Privacy Policy

1. Overview & Scope

This Privacy Policy explains our practices regarding the collection, processing, transfer, and storage of personal information when you access our Customer Relationship Management platform, voice telephony services, marketing automations, and third-party advertising bridges (collectively, the "Service").

This policy applies to company owners, team members, and administrative operators ("Tenant Users") who hold an account on Daclere CRM, as well as prospective clients and leads ("End Customers") who interact with a tenant workspace via voice call, WhatsApp, SMS, web chat, or ad forms.

2. Categories of Information We Collect

We process information across the following categories:

• Account & Registration Information: Business name, owner name, business email address, phone number, physical address, business category, and encrypted login credentials.
• Customer Relationship Records (CRM Data): Contact names, emails, telephone numbers, pipeline stages, custom tags, appointment times, notes, and deal values entered or imported into your workspace.
• Telephony & Voice Interaction Telemetry: Inbound phone call metadata (caller ID, call duration, timestamp), speech-to-text transcripts, and autonomous tool execution parameters. Audio recordings are retained strictly according to your configured tenant retention window.
• Omnichannel Communication Logs: Incoming and outgoing messages across connected channels (WhatsApp, Instagram Direct, Facebook Messenger, SMS, and Email).
• Technical Device & Session Telemetry: IP addresses, browser user agent, session timestamps, and authentication audit logs for brute-force protection and fraud detection.

3. Use of Meta (Facebook & Instagram) Platform Data & Permissions

Daclere CRM provides verified API bridges connecting your workspace with Meta Marketing API and Meta Graph API v21.0. We strictly disclose the exact scope of each requested Meta permission:

• Meta Lead Generation (leads_retrieval): When prospects submit inquiries on your Facebook or Instagram Lead Ads, Daclere receives form fields (name, email, phone) in real time via secure webhook. This information is used exclusively to populate your internal CRM pipeline and trigger speed-to-lead calling. We never share lead records with external brokers.
• Meta Ads Management & Reporting (ads_management, ads_read): Used to synchronize ad campaign performance (impressions, clicks, spend, leads) into your CRM dashboard. This allows your sales team to measure cost-per-lead and customer acquisition cost directly inside the CRM.
• Conversational Customer Service (pages_messaging, instagram_manage_messages): Enables your unified inbox to display incoming client direct messages and dispatch automated or manual replies from your team.
• WhatsApp Cloud API (whatsapp_business_messaging): Processes 2-way client WhatsApp conversations and appointment reminder alerts.
• Non-Monetization Guarantee: Meta platform data is never combined across tenants, never used for training public machine learning models, and never sold to third parties.

4. Autonomous Voice AI & Speech Processing Disclosures

Our telephony service utilizes ElevenLabs Conversational AI and language model inference (GPT-4o-mini). Audio streams from inbound telephone callers are processed in real-time memory to synthesize spoken responses and execute calendar tools.

Audio streams are processed over encrypted WebSockets (TLS 1.3). Voice models do not use your proprietary business calls for public LLM training. Call transcripts are stored encrypted inside your tenant workspace database.

5. Multi-Tenant Vault Security & Data Isolation

Every database query executed by Daclere CRM is scoped with an enforced tenant_id constraint through our centralized TenantService layer. This architecture ensures complete horizontal isolation:

• No company can view, search, or access another company's leads, contacts, or conversations.
• All sensitive third-party secrets (such as Meta Permanent Access Tokens, Twilio Auth Tokens, Google Ads Refresh Tokens, and SMTP Passwords) are encrypted using authenticated AES-256-GCM encryption with SHA-256 key derivation.
• Session cookies are configured with HttpOnly, Secure, and SameSite=Strict attributes to prevent session hijacking and CSRF vulnerabilities.

6. Subprocessors & Service Providers

Daclere CRM engages trusted infrastructure subprocessors to deliver the platform. Each subprocessor is vetted for SOC-2 Type II, ISO 27001, and GDPR compliance:

• ElevenLabs Inc.: Voice synthesis and conversational agent orchestration.
• Twilio Inc.: Global telephony carrier trunking, phone number routing, and SMS delivery.
• Meta Platforms, Inc.: Facebook Lead Ads, Instagram Messaging, and WhatsApp Cloud APIs.
• Google LLC: Google Ads API, Google Meet video link generation, and Google Calendar sync.
• Hostinger International Ltd.: Dedicated database cluster hosting and transactional system SMTP mailers.

7. Data Retention & Archival Storage

We retain customer data for as long as your company workspace remains active on Daclere CRM. Upon subscription cancellation, account data is held in an encrypted dormant state for 30 calendar days to allow you to request data exports, after which all customer records are permanently scrubbed from active databases.

8. Your Privacy Rights (GDPR & CCPA Compliance)

Depending on your jurisdiction, you possess the following rights regarding personal data:

• Right to Access: You may request a copy of all personal information held in your account.
• Right to Rectification: You may correct or update inaccurate contact records directly in your CRM dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and related customer records.
• Right to Restrict Processing: You may disable specific integrations or automated telephony tools at any time.
• Right to Data Portability: You may export all contacts, deals, and notes into standard CSV format.

9. User Data Deletion Instructions & Status Tracking

If you connected your Meta (Facebook or Instagram) account to Daclere CRM and wish to delete your data:

1. You can request instant data deletion by visiting our User Data Deletion Instructions & Status Page.
2. You can disconnect Daclere CRM from your Facebook profile under Settings & Privacy > Settings > Apps and Websites, which automatically triggers our server-to-server Meta Data Deletion Callback.
3. You can email our Data Protection Officer at sales@daclere.com.

10. Contacting Our Data Protection Officer (DPO)

For privacy inquiries, regulatory compliance requests, or data processing agreements (DPA), contact: