Privacy Policy

Last Updated: October 01, 2026

This Privacy Policy (“Policy”) describes the manner in which Gravion Technologies Private Limited having CIN U58201GJ2026PTC181674, operating the BoothCRM platform (“BoothCRM”, “Platform”, “we”, “us” or “our”), collects, receives, uses, stores, discloses, transfers and otherwise processes Data in connection with the access to and use of the Platform. This Policy applies to all individuals whose Personal Data is processed by BoothCRM through the Platform, including registered users, authorised members of enterprise accounts, and persons who access or otherwise interact with publicly shared features of the Platform, including digital business cards.

Depending upon the nature of the Personal Data processed and the manner in which the Platform is used, BoothCRM may act either as a Data Fiduciary or as a Data Processor for the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Where BoothCRM processes Personal Data relating to the administration and operation of the Platform, including account management, security, support, billing, compliance and other operational activities, it acts as a Data Fiduciary. Where BoothCRM processes Personal Data uploaded, submitted or otherwise made available by enterprise customers in connection with their own lead generation, customer relationship management or similar business activities, BoothCRM processes such Personal Data solely on the instructions of the relevant enterprise customer in its capacity as a Data Processor, unless otherwise required under applicable law.

This Policy forms an integral part of, and should be read together with, the Terms of Use governing access to and use of the Platform. In the event of any inconsistency between this Policy and the Terms of Use in relation to the processing of Personal Data, the provisions of this Policy shall prevail only to the extent of such inconsistency. BY ACCESSING OR USING THE PLATFORM, OR OTHERWISE PROVIDING PERSONAL DATA THROUGH THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS POLICY.

1. DATA CATEGORIES OF PERSONAL DATA PROCESSED

BoothCRM processes different categories of Personal Data depending upon the manner in which the Platform is accessed and used. Such Personal Data may be provided directly by you, submitted by or on behalf of another authorised user, generated through your use of the Platform, or otherwise made available to BoothCRM in connection with the provision of the Platform’s services.

A. Registered Users and Authorised Members: Where you create an account on the Platform or are invited to access the Platform as an authorised member of an enterprise account, BoothCRM processes Personal Data necessary for the creation, administration, security and operation of your account. Such Personal Data may include your name, contact details, account credentials stored in a secure hashed format, professional information, organisational affiliation, profile information, preferences, and any content or information voluntarily uploaded by you for use within the Platform, including information published through your digital business card. BoothCRM also processes technical and usage information generated through your access to and use of the Platform, including account activity, session information, device and browser information, network identifiers, audit logs and other information reasonably necessary for maintaining the security, integrity and operation of the Platform.

B. Lead Data and Business Contacts: Where registered users or enterprise customers use the Platform to capture, organise or manage information relating to prospective customers, business contacts or other leads, BoothCRM processes such Personal Data solely for the purpose of providing the Platform’s services to the relevant customer. Such Personal Data may include contact information, professional information, communications, notes, uploaded business cards, conversation transcripts, AI-generated summaries and other information submitted or generated in connection with the customer’s use of the Platform. BoothCRM does not independently determine the purposes for which such Personal Data is collected or processed, and processes such information only in accordance with the instructions of the relevant registered user or enterprise customer, subject to applicable law.

C. Public Visitors: Where publicly accessible digital business cards or similar Platform features are viewed by persons who do not maintain a registered account, BoothCRM may process limited Personal Data relating to such visitors, including technical information associated with the visit and any information voluntarily submitted through feedback, enquiry or similar features made available on the relevant page.

2. PURPOSES OF PROCESSING PERSONAL DATA

BoothCRM processes Personal Data only to the extent reasonably necessary for the provision, administration, security and lawful operation of the Platform, for the purposes described in this Privacy Policy, and otherwise as required or permitted under applicable law. BoothCRM does not sell, rent or otherwise disclose Personal Data to third parties for their own independent commercial purposes. Depending upon the nature of the Personal Data processed and the capacity in which BoothCRM acts, Personal Data may be processed for one or more of the following purposes:

A. Provision and Administration of the Platform: To establish, administer and maintain user accounts, provide access to the Platform and its functionalities, authenticate authorised users, facilitate lead management, digital business card services, customer relationship management features and other services requested by users, administer subscriptions, and otherwise enable the secure and efficient operation, maintenance and improvement of the Platform.

B. Security, Integrity and Platform Administration: To protect the security, integrity and availability of the Platform and its users, detect, prevent and investigate fraud, unauthorised access, abuse, misuse and other unlawful activities, maintain audit trails, logs and security records, enforce the Terms of Use, and otherwise safeguard the Platform and its supporting infrastructure.

C. Communications: To communicate with users regarding their accounts, subscriptions, technical notices, security alerts, support requests, administrative matters, changes to the Platform, this Privacy Policy or the Terms of Use, and other communications reasonably necessary for the provision, administration and lawful operation of the Platform. Where BoothCRM undertakes promotional or marketing communications, such communications shall be carried out in accordance with applicable law and any consent requirements prescribed thereunder.

D. Legal and Regulatory Compliance: To comply with applicable laws, judicial or governmental directions, regulatory requirements, law enforcement requests and legal process, and where reasonably necessary to establish, exercise or defend BoothCRM’s legal rights, investigate suspected unlawful activity, or fulfil its legal and regulatory obligations.

E. Processing on Behalf of Enterprise Customers: Where enterprise customers use the Platform to capture, organise or manage Personal Data relating to prospective customers, business contacts or other third parties, BoothCRM processes such Personal Data solely for the purpose of providing the Platform and the services requested by the relevant enterprise customer. BoothCRM does not independently determine the purposes or means by which such Personal Data is collected and processed. Enterprise customers remain solely responsible for ensuring that the collection, recording, submission and use of such Personal Data through the Platform complies with applicable law, including any requirements relating to notice, consent, authorisation or other lawful basis for processing.

3. ARTIFICIAL INTELLIGENCE PROCESSING

Certain functionalities of the Platform utilise artificial intelligence, machine learning and other automated technologies to assist users in processing information submitted through the Platform. Such functionalities may include, without limitation, the extraction of information from business cards and other uploaded documents, transcription of recorded conversations, generation of summaries, categorisation of information, sentiment analysis and similar automated processing activities. Where a user elects to utilise such functionalities, the relevant Personal Data may be transmitted to third-party technology providers engaged by BoothCRM solely for the purpose of providing the requested functionality. AI-generated outputs are produced through automated processes and may be incomplete, inaccurate, misleading, inconsistent or otherwise unsuitable for a particular purpose. Such outputs are intended solely to assist users in managing and organising information and should not be treated as a substitute for independent human review or decision-making. Users remain solely responsible for reviewing, verifying and determining the suitability of any AI-generated output before relying upon or acting upon it. Where AI-generated outputs form part of a user’s lead records, customer relationship management records or other information maintained through the Platform, such outputs shall be processed and retained as part of the relevant Customer Data in accordance with this Policy and the applicable Terms of Use.

The use of artificial intelligence features may involve the processing of Personal Data relating to individuals who are not registered users of the Platform. Enterprise customers and registered users remain responsible for ensuring that they possess the necessary rights, permissions or other lawful basis required under applicable law to submit such Personal Data for processing through the Platform. BoothCRM’s role in processing such Personal Data is subject to the capacities described in this Policy and the obligations set out in the Terms of Use.

4. AI DISCLOSURE OF PERSONAL DATA AND THIRD-PARTY SERVICE PROVIDERS

BoothCRM does not sell, rent or otherwise disclose Personal Data to third parties for their own independent commercial purposes. Personal Data is disclosed to third parties only where reasonably necessary for the provision, operation, security and administration of the Platform, where required by applicable law, or otherwise in accordance with this Policy. Without limitation, Personal Data may be disclosed in the following circumstances:

A. Third-Party Service Providers: BoothCRM engages third-party service providers to support the operation of the Platform, including providers of cloud hosting and infrastructure, artificial intelligence and automated processing services, transactional email and messaging delivery, payment processing and other technology services reasonably necessary for the provision of the Platform. Such service providers process Personal Data only to the extent necessary to provide the relevant services to BoothCRM users.

B. Legal and Regulatory Disclosures: BoothCRM may disclose Personal Data where required to do so under applicable law, pursuant to a court order, governmental direction, regulatory requirement or other lawful process, or where BoothCRM reasonably considers such disclosure necessary to establish, exercise or defend its legal rights, investigate unlawful activity, protect the security or integrity of the Platform, or comply with its legal obligations.

C. Corporate Transactions: Personal Data may be disclosed or transferred in connection with a proposed or completed merger, acquisition, corporate restructuring, financing transaction, sale of assets or business, or other similar corporate transaction, provided that the recipient of such Personal Data is bound to use it only for purposes consistent with this Policy and applicable law.

D. International Transfers: BoothCRM and its service providers may process Personal Data in jurisdictions outside the country in which it was originally collected. Where Personal Data is transferred across borders, BoothCRM shall implement such safeguards and comply with such requirements as may be prescribed under applicable law.

5. DATA STORAGE, SECURITY AND RETENTION

A. Storage of Personal Data: Personal Data processed through the Platform is stored using cloud infrastructure and related technology services engaged by Us. We implement administrative, technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss or destruction.

B. Security Measures: We implement reasonable technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss and destruction. Such measures are reviewed periodically having regard to the nature of the Personal Data processed, the risks associated with such processing, technological developments and industry practices. While We endeavour to maintain appropriate safeguards, no method of electronic transmission, storage or processing is completely secure. Accordingly, We cannot guarantee the absolute security of Personal Data. Users are responsible for maintaining the confidentiality of their account credentials, restricting access to devices used to access the Platform, and notifying Us promptly of any suspected unauthorised access to their accounts. Without limitation, BoothCRM’s security measures may include:

i. secure storage of account credentials using cryptographic hashing techniques;

ii. encrypted transmission of data between users and the Platform using secure communication protocols;

iii. access controls, authentication mechanisms and role-based permissions designed to restrict access to Personal Data;

iv. logical segregation of customer data within the Platform;

v. monitoring, logging and audit mechanisms to detect and investigate unauthorised activity;

vi. rate-limiting and other protective measures designed to reduce abusive or malicious use of the Platform; and

vii. controlled mechanisms for granting temporary access to uploaded files and other stored content.

C. Retention of Personal Data: We retain Personal Data for as long as reasonably necessary to fulfil the purposes described in this Policy, to provide the Platform, to comply with applicable legal obligations, to resolve disputes, to enforce its legal rights and obligations, and for legitimate operational purposes. Certain categories of Personal Data may be subject to different retention periods depending upon their nature and purpose. Without limitation:

i. conversation audio submitted for transcription is deleted following completion of the transcription process;

ii. transcripts, summaries and associated lead records are retained as part of the relevant customer records;

iii. audit logs, security records and administrative information may be retained for longer periods where reasonably required for security, compliance or dispute resolution;

iv. Personal Data may continue to exist in secure backup or archival systems for a limited period following deletion until such backups are overwritten or otherwise retired in accordance with BoothCRM’s operational practices.

D. Customer Controlled Information: Where the Platform enables you to create, upload, modify or delete lead records, digital business cards or other content, you remain responsible for managing such information throughout the duration of your account. Deletion or modification of such information through the Platform shall be subject to BoothCRM’s operational processes, backup procedures and applicable legal retention requirements.

6. RIGHTS OF DATA PRINCIPALS

The rights available in relation to Personal Data processed through the Platform depend upon the capacity in which BoothCRM processes such Personal Data. Where BoothCRM processes Personal Data as a Data Fiduciary, Data Principals may exercise the rights available to them under applicable law directly against BoothCRM. Where BoothCRM processes Personal Data solely as a Data Processor on behalf of an enterprise customer or other Data Fiduciary, requests relating to such Personal Data should ordinarily be directed to the relevant Data Fiduciary. BoothCRM may, where appropriate or required by applicable law, cooperate with such Data Fiduciary in facilitating the exercise of applicable rights.

A. Right to Access Information: Where applicable law grants you the right to obtain information regarding the Personal Data processed by BoothCRM as a Data Fiduciary, you may request confirmation as to whether BoothCRM is processing your Personal Data together with such information as BoothCRM is required to provide under applicable law.

B. Right to Correction and Erasure: Subject to applicable law, you may request the correction, completion, updating or erasure of your Personal Data where such Personal Data is inaccurate, incomplete, no longer required to be retained, or otherwise qualifies for correction or erasure under applicable law. BoothCRM may decline or limit such requests where continued retention or processing is permitted or required under applicable law, including for compliance, security, dispute resolution or the establishment, exercise or defence of legal claims.

C. Verification of Requests: BoothCRM may require reasonable information to verify the identity and authority of any person submitting a request under this Clause before acting upon such request. Where BoothCRM is unable to verify the identity or authority of the requester, BoothCRM may decline the request until satisfactory verification has been provided.

D. Personal Data Processed on Behalf of Enterprise Customers: Where BoothCRM processes Personal Data solely on behalf of an enterprise customer acting as the Data Fiduciary, BoothCRM may refer requests received from Data Principals to the relevant enterprise customer or otherwise process such requests in accordance with applicable law and the lawful instructions of the relevant Data Fiduciary.

7. COOKIES AND SIMILAR TECHNOLOGIES

BoothCRM uses cookies and similar technologies only to the extent reasonably necessary to operate, secure and improve the Platform. We do not use cookies or similar technologies for behavioural advertising, commercial profiling or cross-site tracking.

A. Essential Cookies: BoothCRM uses essential session cookies and similar technologies to authenticate users, maintain secure login sessions, remember user preferences during an active session and enable the proper functioning of the Platform. These technologies are necessary for the operation of the Platform and may not be disabled without affecting certain functionality, including user authentication and access to registered accounts.

B. Public Digital Business Card Analytics: Where a publicly shared digital business card is accessed, BoothCRM may collect limited technical information, including the visitor’s IP address, for the purposes of generating aggregate page-view statistics, protecting the integrity of those statistics and maintaining the security of the Platform. Such information is not used to identify visitors personally, create behavioural profiles or serve targeted advertising.

C. Third-Party Tracking Technologies: BoothCRM does not currently deploy third-party advertising cookies or similar technologies for behavioural advertising or commercial profiling. If BoothCRM introduces such technologies in the future, this Policy shall be updated accordingly and any notice or consent required under applicable law shall be obtained before such technologies are used.

D. Managing Cookies: You may manage or disable cookies through your browser or device settings. However, disabling cookies or similar technologies that are necessary for the operation of the Platform may affect your ability to access certain features or maintain authenticated sessions.

8. THIRD-PARTY WEBSITES AND EXTERNAL SERVICES

The Platform may contain links to, integrate with, or otherwise enable access to third-party websites, applications, products or services that are not owned or operated by BoothCRM. Your interactions with such third parties are governed by their respective terms, privacy policies and other applicable policies, and BoothCRM does not control or assume responsibility for their processing of Personal Data. Where the Platform facilitates interaction with third-party services, including payment service providers or other external technology providers, BoothCRM may share or receive information only to the extent necessary to facilitate the requested functionality. Digital business cards created through the Platform may include links, contact methods or references provided by the relevant user. BoothCRM is not responsible for the availability, content, security or privacy practices of any external website or service accessed through such links. The inclusion of any third-party website, application, service or reference on the Platform does not constitute an endorsement, recommendation or representation by BoothCRM regarding such third party or its products, services or practices.

9. CHANGES TO THIS PRIVACY POLICY

BoothCRM may revise this Privacy Policy from time to time to reflect changes in applicable law, the functionality of the Platform, or our data processing practices. The revised version shall be published on the Platform together with the date on which it becomes effective. Where required by applicable law or where BoothCRM considers a revision to materially affect the manner in which Personal Data is processed, BoothCRM may provide additional notice through the Platform, by email or through other appropriate means before the revised Policy takes effect. Your continued use of the Platform after the effective date of any revised Privacy Policy shall constitute your acknowledgement of the updated Policy. Where applicable law requires fresh consent for any new or materially different processing activity, BoothCRM shall obtain such consent through an appropriate mechanism before undertaking such processing.

10. ACCOUNT DELETION

A. Creation of Accounts: Accounts on the Platform can only be created through the BoothCRM website. You cannot create an account from within the BoothCRM mobile application.

B. Deleting Your Account: You may delete your account, and all Personal Data and content linked to it, at any time from within the BoothCRM mobile application. To delete your account, go to: Log in → Dashboard → More → Delete Account. You may be asked to confirm your request before the deletion is completed. If you cannot use the mobile application, you may also ask us to delete your account by writing to support@boothcrm.net from the email address registered with your account.

C. Effect of Deletion: When your account is deleted, you will permanently lose access to it. Your profile information, lead records, digital business cards, uploaded files, transcripts, AI-generated summaries and other content linked to your account will be deleted. Any publicly shared digital business card linked to your account will stop being available. Deleted accounts and data cannot be recovered. You should save a copy of any information you want to keep before you delete your account.

D. Retention After Deletion: Deletion is subject to Clause 5(C) of this Policy. Some limited information, such as audit logs, security records, billing and transaction records, may be kept for as long as applicable law requires, or as needed for security, fraud prevention, dispute resolution, or to establish, exercise or defend legal claims. Personal Data may also stay in secure backup systems for a limited period until those backups are overwritten or retired in the normal course.

E. Enterprise Accounts: If you use the Platform as an authorised member of an enterprise account, Personal Data processed on behalf of the enterprise customer may be kept, deleted or handled according to that enterprise customer’s lawful instructions, as described in Clause 6(D) of this Policy.

F. Subscriptions: Deleting your account does not by itself entitle you to a refund of any fees already paid. Refunds, if any, are governed by the Terms of Use.

G. Using BoothCRM Again: Once your account is deleted, you will need to create a new account through the BoothCRM website to use the Platform again. Data from a deleted account will not be restored or moved to a new account.

11. GRIEVANCE REDRESSAL AND CONTACT INFORMATION

BoothCRM has designated a Grievance Officer in accordance with applicable law to receive and respond to complaints, requests and enquiries relating to the processing of Personal Data and the exercise of rights under this Privacy Policy. Where you wish to exercise any rights available under applicable law or have any concern regarding BoothCRM’s processing of your Personal Data, you may contact the Grievance Officer using the details set out below. BoothCRM may require reasonable information to verify your identity or authority before responding to your request. Where BoothCRM processes the relevant Personal Data solely as a Data Processor on behalf of an enterprise customer or other Data Fiduciary, BoothCRM may refer the request to the relevant Data Fiduciary or otherwise cooperate with that Data Fiduciary in facilitating the exercise of applicable rights, to the extent required by applicable law. BoothCRM shall acknowledge and respond to grievances and requests within the timelines prescribed under applicable law.

Grievance Officer

Name: Omnexa Solutions Pvt. Ltd.

Email: support@boothcrm.net

12. GENERAL PROVISIONS

A. Relationship with the Terms of Use: This Privacy Policy forms part of and should be read together with the Terms of Use governing your access to and use of the Platform. In the event of any inconsistency relating specifically to the processing of Personal Data, this Privacy Policy shall prevail to the extent of such inconsistency.

B. Interpretation: References to applicable law include any amendment, modification, replacement or re-enactment thereof. Headings are included for convenience only and shall not affect the interpretation of this Privacy Policy.

C. Severability: If any provision of this Privacy Policy is held to be invalid, unlawful or unenforceable, the remaining provisions shall continue in full force and effect to the extent permitted by applicable law.

D. Language: This Privacy Policy is published in the English language. Any translation provided is for convenience only. In the event of any inconsistency between the English version and any translated version, the English version shall prevail.