GGlaMark CRM

Privacy Policy

Last updated 14 September 2026

This policy explains how GlaMark (“GlaMark,” “we,” “us”) collects, uses, stores and protects information when you use the GlaMark CRM — a WhatsApp-based customer-management tool for businesses. GlaMark is operated by Krithveek Reddy (proprietor, trading as GlaMark), based in Hyderabad, Telangana, India. By using the service you agree to this policy.

1. Two kinds of data

It helps to separate two roles:

  • Your account data — we are the controller. Information about you as our customer: your business name, owner login email, and how you use the service.
  • Your customers’ data — we are your processor. The contacts, phone numbers, WhatsApp messages, notes, tags and renewal dates you put into the CRM belong to you. We process them only to run the service for you, on your instructions. You are the controller of that data and are responsible for having the right to hold and message it.

2. What we collect

  • Account details: business name, login email, and (for support) basic usage and audit logs.
  • Customer records you add or import: names, phone numbers, lead source, stage, tags, notes and renewal dates.
  • WhatsApp conversations: the messages sent to and from your WhatsApp Business number through the service, including media (images, video, documents) and delivery status.
  • Free-form content you enter: notes fields and WhatsApp conversations are open-ended, so they may contain whatever you or your customers type or attach — which, depending on your business, can include sensitive information (for example appointment, health or payment details in a clinic’s chats). You control what goes into the service.
  • WhatsApp connection credentials: your WhatsApp Business Account ID, phone-number ID and access token, which are stored encrypted.
  • Essential cookies: a secure session cookie to keep you signed in, and a local browser preference for light/dark theme. We do not use advertising or cross-site tracking cookies.

Because the service can hold free-form content and attachments, the data you put in may include sensitive personal information. Where it does, you are responsible for ensuring you have a lawful basis and any required consent to collect and process that information through the service.

3. How we use it

  • To provide the CRM: show your inbox, send and receive WhatsApp messages, run your automations, reminders and reports.
  • To keep the service secure, detect abuse, and support you when something breaks.
  • To communicate with you about your account, billing and important service changes.

We do not sell or rent your data, and we do not use your customers’ data to train any AI model.

4. WhatsApp & Meta

The service sends and receives messages through Meta’s WhatsApp Business Platform (the official Cloud API). Your business connects its own WhatsApp Business Account and pays Meta directly for messaging. When you connect that account, GlaMark receives and processes the WhatsApp-related data needed to run the service for you — message content, contact numbers, delivery status and any media exchanged. Meta separately processes that information under its own terms and policies, and Meta’s WhatsApp Business terms place legal and privacy responsibilities on the business using the platform (that is you). Please review the WhatsApp Business Policy and Meta’s Privacy Policy.

5. Who we share it with

We share data only with the service providers that make the product work (“sub-processors”):

  • Supabase — secure database and file storage (data hosted in the Mumbai, India region).
  • Vercel — application hosting (functions run in the Mumbai region).
  • Meta / WhatsApp — to deliver and receive your messages.

We may also disclose information if required by law, or to protect the rights, safety or property of GlaMark, our users, or the public.

6. Storage & security

Your database and file storage are hosted in India (Mumbai region). Traffic is encrypted in transit (HTTPS), and your WhatsApp access tokens are encrypted at rest (AES-256-GCM). We apply access controls, tenant-level access controls — database row-level security plus server-side authorization — designed to prevent unauthorized access to another business’s data, signature verification on incoming WhatsApp events, and rate limiting. No system is perfectly secure, so we cannot guarantee absolute security — but we take reasonable, industry-standard measures to protect your data and will notify you of a breach affecting your data as required by applicable law.

7. Your data is yours — export & deletion

  • Export: you can download a complete copy of your workspace at any time from Settings, and export contacts and usage as CSV.
  • Deletion: you can ask us to delete your account and its data by contacting us. On account closure we delete or irreversibly anonymise your data within a reasonable period, except where we must keep limited records to meet a legal obligation.
  • Correction & access: you can view and edit contact records in the app, or ask us for help.

8. Retention & deletion

We retain your GlaMark CRM workspace and the customer data processed through it for as long as your account remains active.

When you close your account, we make your workspace available for export and delete or anonymise the workspace and associated customer data within 30 days, subject to any data we are required or permitted to retain by law. We may keep limited records relating to payments, invoices, billing, accounting, fraud prevention, security or legal obligations for as long as reasonably necessary or required under applicable law; these are maintained separately from your CRM workspace and are not kept in order to continue operating your account.

Where data is held in backups or disaster-recovery systems, deletion happens on the applicable backup-retention cycle, after which the data is securely overwritten or otherwise rendered unavailable for ordinary processing. We do not restore deleted customer data except where necessary for disaster recovery, security, legal compliance or other legitimate purposes. You can export a full copy of your data at any time before closing your account, and may ask about the status of your deletion using the contact details in this policy.

9. Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

10. Changes

We may update this policy as the product evolves. We will post the new version here with a revised “last updated” date and, for material changes, notify you in the app or by email.

11. Contact & privacy requests

Questions, or a privacy / data request (access, correction, deletion, or withdrawal of consent)? Email contact.glamark@gmail.com with “Privacy request” in the subject, or reach us on WhatsApp at +91 63048 62641. We aim to acknowledge requests promptly and respond within the timelines required by applicable law.

For customer data we process on behalf of a business (our client), a person should generally direct their request to that business first, as the party responsible for that data. We will assist our business customer in responding as required.