Privacy Policy

This Privacy Policy explains how Sartthi ("Sartthi", "Company", "we", "our", or "us"), headquartered in Ahilyanagar (Ahmednagar), Maharashtra, India, collects, uses, processes, stores, and protects personal data when you visit our primary website (sartthi.com), access our software-as-a-service portals (sartthicrm.com), or engage our custom engineering wing (TechSartthi).

Our ecosystem operates two distinct business branches, each with tailored operational workflows:

• SartthiCRM: Pre-built, domain-tailored software platforms designed specifically for Indian enterprises — including IT Sales & Support agencies, Chartered Accountant (CA) & tax practice firms, and Retail & Distribution merchants.
• TechSartthi: A specialized engineering practice designing and shipping custom web systems, mobile applications, IoT firmware integrations, and artificial intelligence architectures for high-growth enterprises.

We collect personal information that you voluntarily submit to us across our forms, consultation bookings, product demonstrations, and customer support channels.

A. Contact & Growth Scaling Inquiries

When you request a product walkthrough or engineering estimate via our contact form, we collect:

• Full Name: To identify and address you appropriately.
• Email Address: To deliver requested project documentation, demo links, and software configuration credentials.
• Service Interest Category: Categorization identifying whether you require SartthiCRM (IT Sales, CA Practice, or Retail) or TechSartthi bespoke engineering.
• Message & Project Description: Custom project requirements, team size indicators, or workflow bottlenecks you detail in your submission.

B. Direct Telephonic & WhatsApp Interactions

If you reach out to our team via phone support (+91 7083373681) or through our official WhatsApp Business channels, we maintain records of your phone number, message timestamps, consultation notes, and any follow-up requests you explicitly authorize.

To maintain high security, safeguard our servers from distributed denial-of-service (DDoS) threats, and prevent form submission spam, our front-end infrastructure collects specific device-level telemetry.

SartthiCRM provides pre-built operating modules tailored to specific Indian business sectors. In operating these modules, business subscribers import and process domain-specific operational data:

1. IT Sales & Support CRM

• Pipeline & Deal Tracking: Lead contact details, opportunity values, expected closing milestones, and sales stage movements.
• Service Level Agreements (SLA) & Helpdesk: Support ticket histories, issue tags, customer response reaction times, and automated SLA alarm triggers.
• WhatsApp Messaging Sync: Transmission of pre-approved billing and renewal templates via official WhatsApp Business APIs.
• Automated Call Sync Logs: Timestamps, duration, and phone identifiers for outgoing client support calls initiated through integrated mobile dialers.

2. CA Practice Manager CRM

• Compliance Calendar Records: Indian GST return deadlines (GSTR-1, GSTR-3B, GSTR-9), TDS quarterly filing dates, and Income Tax Return (ITR) audit schedules.
• Secure Client Document Vaults: Audit reports, balance sheets, incorporation documents, digital signatures (DSC logs), and tax notices uploaded into encrypted, isolated per-client directories.
• Task Allocations: Partner and article-trainee assignments, time logs, and billing slips.

3. Retail & Distribution CRM

• Inventory & Stock Ledgers: Stock balances, warehouse SKUs, distributor supplier accounts, and automatic low-inventory alert thresholds.
• GST Invoicing Records: Customer billing slips, state GST (SGST), central GST (CGST), integrated GST (IGST) calculations, and print-ready invoice registers.
• Loyalty & Customer Loyalty Rules: Point accruals, redemption logs, and seasonal promotional campaign records.

For enterprises engaging TechSartthi for bespoke web, mobile, IoT, or AI development, we operate under strict mutual Non-Disclosure Agreements (NDAs).

• Project Schematics & Requirements: Architectural diagrams, database schemas, and Figma interface designs shared during discovery and prototyping phases.
• Source Code & Repositories: Codebases developed or accessed on GitHub, GitLab, or AWS CodeCommit remain confidential.
• Credentials & Staging Environments: API keys, third-party token secrets, and database connection strings supplied for staging deployments are managed through encrypted secret vaults and deleted following project handover.

Under Section 4 and Section 6 of the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) and international standards, we process your information exclusively under the following lawful grounds:

• Performance of a Contract: Creating your workspace database, provisioning team user seats, executing agreed project deliverables, and generating invoices.
• Explicit Consent: Provided when submitting contact forms, requesting demo callbacks, or opting into WhatsApp notification alerts. You may withdraw consent at any time.
• Compliance with Legal Obligations: Retaining financial transaction records, tax invoices, and audit trails required under the Central Goods and Services Tax (CGST) Act, 2017, and the Companies Act.
• Legitimate Uses & Security: Protecting our systems against cyber-attacks, enforcing admin device authorizations, and debugging server errors.

Sartthi maintains an uncompromising policy: we do not sell, rent, or trade your personal information. Information is shared strictly with trusted sub-processors necessary to operate our infrastructure:

• Cloud Infrastructure Providers: Highly secure cloud database and virtual compute instances (e.g., Amazon Web Services) adhering to ISO/IEC 27001 and SOC 2 security compliance.
• WhatsApp Messaging Partners: Meta / Interakt official business APIs utilized solely to transmit transactional notifications and license renewal alerts authorized by you.
• Law Enforcement & Statutory Demands: We disclose data only if required by a valid, binding judicial order issued by an authorized Indian court or law enforcement agency having proper jurisdiction.

In compliance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Sartthi implements robust multi-tier defenses:

• Encryption in Transit: All web traffic is strictly routed through Transport Layer Security (TLS 1.3 / HTTPS) with modern cipher suites.
• Encryption at Rest: Database records and uploaded client vault files are encrypted using industry-standard AES-256 bit algorithms.
• Hardware-Bound Device Approval: Administrative console access is restricted to approved hardware Device IDs (allowed_devices) registered in our database, safeguarding management endpoints from credential stuffing.
• Active Penetration Testing: Our internal cybersecurity and penetration testing specialists regularly audit software endpoints for OWASP vulnerabilities, authorization bypasses, and SQL/NoSQL injection risks.
• Role-Based Access Control (RBAC): Employee access to production infrastructure is governed by least-privilege principles and multi-factor authentication (MFA).

We retain personal and business information only for the minimum period required to fulfill the purposes set out in this Privacy Policy:

• Inquiry Records: General contact form inquiries are retained for active follow-up for a maximum of twelve (12) months, after which unengaged leads are securely purged.
• Active CRM Subscriptions: Workspace data is maintained throughout your active subscription term. Upon contract termination or non-renewal, Sartthi provides a 30-day grace period for the client to export all customer records, documents, and invoices. Following this window, workspace data is permanently overwritten.
• Statutory Accounting Logs: Invoices, tax records, and payment logs are retained for seven (7) years in compliance with Indian tax legislation.

Under the Digital Personal Data Protection Act, 2023, you enjoy statutory rights regarding your personal data:

• Right to Access & Summary: You may request confirmation on whether we process your personal data and obtain a summary of data categories and processing activities.
• Right to Correction & Updation: You may request the rectification of inaccurate or outdated personal details.
• Right to Erasure: You may request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected, subject to statutory retention requirements.
• Right to Withdraw Consent: Where processing is predicated on consent, you may withdraw your consent at any time by emailing our support desk.
• Right of Grievance Redressal: You have the right to register a grievance with our designated Grievance Officer and receive a prompt resolution.

Sartthi does not utilize third-party advertising cookies or cross-site tracking pixels. We rely on lightweight, functional browser storage:

• sartthi_device_id: Stored in HTML5 localStorage to generate a persistent visitor reference for rate-limiting contact inquiries and preventing automated bot flooding.
• sartthi_admin_token & sartthi_admin_user: Used strictly in the administrative portal to authenticate approved management sessions via signed JSON Web Tokens (JWT).

You can clear your browser's local storage and cookies at any time through your browser preferences. Note that clearing storage will regenerate a new anonymous Device ID on your subsequent visit.

In compliance with Rule 5(9) of the Information Technology Rules, 2011, and the Digital Personal Data Protection Act, 2023, Sartthi has designated a Grievance Redressal Officer to address any privacy inquiries, data requests, or complaints: