Privacy Policy
This service ("Advisor CRM", the "Service") is run by Archsoft Consulting ("we", "us"). It helps financial advisors ("Advisors") manage their own clients.
1. Who is responsible for what
- The Advisor decides which client data to put in the Service and why. For that client data the Advisor is the "data fiduciary" (data controller) and we act as a service provider (data processor) that stores and processes it only on the Advisor's instructions.
- For the Advisor's own account details (email, name, plan, payments) we are the data fiduciary.
2. What we process
- Advisor account: name, email, password (stored only in scrambled form, never readable), plan and expiry, payment references (UPI transaction number), login sessions.
- Client data entered or imported by the Advisor: names, family links and relationships, date of birth, gender, mobile numbers, email, address, policy and SIP details (company, plan, premium, due dates, status), notes, message history and consent choices.
- Technical: a sign-in token in the page address, basic server logs.
3. Why we process it
To provide the Service: store the Advisor's data, show reminders and suggestions, and (only if the Advisor connects WhatsApp) send messages the Advisor chooses or schedules. We do not use client data for advertising and we do not sell it.
4. Who else receives data
- Meta (WhatsApp Business Platform): only if the Advisor connects their own WhatsApp Business account. Messages and recipient numbers are then sent through Meta under the Advisor's own account and Meta's terms.
- Hosting provider: servers are hosted with AWS Lightsail, Mumbai (India).
- We do not share one Advisor's data with another Advisor. Super-admin screens do not show Advisors' client data.
- We may disclose data if required by law.
5. Messaging and consent
Advisors must have a lawful basis, normally the client's consent, before messaging a client. The Service lets an Advisor mark a client "Do not contact", and a client replying STOP on WhatsApp is blocked automatically from further messages.
6. How long we keep it
Data is kept while the Advisor's account is active. After an account ends, the Advisor can export their data; we delete it within 30 days of a written request or account closure, and from backups within 90 days.
7. Security
Passwords are stored with salted hashing; access is over HTTPS; each Advisor's data is held in a separate database; repeated wrong passwords lock sign-in for a short time; backups are kept. No system is perfectly secure, and we will inform affected Advisors without undue delay if we learn of a breach affecting their data.
8. Your rights
Under the Digital Personal Data Protection Act, 2023 and other applicable law, individuals can ask to access, correct or erase their data, withdraw consent, and complain. Clients of an Advisor should first contact that Advisor, who controls their data. Advisors and others can write to our grievance officer: Ruchi Verma, ruchiverma330@gmail.com. We will respond within the time the law requires.
9. Children's data
Advisors may record family members who are children (for example a child's date of birth for a savings plan). The Advisor is responsible for having the parent's or guardian's consent. We do not allow tracking or targeted advertising of children.
10. Changes
We may update this policy and will show the new date above.
Contact: Archsoft Consulting