Data Policy

Last updated: 12 October 2026

This Data Policy explains how InfoIndia91 handles the business data stored in InfoIndia91 - PoolCo CRM (the "Service"). It adds detail to our Privacy Policy and forms part of our Terms & Conditions.

1. Who owns the data

Each business that uses the Service ("Customer company") owns the business data it enters: clients, leads, quotations, products, payments, notes, files and messages. We process that data only on the Customer company's behalf, to provide the Service.

2. Where data is stored

Data is stored in a database on secure servers of our hosting provider and is accessed only over encrypted HTTPS connections. Uploaded files such as logos, product photos and payment proofs are stored on the same hosting account.

3. How data is protected

We use end-to-end data protection: data is protected while it travels, when anyone logs in, inside the Customer company, while it is stored and on the server. Each Customer company's data is 100% private to that company — no one outside the Customer company can see it, and it is never shared, sold or used for advertising. (Our support team opens a company's data only as described in section 4.) The main security layers are below; the full list is on our Security & Data Protection page.

• Encryption in transit: every connection uses HTTPS (TLS), plain http:// is redirected, and browsers are told to always use the secure connection.
• Separation between companies: every record belongs to one Customer company, and no one outside that company can see it.
• Roles inside a company: admin, manager and employee roles decide who sees what. Employees see their own leads; managers see their team; admins see the whole company.
• Secure login: passwords are stored only as one-way hashes, 5 wrong passwords lock the login for 15 minutes, and a 6-digit code is emailed for logins from new devices. A login works on one device at a time, and admins can limit logins to office IP addresses.
• Protection against fake requests: every form carries a security token (CSRF protection).
• Encrypted secrets: WhatsApp access tokens, payment gateway keys and login tokens are stored with AES-256-GCM encryption.
• Private files: payment proofs and field photos are never public and open only after a permission check.
• Hardened server: configuration and database files cannot be opened from the web, and uploaded files can never run as programs.
• Login history: logins are recorded with time, IP address and device, so unusual access can be spotted.
• Not in search engines: CRM pages are blocked from search engines and are never indexed.

4. Who can access data

Only the Customer company's own users can see its business data. Our staff access a company's data only when needed to provide support, fix a problem or meet a legal requirement, and only for that purpose.

5. How long data is kept

• Business records (clients, quotations, products, payments) — while the Customer company's account is active.
• Team chat messages — 90 days.
• Login history — 1 year.
• Field location points — 90 days by default (the company can choose 30 to 365 days).
• Quotation PDFs sent on WhatsApp are passed to Meta and are not stored on our server.
• Records we must keep by law, such as invoices, are kept for the period the law requires.

6. Getting a copy of your data

A company admin can download quotations and reports from the Service where downloads are enabled for the company. For a full copy of the company's data, write to us from the admin's registered email; we send it in a common format such as CSV.

7. Data deletion

1. Email us from your registered email address with the subject "Data deletion request", and mention the company name and the phone number or email to be deleted.
2. We confirm the request and delete the data within 30 days, except records we must keep by law.
3. When a Customer company's account is deleted, its data is removed from the Service.

If you are a customer of a business that uses the Service, please contact that business first; we will help them act on your request.

8. Data shared with others

We do not sell data and do not use it for advertising. We share data only with our hosting provider, our email provider, Meta (for WhatsApp messages of companies that connect WhatsApp), payment gateways (for subscription payments) and authorities when required by law.

9. Security incidents

If we become aware of a security incident that affects a Customer company's data, we will inform that company without undue delay and take steps to limit the impact, and will meet our obligations under applicable Indian law.

10. Contact

For any question or request about data, contact InfoIndia91:
Email: 91infoindia@gmail.com
Phone: +91-6201868378
Address: Near Bijwasan Flyover, Bijwasan,
New Delhi - 110061, India