Privacy
Privacy policy.
What personal data the service handles, why, how long it is kept, and how to have it deleted.Operated by Tavco Growth Private Limited · Last updated 8 November 2026
Two groups
Who appears in this policy.
Tavco CRM is customer-relationship software for real-estate businesses. Two different groups of people appear here.
- Our customers — real-estate businesses that use Tavco CRM, and the staff who log in to it.
- Enquirers — people who submit an enquiry to one of those businesses (for example through a Facebook or Instagram lead form) and whose details are then stored in that business’s workspace.
For enquirer data, the customer business is the data fiduciary and decides how that data is used. Tavco Growth Private Limited processes it on their instructions.
Data we collect
What we collect.
From our customers and their staff
- Name, work email address, phone number, and role within their organisation
- Authentication identifiers issued by our login provider
- Activity records — sign-ins, screens visited, and actions taken in the product, used to operate and secure the service
From enquirers
- Name, phone number, email address
- Property requirements — budget, configuration, preferred locality, city, project of interest, preferred language
- Where the enquiry came from — the advertising source, campaign, and form
- Records of contact attempts: call outcomes, notes written by the business’s staff, scheduled follow-ups, and consent records
The Android app asks for permission to read your call log, and uses it only to fill in how long a call lasted. It does not record audio.
Meta
Data obtained through Meta Platforms.
Where a customer connects their Facebook or Instagram assets to Tavco CRM, we access data through Meta’s APIs strictly on that customer’s instruction and only for the purposes described here.
| Permission | What we receive | Why |
|---|---|---|
leads_retrieval | The contents of lead-form submissions on the customer’s own Facebook and Instagram lead ads — name, phone, email, and the answers to the form’s questions | To deliver each enquiry into that customer’s workspace within seconds, so their team can respond while the enquirer still expects a call |
pages_show_list, pages_read_engagement | The list of Pages the person administers, and basic Page details | So the customer can choose which of their own Pages to connect |
ads_management, ads_read | Campaign, ad set and ad names and performance metrics for the customer’s own ad accounts | To report which campaigns produced enquiries that converted |
| WhatsApp Business messaging | Messages exchanged between the customer’s business and an enquirer | To let the business reply from the CRM and keep the conversation alongside the rest of that enquiry’s history |
We do not sell data obtained through Meta’s APIs, share it with data brokers, use it for advertising to the enquirer, combine one customer’s data with another’s, or use it to build profiles beyond the customer’s own records. Data from Meta is used only to provide the CRM to the customer who authorised the connection.
Retention
How long we keep data.
| What | Kept for |
|---|---|
| Enquirer records in an active workspace | As long as the customer keeps them, or until they or the enquirer request deletion |
| Data after a customer closes their account | Deleted within 90 days, except where law requires us to keep it longer |
| Deleted records | Removed from live systems immediately; purged from encrypted backups within 35 days |
| Security and audit logs | Up to 24 months, then deleted |
Deletion
Deleting your data.
Anyone can request deletion, and we act on it. Full instructions, including what happens to data already in backups, are on our data deletion page.
In short: email privacy@tavcogrowth.com with the phone number or email address in question. We acknowledge within 72 hours and complete deletion within 30 days. If your details sit in a customer’s workspace, we will pass the request to that business and confirm once it is done.
Protection
How data is protected.
- Each customer’s data is separated at the database level. The database itself refuses to return one customer’s records to another — this is enforced below the application, not by the application.
- All traffic is encrypted in transit; data is encrypted at rest.
- Access to production systems is restricted, individually authenticated, and logged.
- Every change to a record is recorded with who made it and when.
Providers
Who else processes data.
We use a small number of providers strictly to run the service: Google Cloud Platform (hosting and database, Mumbai region), Cloudflare (content delivery), Google Identity Platform (sign-in), and Resend (transactional email). Each processes data only to provide their service to us. We do not share personal data with anyone else, and we never sell it.
Your rights
Your rights.
Under India’s Digital Personal Data Protection Act, 2023, and comparable laws elsewhere, you may ask us to confirm what data we hold about you, correct it, delete it, or withdraw consent you previously gave. Write to privacy@tavcogrowth.com. If you are unhappy with our response you may complain to the Data Protection Board of India.
Children
Children.
Tavco CRM is business software and is not directed at children. We do not knowingly collect data from anyone under 18.
Changes
Changes and contact.
If we change this policy materially we will update the date above and notify customer administrators by email before the change takes effect.
Tavco Growth Private Limited. Privacy enquiries: privacy@tavcogrowth.com. See also the terms of service and security.