1. Scope and roles
TDO CRM is a business platform for company administrators and their authorized team members, not a service intended for children. Companies use it to manage leads, calling, tasks, sharing, reporting, and subscriptions. A company decides which staff may use its workspace and which business information they enter. TDO CRM operates the website, mobile app, APIs, and supporting records. This policy covers visitors, company administrators, employees or agents, and people whose details are entered as leads or contacts.
Company administrators and authorized platform personnel can manage access and view information according to their roles. An individual whose details a company entered should usually contact that company first about its business records; they can also contact TDO CRM using the address below.
2. Information handled
- Accounts and teams: names, email addresses, phone numbers, company and role assignments, permissions, manager or team leader relationships, login and account status, and reported Android app version.
- Business records: lead and customer names, phone numbers, company details, source, status, assignment, notes, follow-ups, tasks, comments, work reports, uploaded task or shared-content files, and WhatsApp sharing records when those features are used.
- Calling and work activity: call numbers, direction and result, start and end times, dial and talk duration, missed-call status, disconnect reason, available SIM label, app session and sync events, and reports derived from these records.
- Billing: company billing profile, contact and address fields entered for invoices, tax details such as GSTIN if provided, seat counts, coupons, payment tickets, amounts, payment method and reference, payment status, and invoice history. Full card details are not entered into the CRM payment-reference form.
- Technical and support information: essential session cookies, optional remembered-login tokens, API authentication identifiers, IP address, browser or app events, audit and security logs, push subscription information where enabled, and support messages you send us.
3. Android calls, consent, and offline sync
If TDO CRM is chosen as the device's default phone app, it can record calls handled by that app, including personal calls on the same device. CRM call records can include the other number and timing and status details described above. Managers and other authorized company users may see synced activity and reports. Companies should tell staff how work-device and personal-call reporting will be used.
The Android app presents an account-specific disclosure before authenticated CRM syncing is enabled in builds that support it. Selecting “Not now” leaves CRM uploads disabled. With consent and an authenticated account, the app may queue events while offline and upload them when connectivity returns, including earlier locally saved call events. Logging out stops new authenticated uploads. Removing a device permission or changing the default phone app changes what the app can access; it does not by itself delete records already uploaded to the company workspace.
4. Android permissions
- Phone and call services: place calls, show and manage the in-call experience, observe call state, and keep call events synchronized when the app is the default phone app.
- Contacts: look up and match saved names or numbers for calling and CRM history when granted.
- Notifications and background operation: show calls, reminders, and task updates, and run the phone and synchronization services supported by Android.
- Network: authenticate and exchange CRM records over the internet.
- Audio or media files: browse or select existing audio locally for ringtone features. The current app does not request microphone access or record call audio through this feature.
Android controls optional permissions. Some calling, contacts, notification, or sync features may be unavailable when the corresponding access is withheld.
5. How information is used
Information is used to provide account access and company administration; manage leads, calls, tasks, assignments, and sharing; calculate activity and performance reports; detect duplicates; run trials, seat limits, payment review, and invoicing; deliver enabled notifications; and investigate support, security, misuse, or technical issues. We do not describe CRM records as advertising data.
7. Storage and security
CRM data is stored in the service's server-side database and, for offline mobile operation, relevant records may remain on the device until synchronization or removal. The app protects sensitive local preferences with Android Keystore-backed encryption and disables Android backup. The service uses hashed passwords, sessions, access controls, mobile tokens, audit records, and HTTPS on the configured public domain. These measures reduce risk but cannot guarantee absolute security.
8. Retention
Leads, calls, tasks, reports, billing records, and audit information remain while needed for the company workspace, service operation, payment history, security, or applicable legal obligations. Deactivation or soft deletion does not necessarily remove underlying records. Authorized administrators have separate permanent-deletion functions for eligible users or companies. An automatic, fixed retention schedule for all categories is not currently configured; exact periods and backup deletion timing require confirmation.
9. Correction, access, and deletion requests
To request correction, access, account deactivation, or deletion, contact your company administrator or email support@tdocrm.com. Identify the account or company and the records involved without sending passwords or unnecessary personal data. We may verify the request and coordinate with the company that controls its workspace. Eligible information can be corrected or deleted using the available administrative controls, subject to other users' records, billing and audit history, legal requirements, and technical backup limits. A request is not an automatic deletion of all company data.
10. Choices and applicable rights
Users can manage Android permissions and notification settings, decide whether to enable the disclosed mobile sync, and ask their company administrator to change account access. Depending on the law in force and the context of processing, individuals may have rights to notice, access to information, correction, erasure, grievance redressal, and withdrawal of consent. Withdrawal may limit the related feature and does not undo processing already carried out. Requests can be sent to the contact below. The Digital Personal Data Protection Act, 2023 and its rules have staged commencement; rights and procedures apply as their relevant provisions come into force.
11. Contact and policy changes
For privacy questions or requests, contact your company administrator or support@tdocrm.com. This policy may be updated when the service or applicable requirements change; the date above identifies this version.
Read the Terms of Service for account and billing conditions.