AbroBot CRM

Privacy Policy

Last updated 14 October 2026 · Digital Personal Data Protection Act, 2023 (India)

This policy explains how AbroBot Technologies Private Limited ("AbroBot", "we") handles personal data in AbroBot CRM at crm.mnbresearch.com.

The distinction that matters most

AbroBot CRM holds two different kinds of personal data, and our duties differ for each.

Your account data — your name, email and billing details as our customer. Here we are the Data Fiduciary (controller). We decide why it is held, and this policy governs it.
Your customers' and enquirers' data — the records inside your CRM. Here we are a Data Processor acting on your instructions. You are the Data Fiduciary for those people. You decide what to collect and why; we store and process it so the product works, and we do not use it for our own purposes, sell it, or train any model on it.

1. What we collect

As Data Fiduciary — your account

Name, work email and organisation name, supplied at sign-up.
Sign-in events. We use passwordless magic links, so we never store a password.
Plan, payment status and invoice history. Card and UPI details go directly to our payment gateway and never reach our servers.
Operational logs needed to keep the service running and to investigate faults.

As Data Processor — the records in your CRM

Whatever you or your enquirers put in, typically: name, email, phone or WhatsApp number, the text of their enquiry, the page they arrived on, and any custom fields you define. If you capture passport, budget or academic details through your own forms, we store those too — as your processor, on your instruction.

Where the AI assistant is enabled on your website, it records the conversation and the page URL so the transcript appears against the record in your CRM.

2. Who else processes it

Every sub-processor actually used by the running product, and what each one sees:

Sub-processor	Purpose	What it receives
Supabase	Database, authentication, serverless functions	All stored data
Cloudflare	Hosting and CDN for the application	Request metadata, IP addresses
Groq	The AI assistant's language model	Conversation text, and your agent's knowledge base
Resend	Outbound email (follow-ups, campaigns)	Recipient name and email, message content
Telegram	New-lead alerts, where you enable them	The alert contents you choose to receive
Meta (WhatsApp Cloud API)	WhatsApp messaging, on Growth plans and above where you configure it	Phone number and message content
Cashfree	Payments	Your billing details. Card data goes to Cashfree directly, not through us.
Google Fonts (Google LLC)	Font delivery for our website and app pages	Your IP address and browser user agent, when your browser downloads the fonts

We do not sell personal data, and we do not share it with advertisers. This site runs no advertising trackers and no third-party analytics.

Bounces and spam complaints

When an email sent through AbroBot CRM hard-bounces, or its recipient reports it as spam, our email provider (Resend) notifies us and we add that address to a suppression list. Follow-ups, campaigns and our own account emails are then no longer sent to it, and it is opted out of automated follow-ups in every workspace that holds it. We keep the address on the list only so that we can keep honouring it; ask the Grievance Officer below if you want it reviewed.

Our own product analytics

To understand how AbroBot CRM is used, we record a small set of events in our own database — for example that the pricing page was viewed, a sign-in link was requested, a workspace was created, a screen in the app was opened, or a checkout was started. No third party receives them. We record the page path without its query string, the referring website and any campaign (UTM) tags, and — when you are signed in — your user and workspace. We do not set cookies for this: signed-out visits carry only a random identifier kept for the life of the browser tab. We never record what you type, the contents of your CRM, passwords, or payment details. Payment outcomes are taken from our payment provider's verified notifications, not from your browser.

If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing. These events are kept for 13 months and then deleted; you can ask the Grievance Officer below to erase yours sooner.

3. Where it is stored

Primary storage is in Supabase's Asia-Pacific region. Some sub-processors above operate globally, so data may be processed outside India in the course of delivering the service. We use providers that offer contractual data-protection terms.

4. How long we keep it

CRM records: for as long as your account is active. Deleting a record archives it first — recoverable by you for 30 days — and it is then permanently removed.
Chat transcripts: retained with the record they belong to.
Invoices and payment records: retained as long as Indian tax law requires, even after you close your account.
On closure: tell us and we will delete your workspace and its records, except anything we must keep by law.

5. Your rights under the DPDP Act

If you are our customer, you may ask us to give you a copy of your account data, correct it, delete it, or tell you who we have shared it with. Write to the Grievance Officer below and we will respond within the timelines in section 7.

If you are someone whose details sit in a business's CRM — you enquired with a shop, a clinic or a consultancy that uses AbroBot — then that business is the Data Fiduciary, not us. Contact them first. If you cannot reach them, write to us and we will pass your request to them and support them in honouring it.

6. The chat assistant on a customer's website

When a business adds the AbroBot assistant to its site, conversations with that assistant are recorded and stored in that business's CRM, and the message text is sent to the language-model provider named above to generate a reply. If you leave an email or phone number in the conversation, it is saved as an enquiry record for that business. Do not share payment details, passwords, or government identifiers in a chat window.

7. Grievance Officer

Mridul Nanda
AbroBot Technologies Private Limited
Email: mridulnanda@abrobot.ai
Phone: +91 97114 88480

We acknowledge every grievance within 48 hours and aim to resolve it within 7 working days. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India.

8. Security

Access to your data is enforced at the database level, so one customer's workspace cannot read another's. Credentials you supply for integrations are stored write-only: they can be used by the service but cannot be read back out through the application. Traffic is encrypted in transit. No system is perfectly secure, and we will tell affected customers and the Board about a breach that is likely to cause harm.

9. Children

AbroBot CRM is a business tool and is not directed at children. We do not knowingly collect a child's personal data as Data Fiduciary. If you operate in education and your records concern people under 18, you are responsible as Data Fiduciary for the verifiable parental consent the DPDP Act requires.

10. Changes

If we change this policy materially we will update the date above and tell account holders by email.