Last updated 21 October 2026

This policy explains how Anibros Design ("we", "us") handles personal data when you visit this website or use Anibros CRM (the "service"). It is written to be read. If something is unclear, ask us through the contact page.

1. Two roles: your account, and your leads

For your account (your name, e-mail, sign-in details, billing), we decide why and how the data is used. We are the controller (in Indian law, the data fiduciary).

For the leads and contacts you put into the CRM (the people who enquire with you or your clients), you or your client decide why and how that data is used, and we process it on your behalf and on your instructions. We are the processor. You are responsible for having a lawful basis, and any consent you need, to hold and contact those people. The CRM helps with this: it records consent and opt-outs per person and channel, and it will not send e-mail or WhatsApp to someone who has opted out.

2. What we collect

Account data: your name, e-mail address, password (kept only as a salted hash), phone number if you add one, time zone and language, and the names of your agency and clients.
Content you add or import: leads, contacts, notes, call and message logs, tasks, properties and files, and what your lead sources send us (for example a Meta or website form submission).
Billing data: your plan, invoices, and the references Razorpay gives us for payments. We do not receive or store card numbers.
Security and operations data: IP address, browser type, sign-in and session records, request identifiers, and error and activity logs.
Messages to us: what you write in the contact form or in an e-mail to us.

3. Cookies

This website sets no cookies and has no advertising or analytics trackers. When you sign in to the CRM we set two cookies that it cannot work without: a session cookie (HttpOnly, to keep you signed in) and a security cookie that protects against cross-site forgery. We do not use them for anything else.

4. How we use data

To provide the service: show you your data, assign and remind, send the messages and e-mails you ask us to send, and process the leads your sources deliver.
To run billing: start and renew subscriptions, issue invoice numbers, and tell you about your plan, trial and payments.
To keep the service safe: detect abuse, investigate errors, and keep an audit trail.
To answer you, and to send service notices (for example, a trial that is about to end). We do not send marketing e-mail to people who have not asked for it.

We do not sell personal data and we do not use your leads' data for our own marketing or to train models.

5. Who we share data with

Razorpay, to take payments. Their handling of your payment details is described in their own privacy policy.
Our hosting provider, which runs the servers the service and its database live on.
Services you connect, such as Meta, Google and WhatsApp Business, only as you instruct (for example to receive your ad leads or to send a message you wrote).
Authorities, when the law requires it and after checking that the request is valid.

E-mail from the service is sent through our own mail server. Within your agency, people see only what their role and client assignments allow.

6. How long we keep data

Your account and workspace data: while your account exists. If a subscription ends, your workspace stays readable and exportable. Ask us to delete it and we will.
Operational and activity logs: 90 days. Finished background jobs: 30 days. Expired sessions: 30 days.
Invoices and payment records: as long as the law requires us to keep accounting records.
Contact-form messages: up to two years.
Backups of the database may hold deleted data for a short period before they are overwritten.

7. Security

Each client's data is separated in the database; secrets we hold for you are encrypted; sign-in supports two-factor codes; and we keep audit trails. The security page describes this in more detail, including what we do not claim. No system is perfectly secure; if we learn of a breach that affects you, we will tell you without undue delay.

8. Where data is stored

Data is stored on servers operated by our hosting provider. If you need to know the region for your own compliance, ask us through the contact page and we will tell you.

9. Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, or stop using it for a purpose, and you can withdraw consent you gave us. Most of this you can do yourself: export your data from the CRM, edit your profile, and end your sessions. For anything else, write to us through the contact page. We will answer within a reasonable time and in any case within the time the applicable law allows (including the Digital Personal Data Protection Act, 2023 and, where it applies to you, the GDPR). If you are unhappy with our answer you may complain to the relevant data protection authority.

If you are one of the people whose details a customer of ours holds in the CRM, please contact that customer first: they decide what is done with your data, and we will help them act on your request.

10. Children

The service is for businesses. It is not directed at children and we do not knowingly collect their data.

11. Changes

If we change this policy in a way that matters, we will tell account owners by e-mail before it takes effect. The date at the top shows the latest version.

12. Contact

Anibros Design. Write to us through the contact page. Include your agency name so we can find your account.

Privacy policy