Book a Demo

Privacy

Privacy Policy

Last updated:
22 October 2026
Effective date:
This version takes effect when published.

This policy explains how AGENCRM handles personal information through its website, business enquiries and CRM and AI automation services. Features and connected channels depend on the service configured for each business.

1. Who operates AGENCRM

AGENCRM is operated by Ahmad Abdul Ghaffar, based in Pakistan.

For privacy questions and requests, contact info@agencrm.co. Privacy requests are handled by the owner.

2. Our role and the role of businesses using AGENCRM

For our own website enquiries, account administration, support and service-security activities, AGENCRM determines how the relevant information is used.

When a business uses AGENCRM to manage its customers, that business generally determines why customer information is collected and how its customer relationships are managed. AGENCRM processes that information to provide the configured service on the business's instructions, subject to applicable law and our service arrangements.

If you contact a business using AGENCRM, its own privacy notice also applies. That business is responsible for appropriate customer notices, permissions and communication preferences. If AGENCRM itself is the business you contact, please direct requests to us.

3. Information we handle

Depending on how you interact with us and which features a business enables, information may include:

  • Website enquiries: name, work email, company or organisation, optional phone number, enquiry type, industry, workflow interests and messages.
  • Business and staff accounts: names, email addresses, workspace details, roles, access permissions, password-verification records and session information.
  • Customer and CRM records: names and contact details supplied in an enquiry, customer requirements, conversations, lead records, support tickets, notes and human handoffs.
  • WhatsApp information: customer phone numbers or WhatsApp identifiers, display names when supplied by the service, message content, message identifiers, timestamps, delivery or read-status notifications, and relevant business-account, phone-number and template information.
  • Media and business knowledge: voice notes, images, documents, transcripts, extracted content, catalogue information and knowledge records where the relevant features are enabled.
  • Technical and security information: IP addresses, browser or device details, request paths and times, authentication and audit events, error codes, anti-abuse records and service-usage measurements.
  • Integration credentials: authorisation tokens and configuration needed to operate a business's connected account. These are operational credentials, not information made available to other customers.

Please do not include passwords, API keys, full payment-card details, identity documents, patient information or other sensitive information in ordinary website enquiries. Do not upload information you are not authorised to share.

4. How information is collected and used

We receive information directly from website visitors, account holders and businesses, and through connected services such as WhatsApp when an interaction occurs.

We use information as needed to:

  • Respond to enquiries, arrange demonstrations and provide support.
  • Create and administer workspaces, staff access and configured integrations.
  • Receive and organise customer conversations and relevant media.
  • Retrieve the business information needed to prepare an answer.
  • Provide AI-assisted replies, transcription or image understanding where enabled.
  • Maintain leads, support records and human handoffs.
  • Record message delivery, communication preferences, usage and audit evidence.
  • Prevent abuse, troubleshoot faults, protect accounts and maintain service reliability.
  • Meet applicable legal obligations and handle authorised privacy requests.

An enquiry does not automatically subscribe you to advertising or marketing messages. A business using AGENCRM is responsible for obtaining any permission required for its communications and honouring applicable opt-out requests. Publishing this policy is not itself consent to receive marketing.

5. Website enquiries

The Contact and Demo forms send enquiries to AGENCRM through our website form service and Hostinger email service. The visitor's email address is used as the Reply-To address; it is not used as our sender address.

Received enquiries are held in our receiving mailbox. The website enquiry flow is separate from the CRM application; submitting a form does not itself establish that your information has been added to a CRM workspace.

The forms use field validation, rate limiting, a spam-trap field and Cloudflare Turnstile. Anti-abuse records are separate from enquiry content. The rate limiter uses pseudonymised identifiers derived from an IP address and attempt timestamps rather than saving the enquiry message in those records.

Hostinger may separately maintain website access, email and PHP error logs. We have not established a single customer-controlled retention period for all provider-managed logs.

6. WhatsApp and AI processing

When a business connects its WhatsApp account, relevant messages and events pass between Meta/WhatsApp and the configured AGENCRM service. Authorised staff of that business can access records permitted by their roles.

Where AI processing is enabled, relevant message content, a bounded portion of conversation history, applicable business knowledge and supported media or extracted content may be sent to OpenAI to produce the requested result. Information is not confined to our VPS during that processing.

AI output can be inaccurate or incomplete. Human review and escalation remain important, particularly for sensitive matters and decisions with significant consequences. AGENCRM is not intended to give an AI assistant independent authority to approve refunds, payments, finance eligibility or other consequential actions merely because text was uploaded to a knowledge base.

Our use of the OpenAI API is governed by the applicable service arrangements and data controls. OpenAI may process and retain information under those arrangements. We do not represent that every request is subject to zero data retention. Further information is available in OpenAI's API data controls.

7. Service providers and other disclosures

We disclose information where necessary to operate the configured service, including to:

  • Hostinger: website and CRM hosting, email delivery and related infrastructure.
  • Meta/WhatsApp: WhatsApp account connections, messaging, media, templates and delivery events.
  • OpenAI: enabled AI generation, transcription and image-processing tasks.
  • Cloudflare: Turnstile anti-abuse checks on the marketing website.

A business's authorised staff receive access to their workspace as configured. Other integrations, if added to an implementation, require an appropriate description of their data handling.

We may also disclose information when required by law or when reasonably necessary to investigate abuse, protect rights or address a security incident. We do not sell personal information.

Provider information:

8. Where information is processed

Our current CRM VPS is hosted by Hostinger in Vilnius, Lithuania. AGENCRM's operator and current authorised operational personnel access the service from Pakistan.

This does not mean every copy or every processing activity remains in Lithuania or Pakistan. Website hosting, email, Meta/WhatsApp, OpenAI, Cloudflare and recovery services may involve other countries under their applicable arrangements.

International processing must be considered for each business implementation. Do not use the service for data requiring a particular residency arrangement unless that arrangement has been specifically confirmed.

9. Cookies and browser storage

The CRM uses necessary session cookies and security controls for sign-in and account protection. Website and infrastructure security services, including Turnstile, may process technical browser or device signals.

Submitting an enquiry does not enrol you into advertising campaigns. Necessary sign-in, security and anti-abuse technologies are different from advertising cookies. Third-party security services may make external requests and process browser or device signals as described in their privacy information.

You can manage browser storage through your browser settings. Blocking necessary cookies may prevent sign-in or other essential features from working.

10. Retention and backups

We consider the purpose for which information was collected, whether an account or business relationship remains active, customer instructions, security needs and applicable legal obligations when determining retention.

Website enquiries: we retain enquiry information for up to 12 months from receipt, unless the relevant information is needed for an active business relationship, security investigation or legal obligation. The owner manages retention reviews and deletion of expired enquiries from mailboxes and other copies we control. Any exception is reviewed separately. Recovery copies and provider-managed backups have separate retention arrangements, as explained below.

CRM records: the website's 12-month enquiry period does not apply automatically to CRM conversations, customer records or business knowledge. Those records may remain while needed for the configured service and are subject to the applicable authorised deletion process. Archived content and import history are not necessarily erased when removed from the assistant's active knowledge.

Media, exports and operational records: these have separate technical retention settings and deletion eligibility rules. Deleting an original media file may not delete transcripts, extracted text, conversation records or information already included in a backup. A workspace deletion cooling period is a delay in a particular deletion workflow, not a general expiry period for all information.

Backups: encrypted, access-controlled recovery copies are maintained separately from live information to support service recovery. Backup retention is assessed separately, taking account of recovery needs, the availability of newer usable copies, the age and sensitivity of the information, verified deletion requests, and applicable security or legal requirements. Deleting a live record does not necessarily remove every older copy immediately. When you request deletion, we assess the copies under our control and explain any continuing retention and the applicable deletion arrangements. Hosting and email providers may retain separate backup copies under their own arrangements. Contact us for information about the copies relevant to your request.

Where information must be retained for a legal obligation or a specific security investigation, retention should be limited to the relevant information and reason. Contact us for information about a particular record or service.

11. Access, correction and deletion requests

Contact info@agencrm.co to ask about access to, correction of or deletion of information handled by AGENCRM.

If you are a customer of a business using AGENCRM, contact that business first where possible. It controls the relevant customer relationship. If you contact us, identify the business so the request can be directed appropriately without exposing another workspace's information.

For an AGENCRM or connected Meta/WhatsApp data-deletion request:

  1. Email info@agencrm.co with the subject Data deletion request.
  2. Identify the workspace or business and the contact details associated with the records.
  3. Describe whether you want a specific conversation, customer record, connected-account information or a workspace reviewed for deletion.
  4. Do not send passwords, API tokens or identity documents with the initial request.

We may need proportionate information to verify the request and the requester's authority. Requests are assessed under applicable law, the relevant business's instructions and any retention obligations. We will explain applicable exceptions or further steps.

Disconnecting an integration or deleting a WhatsApp message on a phone does not necessarily erase CRM records or backups. Requests concerning information held independently by Meta, OpenAI or another provider may also need to follow that provider's process.

12. Security and authorised access

Safeguards used in our CRM deployment include HTTPS, restricted administrative access, role-based workspace permissions, database tenant-isolation controls, password hashing, encrypted integration credentials and encrypted recovery copies. Security and audit records support investigation and accountability.

These safeguards reduce risk but do not eliminate it. No online service can guarantee absolute security.

13. Children and sensitive information

The service is intended for business use and is not directed at children. Businesses must ensure that their proposed use, notices and permissions are appropriate for the people and information involved.

Ordinary website forms and a standard CRM configuration should not be treated as a specialised medical, financial or other regulated information system. Any such implementation requires a separately reviewed scope and appropriate safeguards.

14. Changes and contact

We may update this policy when services, providers or data practices change. The effective and last-updated dates identify the published version.

For privacy questions, concerns or requests, contact:

Ahmad Abdul Ghaffar — AGENCRM
Pakistan
Email: info@agencrm.co