Privacy Policy

WayCRM is a product of MagicBolt Private Limited, a company incorporated in India. You can reach us at contact@magicbolt.ai.

We play two different roles depending on the data:

• Account and Website data (for example, your name, email and how you use the Service): we decide why and how this data is processed, so we are responsible for it.
• Customer Data — the leads, contacts, conversations, call logs and other records that a business using WayCRM (our “Customer”) adds to the Service: we process this data on the Customer's behalf and according to their instructions. The Customer decides why the data is collected and is responsible for having a lawful basis, including consent, to collect and use it.

If you are a contact or lead of one of our Customers and have questions about your data, please contact that business directly. We will help them respond to your request.

Information you give us

• Account details such as your name, email address, phone number, business name and password.
• Details of your team members that you invite, and the roles you give them.
• Messages you send us on WhatsApp or by email, and information you share when asking for support.
• Billing details needed to provide a paid plan, such as your business name, billing contact and payment records.

Customer Data processed through the Service

• Leads and contacts, including names, phone numbers, email addresses, notes, labels and activity history.
• WhatsApp messages and media sent and received through the Meta WhatsApp Cloud API, together with delivery and read status.
• Follow-ups, meetings, bookings, tasks, deals, payments, subscriptions, tickets and team chat messages.
• Leads received from connected sources such as Facebook Lead Ads, the Public Lead API, CSV uploads and other integrations you enable.

Information from the Android app

With your permission, the WayCRM Android app may access:

• Call logs, to record calls made to and received from leads.
• Files in the call-recording folder you choose, to attach call recordings to the relevant call.
• Notifications, to send reminders for follow-ups, meetings and tasks.

You can withdraw these permissions at any time in your phone's settings. Some features will stop working if you do.

Information collected automatically

• Technical and usage data such as IP address, browser and device type, pages and features used, and error logs, to keep the Service secure and working.
• Device identifiers and push notification tokens, to deliver notifications to staff devices.

• To create and manage your account and provide the Service.
• To connect and run the integrations you choose, such as WhatsApp, Facebook Lead Ads, Google and email.
• To send reminders, notifications and service messages.
• To provide customer support and respond to your requests.
• To process payments and manage subscriptions.
• To keep the Service secure, prevent misuse and fix problems.
• To improve the Service and develop new features.
• To meet legal obligations and enforce our Terms of Service.

We process personal data with your consent or for other lawful purposes permitted by law, such as providing a service you have asked for, meeting legal obligations, or handling an emergency. Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect processing that took place before.

Customers are responsible for obtaining any consent needed from their own contacts — for example, opt-in before sending WhatsApp messages, and consent before recording calls.

We do not sell personal data. We share it only in these cases:

• Service providers that help us run the Service, such as cloud hosting and infrastructure providers, and Google Firebase for push notifications. They may use the data only to provide services to us.
• Integrations you connect, such as Meta (WhatsApp Cloud API and Facebook Lead Ads), Google (Calendar and Sheets) and ZeptoMail. When you connect them, data is exchanged with those services under their own terms and privacy policies.
• Your organisation: admins of a Customer account can see data within that account, according to the roles and permissions they set.
• White-label partners: if you use the Service through a partner who resells it under their own brand, that partner may manage your account and see its data.
• Legal reasons: when required by law, court order or a government authority, or to protect the rights, safety and property of our users, the public or MagicBolt.
• Business transfers: as part of a merger, acquisition or sale of assets, subject to this Policy.

Your data is stored on secure cloud infrastructure. Some of our service providers and the integrations you connect, such as Meta and Google, may process data outside India. Where this happens, we take reasonable steps to make sure the data is protected and that the transfer is permitted under Indian law.

We keep personal data for as long as your account is active or as needed to provide the Service. Customer Data is kept until the Customer deletes it or closes their account.

After an account is closed, we delete or anonymise its data within a reasonable period, unless we need to keep some records to meet legal, tax or accounting obligations, resolve disputes or enforce our agreements.

We use technical and organisational measures to protect personal data, including:

• Session-based login with hashed tokens.
• Encrypted storage of tokens for connected integrations.
• Role-based access and row-level data isolation, so staff see only the records assigned to them.
• Separation of data between businesses on the platform.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the authorities as required by law.

Subject to applicable law, you have the right to:

• Get a summary of the personal data we process about you and how we process it.
• Ask us to correct, complete, update or erase your personal data.
• Withdraw consent you have given.
• Have your grievances addressed.
• Nominate another person to exercise your rights in the event of death or incapacity.

To exercise these rights, email us at contact@magicbolt.ai. We may need to verify your identity first. For Customer Data, please contact the business that holds your data.

The Website does not use advertising or tracking cookies. It stores your light or dark theme choice in your browser's local storage so it is remembered on your next visit.

The web CRM uses cookies and similar technologies that are needed to keep you signed in and to keep the Service secure.

When you click a WhatsApp link or button on the Website, you are taken to WhatsApp, which is operated by Meta and covered by WhatsApp's own privacy policy.

The Service is meant for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

If you have a question or complaint about how we handle personal data, please contact our Grievance Officer:

Grievance Officer
MagicBolt Private Limited, India
Email: contact@magicbolt.ai

We will acknowledge your complaint and respond within the time required by law. If you are not satisfied with our response, you may contact the Data Protection Board of India.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date, and if the changes are significant, we will notify account holders by email or in the Service.

For any questions about this Privacy Policy, email contact@magicbolt.ai or message us on WhatsApp (+91 62632 06697).