What SheetCRM collects, why, how long it is kept and how to get it back or have it erased.
SheetCRM is customer relationship management software operated by Dev Group, H N-4213, Gali Shahtara, Ajmeri Gate, Delhi-110006. Dev Group is the business that provides the service and bills for it; SheetCRM is the trading name it is sold under.
Questions about this policy, or about your own personal data, go to hello@dg2.in. We answer within 30 days, and within 72 hours where a request is urgent.
SheetCRM holds two very different kinds of data, and the law treats them differently.
If you are an individual whose details are inside somebody else's workspace — a lead they are following up, for example — please contact that business first. We cannot see into a workspace to change or delete its records on your behalf, though we will pass a request on if you write to us and tell us which business it concerns.
Account data. Your name, work email, password (stored only as a one-way hash), email verification state, workspace memberships and role, and the date you accepted these documents.
Workspace data. The records, field definitions, activities, tasks, pipeline stages, invitations, integrations and settings that you and your team create. This is your data, not ours.
Billing data. Plan, billing cycle, invoice number, GSTIN and billing address you give us, and the identifiers Razorpay returns for a payment. We never receive or store your card number, CVV or UPI PIN — those are entered on Razorpay's own checkout.
Technical and security data. IP address, browser and device type, and a log of sign-ins, failed sign-in attempts and administrative changes. This is what lets us stop credential stuffing and answer "who deleted that record?".
Notifications. Which reports and reminders you have switched on, and whether your browser has allowed notifications — a permission your browser holds, not us.
We process personal data only for the purposes below. Under the DPDP Act we rely on your consent, given when you create an account and when you switch an optional feature on, and on the limited legitimate uses that Act allows (such as security and legal compliance). Under the GDPR we rely on performance of a contract, our legitimate interest in running a secure service, and legal obligation.
We do not sell personal data, do not use workspace records to train models, and do not run third-party advertising or cross-site tracking on the app.
SheetCRM uses only what it needs to work:
No advertising, analytics, fingerprinting or social-media cookies are set by the app.
Workspace data is visible to the people your business has added to that workspace, subject to the role you gave them. Workspaces are isolated from each other: a member of one workspace cannot read another workspace's records, and we do not pool data across customers.
A short list of service providers process data on our behalf — for hosting, payments, email delivery and DNS. Each is bound by contract to use it only for the service we bought, and the current list is published on the sub-processors page.
We may also disclose data where the law compels it — a valid court order or a lawful request from an authority — and, where we are allowed to, we will tell you first. We do not hand over workspace data in response to an informal request.
Workspace data lives in the MySQL database of the WordPress installation that serves your SheetCRM app, on the server your provider operates. For most customers that server is in India.
Some providers above are global: a payment or an email may be processed outside India (Razorpay is India-based; Google and Cloudflare operate worldwide). Where personal data leaves India or the EEA/UK we rely on the transfer mechanism that provider offers — standard contractual clauses, an adequacy decision, or the DPDP Act's permitted transfers — and we will tell you which applies if you ask.
No system is perfect. If we become aware of a breach affecting your personal data we will notify you without undue delay — within 72 hours of becoming aware where the GDPR applies — and report it to the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India as required.
Under the DPDP Act you may access a summary of the personal data we hold about you, ask for it to be corrected or erased, nominate someone to exercise your rights if you die or become incapacitated, and complain to the Data Protection Board of India. Under the GDPR you additionally have the right to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time without affecting what was done before.
Two of these are self-service, so you do not have to wait for us:
For anything else — correction of account details, a copy of your own account record, withdrawal of consent, or a request about a workspace you no longer have access to — write to hello@dg2.in. We may ask you to prove you control the email address on the account before acting.
Withdrawing consent for something optional (report emails, browser notifications) stops that processing; withdrawing consent for the essentials means closing the account, because we cannot run a signed-in CRM without an identified account holder.
Sign-in links, verification, password resets, invitations, report summaries and reminders are service messages, sent because you or your workspace asked for them. Report emails and overdue-reminder emails are switched on by default for a workspace and can be turned off in Settings → Workspace profile by an owner or admin.
We do not run marketing campaigns to workspace members. If we ever write to you about the product, it will be to the address that pays for the workspace, it will be occasional, and every message will have a one-click opt-out.
SheetCRM is business software. It is not intended for anyone under 18, and we do not knowingly collect a child's data. If you believe a child's details have been entered into a workspace, tell the business that owns the workspace, and tell us as well if they do not act.
Dev Group has appointed the following grievance officer, as the DPDP Act and the Indian IT (Intermediary Guidelines) Rules require:
Grievance Officer
Dev Group
H N-4213, Gali Shahtara, Ajmeri Gate, Delhi-110006
Email: hello@dg2.in
We acknowledge a complaint within 24 hours and resolve it within 15 days. If you are not satisfied with our answer you may complain to the Data Protection Board of India; if you are in the EU or UK you may complain to your national supervisory authority. Nothing here limits your right to go to a regulator.
This policy carries a version and an effective date. We bump the version when the substance changes, tell workspace owners by email before the change takes effect, and keep the previous versions available on request. Fixing a typo does not bump the version.