CRM Privacy Notice

1. Scope and roles

This notice applies to authorized users of Avyukta CRM. Avyukta Technologies Inc. provides and operates the CRM software. The organization that authorized your account is the Client and owns its Client Data.

The allocation of privacy responsibilities between Avyukta and the Client depends on the circumstances and any written service agreement. The Client determines what business records its users enter into the CRM; Avyukta uses Client Data to operate, secure, maintain and support the service.

2. Information handled by the CRM

The CRM handles personal information and confidential business information needed for customer, sales, job and billing workflows.

• Account information: name, business email, account status, organization membership, role and permissions.
• Business contact information: customer and supplier names, job titles, departments, business email addresses, telephone numbers, extensions and business addresses.
• CRM records: customer profiles, notes, tags, activities, quotations, RFQ details, work orders, job scopes, schedules and completion records.
• Commercial records: supplier pricing, purchase orders, invoices, payment-status information, taxes, credit terms and related calculations.
• Uploaded content: organization and customer logos, quotation materials, supplier quotations, purchase-order files, invoice files and work-completion documents.
• Audit and security information: record revisions, status histories, creator/updater identifiers, timestamps, authentication events, request logs and essential session-cookie data.

3. Data that must not be entered

Avyukta CRM is not intended for payment-card numbers, social insurance numbers, health or medical information, biometric information, information about children, government identity documents, account passwords placed in free-text fields, or other highly sensitive personal information. Users must not upload or enter those categories.

4. Purposes

• Authenticate users and enforce organization, role and record access.
• Provide customer, quotation, job, document, employee, calendar and invoice workflows requested by the Client.
• Maintain records, generate business documents and support authorized exports.
• Protect the service, investigate errors or misuse, maintain auditability and recover from incidents.
• Provide support, respond to privacy requests and meet legal or contractual obligations.

5. Canadian privacy framework

The privacy program for this commercial pilot is designed around the fair-information principles in Canada's Personal Information Protection and Electronic Documents Act (PIPEDA): accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, access and challenging compliance.

This statement describes the framework used for the pilot; it is not a certification and does not replace case-specific legal advice. Other laws may apply depending on the Client, the individuals and where information is handled.

6. Service providers and disclosure

Avyukta does not sell Client Data and does not use Client Data for third-party advertising. Client Data is disclosed to service providers only as needed to host, authenticate, store, transmit, secure and support the CRM, or when required by law. Current providers are listed in the Subprocessors Notice.

7. Cross-border processing

Canada-only data residency is not promised. The configured production Supabase region must be disclosed as: us-west-2 (United States). Vercel, Supabase, Resend and their providers may process service data in other jurisdictions. Information processed outside Canada may be subject to the laws and lawful-access regimes of those jurisdictions.

8. Retention and deletion

• Client Data: Client Data is retained while the Client CRM account remains active and only as needed to provide, secure and support the service. Data created during the pilot continues into Production when the Client continues using the service. If the service ends, Client Data will be returned, exported or deleted according to the Client's authorized instructions and the applicable written agreement, except where longer retention is required by law or needed to establish, exercise or defend legal claims.
• Database and Storage backups: Avyukta currently operates Production using Supabase Pro. Supabase Pro provides daily database backups with access to the previous 7 days. Point-in-Time Recovery is not represented unless separately enabled. Supabase database backups cover PostgreSQL data and Storage metadata but do not include the actual files stored through the Supabase Storage API. Clients are advised to regularly download and retain copies of important PDFs and other documents uploaded to or generated by the CRM on systems they control. Backup periods and capabilities may change if the provider plan or configuration changes.
• Application, authentication and security logs: Avyukta currently operates the application on Vercel Pro and the database on Supabase Pro. Vercel Pro runtime logs are available for 1 day, and Supabase Pro logs are available for 7 days. Vercel and Supabase maintain platform security, encryption, access-control, monitoring and compliance safeguards, while Avyukta applies application-level authorization and security controls under a shared-responsibility model. No safeguard eliminates all risk, and retention periods may change if provider plans or configurations change.
• Transactional email data handled through Resend: Resend retains email and log data for 30 days while the account is active on Free, Pro and Scale plans, and its backups persist for 7 days. When the account is terminated, Resend states that remaining user and customer data is deleted within 90 days, subject to its agreement and applicable law.
• Versioned legal-acceptance records are retained as evidence of the agreement or acknowledgment and cannot be edited by users.

9. Safeguards

The CRM uses organization-scoped authorization, database row-level security, private Storage access, server-side secret handling, password authentication managed by Supabase Auth, audit/history records and HTTPS delivery. No safeguard eliminates all risk. Security controls and incident reporting are described on the Security page.

10. Access, correction and questions

Users should first contact their Client administrator to access or correct CRM business records. Individuals may also ask questions, challenge compliance or request access/correction by contacting the Privacy Officer. Requests may require identity and authority verification and may be subject to legal or contractual limits.

11. Contact the Privacy Officer

Privacy inquiries: hardik@avyukta.ca

12. Changes to this notice

Material changes will receive a new version. Authorized users will be asked to acknowledge the new version before continuing to protected CRM areas.