Privacy policy

This policy explains how Mr. Site Visit (“we”, “us”) handles personal data when you visit mrsitevisit.com, contact us, or use the Mr. Site Visit CRM through its web app or Android app (together, the “Service”). We follow the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and its rules, and the Information Technology Act, 2000 and its rules.

Who is responsible for which data

Data about you as our customer or website visitor. For your account details, billing details, website enquiries and support messages, we decide why and how the data is used. Under the DPDP Act we are the Data Fiduciary for this data.

Data your company puts into the CRM. Leads, buyers, contacts, notes, call logs, site visits and similar records belong to your company. Your company decides why that data is collected and used, so your company is the Data Fiduciary and we act as its Data Processor: we store and process that data only to provide the Service, under your instructions and our Terms of service.

Your company is responsible for having a lawful basis to collect and use its leads’ data, for giving them any notice the law requires, and for answering their requests. If a lead contacts us, we will pass the request to your company.

What we collect

When you visit the website or fill a form

• What you type: name, mobile number with country code, company name, and whether you are a CP firm, developer or mandate company.
• How you found us: the page you were on, the referring website, and campaign tags in the link (such as utm_source or an ad click ID).
• Technical details: IP address, approximate location derived from it (country, region, city and rough coordinates), network provider, device model where your browser shares it, operating system, browser, screen size, language and time zone.

We do not ask your browser for your precise GPS location on the website.

When your team uses the CRM

• Account data: name, email, mobile number, role and company of each user.
• Business data your team adds: leads and buyers (name, phone, email, budget, requirement, notes), projects, inventory, channel partners, follow-ups, site visits and bookings.
• Leads from connected sources: enquiries that arrive from portals (99acres, Housing.com, MagicBricks), Meta lead forms, website forms or webhooks that your company connects.
• Call details (Android only, with permission): when a user allows it, the app reads the phone’s call log for calls with leads: the number, direction, time and duration, so calls log themselves. Where call recording is offered and your company switches it on, recordings are stored as described under “How long we keep data”.
• Site visit location: the app records GPS location and time only when a user taps to start a site visit and again when the visit ends. There is no location tracking at any other time.
• Device and security data: device type, app version, sign-in sessions (a user can be signed in on up to three devices), IP addresses and logs used to keep accounts secure.
• Billing data: the plan, number of users, invoices and payment status. Card or bank details are handled by our payment provider; we do not store them.

When you contact us

Messages you send us on WhatsApp, by email or by phone, and our notes of the conversation.

How we use data

• To provide, secure and support the Service, and to set it up for your team.
• To reply to enquiries, book demos and call you back, usually on WhatsApp or by phone.
• To understand which pages and campaigns bring enquiries, so we can improve the website.
• To bill you and keep accounting and tax records.
• To detect fraud, spam and misuse, and to meet legal obligations.
• To send service messages, such as daily reports your company sets up, renewal reminders and security alerts.

We do not sell personal data, rent it, or use the data in your CRM to advertise to your leads or to anyone else. We never contact your leads or buyers.

Legal basis

We process personal data with your consent (for example, when you submit a form or allow call-log or location permission in the app), to perform our contract with your company, and for legitimate uses allowed by the DPDP Act, such as data you share voluntarily to get a reply, and meeting legal obligations.

You can withdraw consent at any time, as easily as you gave it: switch off a permission in your phone’s settings, or write to us. Withdrawal does not affect processing done before it, and some features (such as automatic call logging) stop working without the permission.

AI features

Some features suggest what to do next, such as which leads to call first and what to say. To produce a suggestion, the Service sends only the details that feature needs (for example, a lead’s recent activity) to an AI model provider. We do not use your data to train our own AI models. AI suggestions can be wrong; your team decides what to do.

Who we share data with

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only for our instructions:

Provider type	What they do
Cloud hosting (servers in India)	Runs the CRM database and application
Cloudflare	Delivers and protects the website, receives website forms, stores backups and files
Google (Tag Manager, Analytics, Ads), Microsoft (Clarity) and Meta (Pixel)	Measure website visits, how pages are used and the results of our ads, on the website only
Email and push notification services	Send reports, alerts and app notifications
AI model providers	Produce AI suggestions (see “AI features”)
Payment provider	Processes payments
Error monitoring	Helps us find and fix faults

We also share data within your company’s account, as your company’s roles and permissions allow; when the law, a court or a government authority requires it; and with a buyer of our business if we are ever acquired, in which case this policy will continue to apply to your data. We will tell you the name of any provider on request.

Where data is stored

The CRM’s main servers are in India. Some providers, such as Cloudflare, email, notification and AI providers, may process limited data outside India. We transfer data abroad only as the DPDP Act allows, and never to a country the Government of India has restricted.

How we protect data

• Encrypted connections (HTTPS) for the website, the web app and the Android app.
• Each company’s data is kept separate from every other company’s.
• Role-based access: your company decides who sees which pipelines, and can hide phone numbers and emails from sales staff.
• Exports of lead data need a one-time code sent to the account owner.
• Remote sign-out of any user, a limit of three devices per user, and a history of every export.
• Regular backups.

No system is perfectly secure. If a personal data breach happens, we will inform the affected persons and the Data Protection Board of India as the DPDP Act and its rules require, and tell your company without delay if the breach involves its data.

How long we keep data

Data	How long
Your company’s CRM data	While your subscription is active, then 90 days after it ends so you can export it, then deleted
Call recordings (where switched on)	Up to 90 days, unless your company deletes them sooner
Website enquiries	While we are in touch, and up to 24 months after the last contact
Billing and tax records	As long as tax and company laws require, usually 8 years
Security and server logs	Up to 90 days

Deleted data leaves our backups as they are replaced, normally within 30 days.

Cookies and browser storage

The website uses Google Tag Manager, which loads Google Analytics and Microsoft Clarity, and can load advertising measurement tools such as Google Ads or the Meta Pixel. These set cookies to count visits, see which pages and campaigns work, and measure whether an ad led to an enquiry. Clarity also records how visitors scroll and click (session recordings and heatmaps), so we can fix confusing pages; it hides what you type into form fields. When you submit a form, we record that a form was sent, which button it came from and your business type; we do not send your name, phone number or company to these tools.

The site also stores the campaign tags that brought you here in your browser’s own storage, so that if you fill a form we know which campaign or page led you to us. Cloudflare may set a strictly necessary security cookie to protect the site from bots. The web app uses cookies and browser storage to keep you signed in.

You can block or delete cookies in your browser settings; the website still works without them.

Your rights

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it by law;
• withdraw consent you have given;
• nominate another person to exercise your rights if you die or cannot act;
• raise a grievance with us, and then with the Data Protection Board of India.

To use a right, write to [email protected] from the email or phone number we have on record. We reply within 30 days. If you are a lead or buyer of one of our customers, please contact that company first; we will help them answer you.

Children

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data. If you think a child has given us personal data, tell us and we will delete it.

Changes to this policy

We will post any change on this page with a new date. For important changes we will also tell account owners by email or in the app before the change takes effect.

Grievance Officer and contact

If you have a question or complaint about your personal data, contact our Grievance Officer:

• Name: Jayesh G, Grievance Officer, Mr. Site Visit
• Address: 404, Sai Darshan Rajesh CHS, Jogeshwari East, Mumbai, Maharashtra 400 060, India
• Email: [email protected] (subject: “Grievance”)
• WhatsApp: +91 95946 78500

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Also read: Privacy policy, Terms of service, Refund policy.