Privacy Policy

1. Introduction

Tundla CRM("we", "our", or "us") operates a CRM application ("the Service") accessible at https://crm.tundla.com. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Service, including information obtained through integrations with Meta platforms (Facebook, WhatsApp, Instagram).

2. Information We Collect

2.1 Information You Provide

• Account registration details (name, email, password)
• Company and business information
• CRM data you enter (contacts, deals, notes)
• WhatsApp Business configuration credentials

2.2 Information from Meta Platforms

When you connect your Facebook account or WhatsApp Business account, we receive:

• Facebook Page names, IDs, and access tokens
• Lead data submitted through Facebook Lead Ads forms (name, email, phone number, and other fields you configure)
• WhatsApp Business Account ID and phone number details
• Your Facebook user ID and display name (for authentication only)

2.3 Automatically Collected Information

• IP addresses (logged for webhook security)
• API request logs (for debugging and rate limiting)

3. How We Use Your Information

We use collected information to:

• Provide and operate the CRM Service
• Receive and store leads from Facebook Lead Ads into your CRM
• Enable WhatsApp Business messaging through the Cloud API
• Send and receive messages on your behalf via WhatsApp Business
• Process and fulfill data deletion requests
• Maintain security, prevent fraud, and debug issues

We do not sell your data or the data of your contacts to third parties. We do not use Facebook lead data for advertising purposes or share it with Meta for retargeting.

4. Facebook Data and Meta Platform Policy

Our use of information received from Meta APIs is governed by the Meta Platform Terms and the Meta Privacy Policy. Specifically:

• Lead data from Facebook Lead Ads is only accessed by the business that owns the CRM account
• Facebook Page access tokens are encrypted at rest using AES-256-GCM
• We request only the minimum permissions required to operate the lead capture features
• We comply with Meta's data deletion requirements — see Section 7 below

5. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Supabase. All API tokens and credentials are encrypted at rest using AES-256-GCM encryption. We use row-level security (RLS) to enforce data access controls.

Despite our security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Contact data (leads) are retained until you explicitly delete them from the CRM. You may request deletion of your data at any time (see Section 7).

7. Data Deletion Requests

If you have used our application via Facebook Login and wish to request deletion of your data, you may do so by:

• Submitting a request through our Data Deletion Request page
• Removing our app from your Facebook settings at facebook.com/settings → Apps and Websites (this triggers an automatic deletion callback to us)

We will process deletion requests within 30 days and send confirmation to your registered email address. You can check the status of your request using the confirmation code provided.

8. Third-Party Services

Our Service integrates with the following third-party platforms:

• Meta / Facebook — Lead Ads, Facebook Login, WhatsApp Business Cloud API
• Supabase — Database and authentication hosting
• Google — Optional Gmail integration for email sending

Each service has its own privacy policy. We are not responsible for the privacy practices of these third-party services.

9. Children's Privacy

Our Service is not directed to individuals under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: