Privacy Policy

MindTech CRM ("the Platform", "we", "us") is operated by Junadev (Private) Limited, trading as Juna Dev, a company limited by shares incorporated in Pakistan under the Companies Act 2017 (SECP corporate unique identification number 0279495, National Tax Number F803530-1), registered at Plot No 1939/55 VII, Baghdad-ul-Jadid Road, Anwarabad Colony, Bahawalpur, Punjab, Pakistan.

The Platform is a customer relationship management service. Businesses use it to manage leads and customers, run conversations across their website, email, WhatsApp, Facebook and Instagram, take bookings, send campaigns, build websites and automate follow-ups, with help from AI assistants that answer on their behalf.

Two kinds of people appear in this policy, and our responsibilities differ for each.

• Business users are the people who sign up for an account, their staff, and agencies who manage accounts for their clients. For their account data we are the data controller.
• Customers and visitors are the people a business talks to through the Platform: someone who writes to a business's website chat, calls its voice assistant, fills in a form, emails it, or books a meeting. For that data the business is the controller and we are its processor. We handle it on the business's instructions and under our agreement with the business.

If you are a customer or visitor and want to know how a particular business uses your information, contact that business. We will help either of you with any request that reaches us.

From business users: name, email address, password (stored hashed), company details, billing details handled by our payment processor, the settings you choose, and records of what you do in the Platform.

About customers and visitors, on a business's behalf:

• Contact details a person gives a business: name, email address, phone number, and the answers to any questions the business adds to its forms and chat widget.
• The contents of conversations: website chat messages, emails, WhatsApp, Facebook and Instagram messages, voice call transcripts, notes and files exchanged.
• Booking details: the time chosen, the attendee's name and email, and the meeting's outcome.
• Technical details needed to run a website chat or voice widget: a random visitor identifier stored in the visitor's browser, IP address, browser type and the page the widget sits on.
• Website analytics for sites built or tracked on the Platform: page views, referrers and conversions, aggregated per site.

We do not buy personal data. Where a business chooses to use prospect discovery, it searches public business listings and third-party databases it has licensed itself.

• To provide the service: routing conversations, storing leads and customers, sending messages the business asks us to send, taking bookings, running the automations a business sets up.
• To answer on a business's behalf with AI assistants, where the business has turned them on.
• To help a business understand its customers: summaries of conversations, buying signals and lead scores derived from what a customer wrote or said.
• To keep the Platform secure, prevent abuse and enforce sending limits.
• To bill business users and send them service notices.

We do not sell personal data, and we do not use customer conversations to advertise to anyone.

A business can let an AI assistant answer its website chat and voice calls, draft replies, and summarise conversations. When it does, the relevant messages or audio are sent to AI model providers acting as our subprocessors, together with the business's own knowledge-base documents, to produce the answer. Voice calls are transcribed so the assistant can respond and so the business can read what was said.

The Platform also builds a short profile of each customer from their own conversations, such as what they asked about and how ready they seem to buy, so the business can prioritise. This is automated analysis for the business's use; it does not make legally significant decisions about anyone on its own.

We do not use customer data to train AI models, and our agreements with model providers prohibit them from doing so.

A business user can connect a Google account to send email from their own Gmail address, read incoming email into their inbox, and read and write events in their Google Calendar to offer bookings. We only request the scopes needed for the features the user turns on, and we only use the data those scopes return to provide those features to that user.

MindTech CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular we do not use Google user data for advertising, we do not sell it, we do not let humans read it except with the user's consent, for security, or to comply with law, and we do not use it to develop or train generalised AI models.

A user can disconnect a Google account at any time from Settings; we then delete the stored tokens, and the user can also revoke access from their Google Account permissions page.

Microsoft. A business user can connect a Microsoft 365 or Outlook.com account to send and receive email and to sync calendar events. We use only the permissions needed for the features turned on, and disconnecting removes the stored tokens.

Meta. When a business connects its Facebook Page, Instagram account or WhatsApp number, we receive the messages sent to it together with the sender's public profile name and picture through Meta's APIs, solely to show and answer those conversations for that business. We do not sell Platform data or use it for advertising. Access tokens are stored encrypted and removed when the account is disconnected.

We share personal data only with providers that help us run the Platform, each bound by a contract that limits what they may do with it:

• Hosting and infrastructure in the United Kingdom and France.
• Email and calendar connections: Google, Microsoft, and Nylas for Google mailboxes connected through it.
• Messaging channels: Meta (WhatsApp, Facebook, Instagram), and telephony carriers for phone numbers, SMS and calls where a business uses them.
• Email delivery providers for bulk and transactional email.
• Real-time voice infrastructure, speech-to-text, text-to-speech and language model providers for AI chat and voice assistants.
• Payments: Stripe, which receives billing details directly; we never see full card numbers.
• Search, ranking and business-listing data providers for the Insights and prospect features a business chooses to run.

We also disclose data when the law requires it, to protect the rights or safety of any person, or as part of a merger or acquisition, with notice where the law requires notice.

We operate from Pakistan and host the Platform in the United Kingdom and France. Some providers process data in the United States or elsewhere. Where data leaves the country it was collected in we rely on the provider's contractual safeguards, including standard contractual clauses where they apply.

• Conversation, lead and customer data is kept while the owning business keeps an active account and is deleted on the business's instruction.
• A customer a business deletes is held for a short grace period during which the business can restore it, then removed permanently.
• A business account that stops paying is locked, warned over 30 days, and then deleted together with its data. Backups are kept for disaster recovery and overwritten on a rolling schedule.
• Connection tokens for Google, Microsoft and Meta are deleted the moment the account is disconnected.

You can ask us to delete your data at any time using the contact below. If you wrote to a business, you can also ask that business to remove your record.

Access tokens and connection secrets are encrypted at rest. Every business's data is isolated by account, and staff access inside a business is governed by roles its owner controls. Traffic is encrypted in transit, public endpoints are rate-limited, incoming webhooks are verified before they are trusted, and the database is backed up nightly with restores tested. No system is perfectly secure; if we learn of a breach that affects you we will tell you and the relevant authorities as the law requires.

Depending on where you live you may have the right to access the personal data we hold about you, to have it corrected or deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to complain to a supervisory authority.

To exercise any of these, write to the address below. If we act as a processor for a business, we will pass your request to that business and help it respond. We answer within 30 days.

The Platform uses a session cookie to keep business users signed in and a preference cookie for their display settings. A business's website chat and voice widgets store a random visitor identifier in the visitor's browser so a returning visitor's conversation continues. Websites built on the Platform record page views for their owner's analytics; a business that adds third-party tracking to its own site is responsible for it.

The Platform is for businesses and is not directed at children under 16. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

We will post any change here and update the date at the top. If a change materially affects how we use personal data, we will notify business users by email or inside the Platform before it takes effect.

Privacy questions and data requests: mindtechsocial@junadev.com. General enquiries: hello@junadev.com. Post: Junadev (Private) Limited, Plot No 1939/55 VII, Baghdad-ul-Jadid Road, Anwarabad Colony, Bahawalpur, Punjab, Pakistan.