Privacy Policy

1. Overview & Scope

This Privacy Policy describes how M1 ENTITIES SOLUTIONS ("CallingCRM", "we", "us", or "our") collects, uses, processes, stores, and protects personal information obtained through our website (m1entities.com), WebRTC softphone clients, mobile applications, REST APIs, and CRM dashboards (collectively, the "Service").

In the context of the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the Indian Digital Personal Data Protection Act (DPDP Act 2023), and similar data protection legislations:

• Data Controller: CallingCRM acts as a Data Controller for your organization account details, administrative credentials, and billing records.
• Data Processor: CallingCRM acts as a Data Processor on behalf of our customer organizations regarding CRM contact records, customer telephone numbers, and audio recordings uploaded or processed through our telephony dialers.

2. Information We Collect

We collect information across the following distinct categories:

• Account & Profile Data: Full name, corporate email address, mobile phone number, job title, company name, GSTIN/tax identification, billing address, and account passwords (stored strictly as salted, one-way bcrypt hashes).
• Customer CRM Dossiers: Contact names, phone numbers, email addresses, organization affinities, deal values, lead tags, custom form attributes, and communication notes created or synchronized by your users.
• WebRTC Audio & Device Telemetry: Selected audio input/output devices (microphones and headsets), browser user-agent, WebRTC ICE connection candidate pairs, round-trip latency, jitter packet loss, and IP addresses for media gateway routing.
• Billing & Payment Data: Credit card brand, last four digits, billing address, and transaction identifiers. Complete card numbers are tokenized and processed directly by PCI-DSS Level 1 certified payment gateways.

3. Call Detail Records (CDRs) & Call Audio

To deliver telecom services, troubleshoot audio packet latency, and satisfy telecommunication compliance mandates, CallingCRM automatically records and indexes Call Detail Records (CDRs) for all inbound and outbound calls:

• Originating Calling Line Identity (CLI / Caller ID) and terminating destination phone number.
• Call start timestamp, ringing duration, answer timestamp, and end/disconnection timestamp.
• SIP termination disposition codes (e.g., Busy, No Answer, Normal Clearing, Congestion).
• Carrier circuit routing ID and originating user/agent identifier.

Audio Recordings: When call recording is enabled by organization administrators, dual-channel audio streams are encrypted at rest using AES-256 and accessible solely through authenticated role-based access control. CallingCRM does not sell or listen to your call recordings.

4. How We Use Collected Information

We process collected information solely for valid business and operational purposes:

• To establish SIP media sessions and route voice calls through optimal telecom circuits.
• To run automated campaign dialers (Preview, Progressive, Power, Predictive, DTMF broadcast).
• To manage CRM contacts, sales pipelines, lead routing queues, and agent assignments.
• To generate real-time supervisor wallboards, whisper-coaching feeds, and historical analytics.
• To calculate per-minute telephony charges, issue monthly tax invoices, and process credit renewals.
• To detect and prevent fraudulent calling, CLI spoofing, credential abuse, and cyber threats.
• To comply with regulatory subpoenas, lawful intercept requests, and statutory audits.

5. Legal Bases for Processing

Under GDPR and related international data protection laws, we rely on the following lawful bases:

• Performance of a Contract: Processing necessary to provide the subscribed CallingCRM software and telephony services.
• Legitimate Interests: Securing our networks, preventing robocall fraud, improving audio quality, and optimizing system reliability.
• Legal Obligation: Retaining financial records, tax invoices, and CDR telemetry in accordance with telecom and taxation laws.
• Consent: Where required by law for promotional communications or optional cookie technologies.

6. Data Retention & Automated Purging

CallingCRM retains customer data only for as long as necessary to fulfill the operational purposes outlined in this policy or as mandated by law:

• Active Account Data: Retained for the duration of your active subscription.
• Call Recordings: Retained according to your organization's configured retention policy (e.g., 30, 90, 180, or 365 days), after which files are permanently purged.
• Call Detail Records (CDRs): Retained for a minimum of twelve (12) months to comply with telecom regulatory compliance mandates.
• Account Closure: Upon account termination, Customer may request complete deletion of tenant database partitions within thirty (30) days.

7. Sub-Processors & Telecom Carriers

To deliver global telecommunications and high-availability cloud infrastructure, CallingCRM engages vetted third-party sub-processors under strict confidentiality and data protection agreements:

• Telecom Tier-1 Operators: Licensed carriers (e.g., Tata Teleservices, Airtel, Vodafone Idea, Twilio) for PSTN/SIP termination and DID provisioning.
• Cloud Infrastructure: AWS and dedicated private cloud data centers for secure database hosting, storage, and computing.
• Speech Intelligence: Dedicated cloud AI models for speech-to-text transcriptions and audio processing.
• Transactional Communications: Email gateways and SMS relays for OTP delivery and account alerts.

8. Security Safeguards & Encryption

CallingCRM implements rigorous defense-in-depth security measures:

• Data at Rest: All database stores, backups, and audio recording volumes are encrypted using AES-256.
• Data in Transit: WebRTC voice media is secured using Secure Real-Time Transport Protocol (SRTP) and DTLS. Web application and API traffic is strictly enforced over TLS 1.3.
• Multi-Factor Authentication (MFA): TOTP-based two-factor authentication is supported and enforceable across administrative roles.
• Role-Based Access Control (RBAC): Granular permissions ensuring agents access only authorized team queues, contacts, and recordings.
• Continuous Monitoring: Real-time intrusion detection, IP rate-limiting, and comprehensive administrative audit logging.

9. Cross-Border Data Transfers

For international call routing and disaster recovery redundancy, data may be transferred across borders. When transferring data internationally, CallingCRM ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent regional transfer mechanisms.

10. Your Rights & Privacy Choices

Depending on your jurisdiction, you may have the following data protection rights:

• Right of Access: Request a copy of the personal information CallingCRM holds about you.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal and regulatory retention obligations.
• Right to Data Portability: Export your CRM contacts and CDR logs in standard CSV/JSON formats.
• Right to Restrict or Object: Restrict or object to processing carried out on the basis of legitimate interests.

To exercise your rights, please submit a verified request to privacy@m1entities.com.

11. Cookies & Browser Storage

We use strictly necessary cookies, authentication tokens, and browser local storage to maintain your softphone session and agent preferences. For complete details, please review our comprehensive Cookie Policy.

12. Children's Privacy

The Service is strictly intended for enterprise commercial use by individuals of legal age. CallingCRM does not knowingly collect or solicit personal data from children under the age of eighteen (18). If we learn that a minor has provided us with personal information, we will delete it immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory enhancements. When revisions occur, we will update the "Last Updated" date at the top of this document and notify account administrators through the dashboard or via email.

14. Contact Our Data Protection Officer

If you have questions, complaints, or inquiries regarding our data protection practices, please contact our Data Protection Officer: