ClivoCRM Privacy Policy

Clivo Ventures Private Limited
Last updated: October 31, 2026
CIN: U62020MH2026PTC465602

Live at: https://clivo.io/clivocrm/privacy

---

This Privacy Policy ("Policy") describes how Clivo Ventures Private Limited ("Clivo", "we", "our", or "us") collects, uses, shares, and protects personal data when you use the ClivoCRM mobile application on iOS or Android (the "App").

This Policy supplements the Clivo Master Privacy Policy available at https://clivo.io/privacy-policy. Where this Policy differs from the Master Policy in respect of the App, this Policy prevails.

By downloading, installing, or using the App, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please do not use the App.

---

1. WHO WE ARE AND OUR ROLE

Registered office: Unit 109, Master Mind-V, Royal Palms Estate, Aarey Milk Colony, Goregaon East, Mumbai, Maharashtra 400065, India.

CIN: U62020MH2026PTC465602

Contact: support@clivotech.io

ClivoCRM is a business tool. Our role under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where applicable, the EU General Data Protection Regulation ("GDPR") depends on the type of data:

• Your account data and App usage data: Clivo is the Data Fiduciary / data controller.
• CRM content: contacts, leads, deals, notes, activities, and other records about your customers and prospects are entered and controlled by the business or organisation that holds the ClivoCRM subscription (the "Customer"). For this data, the Customer is the Data Fiduciary / data controller, and Clivo processes it on the Customer's behalf and on its instructions as a Data Processor / processor.

If you add personal data about other people to the App (for example, by importing phone contacts or scanning a business card), you, or the Customer you act for, are responsible for having a lawful basis to do so.

2. PERSONAL DATA WE COLLECT

We collect the following categories of personal data when you use the App:

2.1 Account information

Accounts are created on our website, either by you or by your organisation. The App does not create accounts. When you sign in to the App, we process:

• Name, email address, and phone number (if provided);
• Password (stored as a cryptographic hash; we never store your password in plain text);
• Organisation name, your role, and your team membership;
• If you sign in using Google Sign-In or Sign in with Apple: your email address, name, and a unique identifier provided by Google or Apple. We do not receive your Google or Apple account password.

2.2 CRM content

• Contacts, leads, companies, deals, pipelines, tasks, reminders, notes, tags, and activity history that you or your team create, import, modify, or delete;
• Contact details you add about other people, including names, phone numbers, email addresses, company names, job titles, and addresses;
• Customer visit check-ins, including the location recorded at the time of check-in (see Section 3);
• Call records you log after calling a contact from the App (time, estimated length, outcome, and number dialled);
• Voice notes (the audio file and its text transcript), saved on the contact or deal they relate to;
• Text transcripts of voice commands and your conversations with the AI assistant;
• Emails, meetings, and other data from apps your workspace connects (such as Gmail, Zoom, Google Meet, and Slack), to the extent needed for the Inbox, meetings, and actions the AI assistant takes;
• Details of AI phone calls placed from the App, including the call instructions you type, the call transcript, and the outcome;
• Meetings you schedule through the App;
• Metadata associated with such content (creation and modification timestamps, record owner, and status).

2.3 Purchase information

The App does not sell anything or offer in-app purchases. Plans are bought by organisations on our website.

2.4 Device and technical data

When you use the App, we (and our third-party service providers) automatically collect:

• Device identifiers (such as a random installation ID generated by the App and platform-provided device identifiers);
• Device type, model, and manufacturer;
• Operating system and version (iOS, iPadOS, or Android);
• App version, build number, and language/locale settings;
• IP address and approximate location derived from IP (city / region level);
• Network information (such as carrier, connection type, and whether the device is online or offline).

Apart from the location captured when you check in at a customer visit (see Section 3), we do not collect precise GPS location, and we never track your location in the background.

2.5 Usage and analytics data

• Screens and features you view and interact with within the App;
• Actions you take (for example, creating a lead, logging a call, or checking in at a visit);
• Session duration, frequency of use, and in-app navigation paths;
• Performance metrics such as load times and feature responsiveness.

You can turn usage analytics on or off at any time from Settings → Share usage analytics. Turning it off does not restrict any functionality of the App.

2.6 Session recording

The App does not record your sessions.

2.7 Crash and diagnostic data

When the App crashes or encounters an error, we collect crash and error reports containing error details, device type and operating system, App version, and an internal user number. Crash reports do not include your name, email address, or CRM content.

2.8 Communications

Content of support requests or messages you send to us through the App, via support@clivotech.io, or through published support channels.

2.9 Push-notification tokens

When you enable push notifications, the operating system (Apple Push Notification service on iOS, or Firebase Cloud Messaging on Android) and Expo Push (which routes notifications on our behalf) provide us with a device-specific push token, which we use to deliver notifications.

3. APP PERMISSIONS

The App asks for device permissions only when you use the feature that needs them. You can grant or withdraw any permission at any time from your device settings. Declining a permission disables only the related feature; the rest of the App continues to work.

Permission	What we access and why
Location (only while using the App)	Captured once, at the moment you check in at a customer visit, and saved with that visit record. We do not access location in the background or track your movements.
Camera	Used to photograph business cards. The image is processed to extract contact details, which are saved as a new contact.
Contacts	Used to import phone contacts you choose into the CRM. Only the contacts you select are uploaded.
Calendar	Used to add meetings you schedule in the App to your phone calendar. We do not read or upload your other calendar events.
Microphone	Used only while you are recording a voice note or speaking to the AI assistant. Voice notes are saved as an audio file with a text transcript on the contact or deal. Voice commands to the AI assistant are converted to text, and the audio is not stored. We never record phone calls.
Notifications	Used to send task reminders, new lead alerts, and reply notifications.
Display over other apps (Android only)	Used to show a caller ID card on screen when a CRM contact calls you.
Caller ID / call screening (Android only)	Used to check whether an incoming number matches a CRM contact so that the caller ID card can be shown. We do not listen to, record, or block calls.
Network state	Used to detect when your device is offline so that the App can keep working and sync your changes when you reconnect.

4. HOW WE USE YOUR PERSONAL DATA

We use your personal data for the following purposes:

• Provide the App and Services: authenticate you, sync CRM content across your devices and your team, and make the App's features available to you;
• Provide AI features: transcribe voice notes and voice commands, extract details from business cards, and enable the AI assistant to answer questions about, and act on, your CRM records and connected apps at your request;
• Place AI phone calls: make AI phone calls to contacts when you instruct the App to, and record the transcript and outcome;
• Connect your apps: show your Inbox and meetings, and carry out actions in apps your workspace has connected;
• Send notifications and emails: deliver reminders, lead alerts, reply notifications, and other functional notifications you have enabled, and send service emails such as sign-in emails, receipts, and AI credit alerts;
• Improve the App: analyse how users interact with the App, identify bugs and performance issues, and develop new features (you can turn off usage analytics in Settings → Share usage analytics);
• Deliver over-the-air (OTA) updates: distribute JavaScript/TypeScript bundle updates to your copy of the App in accordance with Apple's and Google's applicable guidelines;
• Provide customer support: respond to your enquiries, resolve complaints, and assist with account issues;
• Security and fraud prevention: detect, prevent, and address technical issues, abuse, fraud, and violations of our terms;
• Legal compliance: comply with applicable laws and respond to lawful requests from public authorities.

We do not use CRM content to market to the people whose details are stored in it, and we do not use CRM content for any purpose other than providing, securing, and supporting the App for the Customer.

5. LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases (as applicable):

• Performance of a contract: to provide you and the Customer with the App and the features requested;
• Processing on behalf of the Customer: for CRM content, the Customer determines the legal basis for processing, and we process that data only on the Customer's documented instructions;
• Consent: for device permissions and any other processing that requires consent under applicable law. You may withdraw your consent at any time, including by revoking device permissions;
• Legitimate interests: to secure the App, prevent abuse, and improve the App through usage analytics, where such interests are not overridden by your rights and where you have the ability to object (for example, by turning off Settings → Share usage analytics);
• Legal obligation: where processing is required to comply with applicable law.

6. THIRD-PARTY SDKs AND SERVICE PROVIDERS

To operate the App and understand how it is used, we integrate with the following third-party service providers. Each provider receives only the data necessary for its stated purpose and is bound by its own privacy terms and our written data-processing arrangements.

6.1 Supabase (Backend and Data Hosting)

• Provider: Supabase, Inc.
• Purpose: authentication, database, storage, and backend infrastructure for your account and CRM content.
• Data processed: account information, hashed password, CRM content (including check-in locations, call records, voice note audio and transcripts), and associated timestamps.
• Data location: stored in Supabase infrastructure located in India.
• Privacy policy: https://supabase.com/privacy

6.2 OpenAI (AI Assistant and Business Card Scanning)

• Provider: OpenAI OpCo, LLC.
• Purpose: extraction of contact details from business card images, and generation of AI assistant responses and actions.
• Data processed: business card images, your prompts to the AI assistant (including the text of voice commands), and the CRM records needed to answer or act on your request.
• Model training: data submitted through OpenAI's API is not used to train OpenAI's models.
• Retention by OpenAI: OpenAI may retain API data for up to 30 days for abuse and misuse monitoring, after which it is deleted, unless longer retention is required by law.
• Data location: may be processed outside India, including in the United States.
• Privacy terms: https://openai.com/enterprise-privacy/

6.3 Sarvam AI (Speech-to-Text)

• Provider: Axonwise Private Limited (d/b/a Sarvam AI).
• Purpose: converting voice notes and voice commands to text.
• Data processed: voice audio.
• Model training: voice audio we send to Sarvam AI is not used to train its models.
• Data location: primarily India; may be processed outside India by Sarvam AI's infrastructure providers.
• Privacy policy: https://www.sarvam.ai/privacy-policy

6.4 Composio (Connected Apps)

• Provider: Sampark Inc (d/b/a Composio).
• Purpose: connecting the apps a workspace links (such as Gmail, Zoom, Google Meet, Slack, and others), used for the Inbox, meetings, and actions the AI assistant takes.
• Data processed: email messages and the details needed for each action (for example, meeting details or message content).
• Data location: may be processed outside India, including in the United States.
• Privacy policy: https://composio.dev/privacy

6.5 Bolna (AI Phone Calls)

• Provider: Whismurwave Inc (d/b/a Bolna).
• Purpose: placing AI phone calls to contacts at your instruction.
• Data processed: the contact's name and phone number, the call instructions you type, the call transcript, and the call outcome.
• Data location: may be processed outside India, including in the United States.
• Privacy policy: https://www.bolna.ai/privacy-policy

6.6 Brevo (Service Emails)

• Provider: Brevo SAS.
• Purpose: sending service emails such as sign-in emails, receipts, and AI credit alerts.
• Data processed: name, email address, and email content.
• Data location: may be processed outside India, including in the European Union.
• Privacy policy: https://www.brevo.com/legal/privacypolicy/

6.7 Sentry (Crash and Error Reporting)

• Provider: Functional Software, Inc. (d/b/a Sentry).
• Purpose: crash and error reporting only.
• Data processed: error details, device type and operating system, App version, and an internal user number. Sentry does not receive names, email addresses, or CRM content.
• Privacy policy: https://sentry.io/privacy/

6.8 PostHog (Product Analytics)

• Provider: PostHog Inc.
• Purpose: product analytics only: understanding feature usage, user journeys, and aggregate trends to improve the App. The App does not use PostHog to record sessions.
• Data processed: a pseudonymous user identifier, events and screens you view, actions you take within the App, device and App information, approximate (IP-based) location, and session data.
• Controls: you can turn analytics on or off at any time in Settings → Share usage analytics.
• Privacy policy: https://posthog.com/privacy

6.9 Expo (App Delivery and Push Notifications)

• Provider: 650 Industries, Inc. (d/b/a Expo).
• Purpose: (i) EAS Build: cloud build infrastructure used to compile and sign the App; (ii) EAS Update: delivery of over-the-air updates to your device; and (iii) Expo Push: routing service that forwards push notifications from us to Apple Push Notification service or Firebase Cloud Messaging for delivery to your device.
• Data processed: App version, runtime version, platform (iOS/Android), installation identifiers, and Expo push tokens. For push notifications routed via Expo Push, the notification payload (for example, the title and body of a lead alert) passes through Expo's infrastructure before being delivered to Apple or Google.
• Privacy policy: https://expo.dev/privacy

6.10 Firebase Cloud Messaging (Android Push Delivery)

• Provider: Google LLC.
• Purpose: final delivery of push notifications to Android devices.
• Data processed: device registration tokens and the notification payload forwarded to your device. Firebase Cloud Messaging is a transport layer; we do not use Firebase Analytics or other Firebase services beyond push delivery.
• Privacy policy: https://firebase.google.com/support/privacy

6.11 Apple and Google (Platform Providers)

The Apple App Store and Google Play Store process your account data in connection with downloading the App. Apple Push Notification service (on iOS) handles final delivery of push notifications to your device. Their use of your data is governed by Apple's and Google's respective privacy policies.

7. HOW WE SHARE YOUR PERSONAL DATA

We do not sell your personal data. We share personal data only in the following circumstances:

• Within your organisation: CRM content, activity history, call records, and visit check-ins (including their location) are visible to other authorised users in the Customer's account, according to the roles and permissions the Customer sets;
• Service providers: with the third-party providers listed in Section 6, strictly for the purposes described;
• Legal and regulatory: where required by law, court order, or other legal process, or to establish, exercise, or defend legal claims;
• Safety and security: to protect the rights, property, or safety of Clivo, our users, or the public;
• Business transfers: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to appropriate confidentiality protections and notice where required by law;
• With your consent: where you have directed or consented to the sharing.

8. DATA LOCATION AND INTERNATIONAL TRANSFERS

Your account and CRM content are primarily stored on Supabase infrastructure located in India. Some of our other service providers (including OpenAI, Sarvam AI, Composio, Bolna, Brevo, Sentry, PostHog, Expo, and Firebase Cloud Messaging) may process data outside India, including in the United States and the European Union. Where personal data is transferred to a jurisdiction that does not offer the same level of protection, we implement appropriate safeguards in accordance with applicable law (including the DPDP Act and, where applicable, GDPR standard contractual clauses).

9. DATA RETENTION

We retain personal data for as long as it is needed for the purposes described in this Policy, as follows:

• Account data: retained until your account is deleted;
• CRM content: retained for as long as the Customer's account is active, or until deleted by the Customer or its authorised users. When the Customer's subscription ends, CRM content is deleted or anonymised within 90 days, unless the Customer requests an export or a longer period is required by law;
• Voice notes: the audio file and its transcript are kept on the contact or deal, as part of CRM content, until deleted by you or the Customer;
• Voice commands: the audio is not stored. Only the text is kept, as part of the AI assistant conversation;
• Business card images: deleted after contact details are extracted. Only the extracted details are retained, as part of CRM content;
• AI assistant conversations and AI call transcripts: retained as part of CRM content until deleted by you or the Customer;
• Crash and analytics data: retained in aggregated or pseudonymous form for up to 26 months, consistent with our analytics providers' default retention;
• Billing records for plans bought on our website: retained for the period required under applicable tax, accounting, and commercial laws (typically 8 years from the end of the financial year);
• Support communications: retained for up to 24 months after resolution.

Deleted data is removed from backups in the ordinary course of backup rotation. We may retain certain data for longer where required by law, or where necessary to establish, exercise, or defend legal claims.

10. YOUR RIGHTS

Subject to applicable law, you have the following rights in relation to your personal data:

• Access: obtain a copy of the personal data we hold about you;
• Correction: correct inaccurate or incomplete data;
• Erasure / Account deletion: delete your account and associated personal data (see Section 11);
• Portability: receive a copy of your data in a structured, commonly used, machine-readable format;
• Restriction and objection: restrict or object to certain processing, including direct marketing and usage analytics (which you can turn off in Settings → Share usage analytics);
• Withdraw consent: where processing is based on consent, withdraw your consent at any time, including by revoking device permissions;
• Nominate: under the DPDP Act, nominate another individual to exercise your rights in the event of your death or incapacity;
• Grievance redressal: raise a grievance with our Grievance Officer (see Section 15);
• Complaint to a supervisory authority: lodge a complaint with the Data Protection Board of India or the relevant supervisory authority in your jurisdiction.

If your details are stored in a Customer's CRM: the Customer controls that data. Please contact the business that holds your details to exercise your rights. If you contact us instead, we will forward your request to the relevant Customer and assist it in responding, as required by law.

To exercise your rights, contact us at support@clivotech.io or use the in-App settings where available. We will respond within the timeframes required by applicable law.

11. ACCOUNT DELETION

To delete your ClivoCRM account, email support@clivotech.io from your account email, or use https://crm.clivo.io/data-deletion.

Upon account deletion, we will delete or irreversibly anonymise your account data from our active systems promptly, and from backups in the ordinary course of backup rotation. CRM records you created on behalf of a Customer belong to that Customer and remain in its account unless the Customer deletes them. If your account was created by your organisation, your organisation's administrator may also remove it. Certain data may be retained where necessary for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes, as described in Section 9.

12. CHILDREN'S PRIVACY

The App is a business tool intended for users aged 18 and above. We do not knowingly process personal data of any individual under 18 as a user of the App. If you believe that we have inadvertently collected such personal data, please contact us at support@clivotech.io and we will take steps to delete it.

13. SECURITY

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit using TLS;
• Encryption of CRM content at rest in Supabase infrastructure;
• Cryptographic hashing of passwords (we never store plaintext passwords);
• Role-based access controls, so that users see only the CRM data their organisation permits;
• Access controls and least-privilege principles for our personnel and service providers;
• Not storing voice command audio, and deleting business card images after processing;
• Periodic reviews of our security posture and response procedures.

No method of transmission or storage is completely secure. You are responsible for safeguarding your account credentials and for notifying us promptly at support@clivotech.io if you suspect unauthorised access to your account.

14. NOTIFICATIONS

With your permission, the App sends push notifications to your device, such as task reminders, new lead alerts, replies, and other notifications related to your use of the App. The App does not send promotional notifications.

Push notifications are routed through Expo Push and delivered by Apple Push Notification service (on iOS) or Firebase Cloud Messaging (on Android). You can manage or disable notifications at any time through your device's system settings. Disabling notifications may cause you to miss reminders and lead alerts.

15. GRIEVANCE OFFICER

In accordance with the DPDP Act and the Information Technology Act, 2000 (and the rules made thereunder), we have appointed a Grievance Officer to address any concerns regarding this Policy or our processing of your personal data:

Grievance Officer: Abhay Muttreja, Managing Director, Clivo Ventures Private Limited
Email: support@clivotech.io
Postal Address: Unit 109, Master Mind-V, Royal Palms Estate, Aarey Milk Colony, Goregaon East, Mumbai, Maharashtra 400065, India.

We acknowledge grievances within a reasonable period and respond within the timeframes prescribed by applicable law.

16. APPLE AND GOOGLE PLATFORM REQUIREMENTS

16.1 Apple App Tracking Transparency (iOS)

The App does not track you across apps and websites owned by other companies for advertising or measurement purposes, and does not currently present Apple's App Tracking Transparency (ATT) prompt. If this changes in the future, we will request your permission through Apple's ATT framework before enabling any such tracking, and will update this Policy accordingly.

16.2 Apple Privacy Nutrition Labels

The data types disclosed in this Policy are reflected in the privacy labels displayed on the App's Apple App Store listing. Where there is any inconsistency, this Policy prevails.

16.3 Google Play Data Safety

The data types disclosed in this Policy are reflected in the Data Safety section of the App's Google Play Store listing. Where there is any inconsistency, this Policy prevails.

16.4 Android caller ID and overlay permissions

The caller ID / call screening and display-over-other-apps permissions are used solely to identify CRM contacts who call you and show their caller ID card, as described in Section 3. The App does not read your phone's call log. These features are not available on iOS.

16.5 Over-the-Air (OTA) Updates

The App uses Expo's EAS Update service to deliver over-the-air updates to the App's JavaScript/TypeScript bundle. These updates are limited to bug fixes and non-material changes that are consistent with the App's functionality as approved by Apple and Google, and do not change the App's primary purpose or introduce material new features requiring platform review. Updates that introduce material new features or native-code changes are distributed through the Apple App Store and Google Play Store review process.

16.6 Advertising identifiers

The App does not display third-party advertising, does not use device advertising identifiers (IDFA on iOS or Android Advertising ID) to deliver ads to you within the App, and does not share advertising identifiers with third parties.

16.7 Analytics controls

Usage analytics can be turned on or off by you at any time through Settings → Share usage analytics. Turning it off does not restrict any functionality of the App.

17. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy at https://clivo.io/clivocrm/privacy and update the "Last updated" date at the top of this Policy. Where changes are material, we will provide in-App notice and, where required by law, obtain your consent before the changes take effect.

18. CONTACT US

Clivo Ventures Private Limited
Unit 109, Master Mind-V, Royal Palms Estate, Aarey Milk Colony, Goregaon East, Mumbai, Maharashtra 400065, India
Email: support@clivotech.io | Website: clivo.io

---

© 2026 Clivo Ventures Private Limited. All rights reserved. CIN: U62020MH2026PTC465602