Privacy Policy

1. Scope and Overview

Insight Venture (Pty) Ltd t/a IVCRM ("IVCRM", "we", "us", or "our") operates a multi-tenant Customer Relationship Management (CRM) platform offering lead management, WhatsApp Business API messaging automation, AI Creative Suite generation, SEO analytics tools, and digital marketing integrations. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website, subscribe to our SaaS platform, or use our integrated services.

2. Information We Collect

We collect personal data in two primary contexts: as a Data Controller (for our own account holders and website visitors) and as a Data Processor / Operator (on behalf of our SaaS tenants processing end-customer data).

A. Information You Provide Directly

• Account Information: Name, business email address, phone number, billing address, company details, and password credentials.
• Payment Details: Credit/debit card data and billing records processed via secure PCI-DSS compliant payment gateways.
• Support & Correspondence: Communications sent to our support desk, account managers, or legal team (legal@ivcrm.com).

B. Data Processed via CRM & Platform Modules (Tenant Data)

• Lead & Contact Data: Contact lists, phone numbers, email addresses, custom-field values, and CRM interaction histories uploaded by tenants.
• WhatsApp Business Messaging: Phone numbers, message metadata, conversation logs, template parameters, and media files processed via WhatsApp API connections.
• AI & Content Data: Prompts, keywords, and marketing copy processed through our AI Creative Suite and SEO Gateway modules.

C. Information Collected Automatically

• Technical Data: IP address, browser type, operating system, system logs, device IDs, and referral URLs.
• Usage Data: Platform interaction, feature usage, session duration, and clickstream analysis.

3. Legal Bases for Processing (POPIA, GDPR, US Laws)

We process personal data under the following legal frameworks:

• Contract Performance: To provide CRM services, execute billing, and manage tenant accounts.
• Consent: Where you explicitly opt-in to marketing communications or authorize API connections (e.g., WhatsApp, Meta Ads, Google Merchant Center).
• Legitimate Interests: To maintain platform security, prevent fraud, optimize platform architecture, and improve service features.
• Legal Obligation: To comply with statutory obligations, tax regulations, and legal directives in South Africa and international jurisdictions.

4. How We Use Your Information

We process personal data to:

• Provision, maintain, and secure multi-tenant CRM accounts.
• Execute automated workflows, WhatsApp communications, and ad campaign integrations.
• Facilitate affiliate commissions, tracking links, and referral attribution.
• Monitor system uptime, prevent unauthorized server intrusion, and maintain audit logging.
• Respond to customer service inquiries and deliver legal notices.

5. Data Sharing and Third-Party Sub-Processors

We do not sell personal data. We share data only with vetted third-party service providers (Sub-Processors) necessary for operating the platform:

• Hosting & Cloud Infrastructure: Database Mart, CloudPanel, and Linux VPS infrastructure providers.
• Messaging & API Providers: Meta / WhatsApp Business API, DataForSEO, and OpenRouter / OpenAI API integrations.
• Payment Gateways: PCI-compliant payment processors.
• Legal Requirements: When required by subpoena, court order, or applicable law to protect rights, property, or user safety.

6. International Data Transfers

As an international SaaS provider hosted on cloud infrastructure, your personal data may be transferred to and processed in server locations outside your home country. We implement appropriate safeguards—including Standard Contractual Clauses (SCCs) under the GDPR and mandatory operator agreements under POPIA—to ensure your data receives equivalent legal protection.

7. Data Retention & Multi-Tenant Isolation

• Tenant Isolation: We employ strict database-level tenant isolation to ensure data processed by one tenant is completely segregated from other platform accounts.
• Retention Period: We retain account and operational data for as long as your subscription is active, plus applicable statutory retention periods (e.g., tax records). Tenant data deleted by an account holder is permanently removed or anonymized from active databases, subject to standard automated backup cycles.

8. Your Data Protection Rights

Depending on your jurisdiction (e.g., POPIA in South Africa, GDPR in the EU/UK, CCPA/CPRA in California), you possess the following rights:

• Right to Access & Portability: Request copies of your personal data stored on our systems.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to Object / Restrict Processing: Limit or object to specific processing activities.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (e.g., the Information Regulator in South Africa at inforeg@justice.gov.za).

To exercise any of these rights, contact us at legal@ivcrm.com.

9. Security Measures

We enforce multi-layered technical and organizational security controls, including SSH key enforcement, fail2ban brute-force protection, UFW firewall configurations, encrypted HTTPS protocol communication, and restricted file/folder permission hierarchies (775/664).

10. Contact Information

For any questions, legal notices, or data protection queries, please contact:

• Entity: Insight Venture (Pty) Ltd t/a IVCRM
• Attn: Legal & Compliance Officer
• Email: legal@ivcrm.com
• Website: https://ivcrm.com