protection Board of India.

Email info@webdigitalmantra.in from the address on your account; we reply within thirty days.

8. Security

• TLS 1.2+ in transit everywhere; HSTS on all our domains.
• Passwords stored only as bcrypt hashes; MFA available on request.
• Database access limited to a short list of named engineers with audited logins.
• OrbitoMeet media is relayed through our own servers over DTLS/SRTP; no third-party video relay sees your call.
• Server-side field-level encryption on candidate PII, bank details and signed letters.
• Regular backups, retention tested quarterly, destroyed on the schedule above.

9. Children

OrbitoCRM is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, write to us and we will delete it.

10. Changes to this policy

We update this policy when the Service changes materially or the law changes. When we do, we bump the version number at the top, email every account owner, and display an in-app banner for thirty days. The current version is always available at orbitocrm.in/privacy.

11. Governing law and disputes

This policy is governed by the laws of India. The courts of Bengaluru, Karnataka, have exclusive jurisdiction over any dispute arising out of it, without prejudice to your right to approach the Data Protection Board of India.