Privacy Policy

Insta AI 365 is operated by KWIKFUTURE AI PRIVATE LIMITED, a private limited company registered in India under GSTIN 06AANCK2107N1ZC. Our registered address is at the foot of this page.

For questions about this policy or about personal information we hold, contact privacy@instaai365.com.

This policy covers the website at https://instaai365.com and the Insta AI 365 CRM application. It is important to distinguish three different kinds of information, because our role and your rights differ for each.

A. CRM data entered by our business customers

Records about leads, contacts, companies and their staff, put into a workspace by the customer who operates it. That customer decides why and how this data is used. We process it on their instruction in order to run the service — we do not decide what it is used for. If you are a lead or customer of a business that uses Insta AI 365 and you want your details changed or removed, contact that business; they control the record. We will assist them, and if you contact us we will pass the request on where we can identify the workspace.

B. Account information of our customers and their users

The names, work email addresses, phone numbers and login details of the people who use Insta AI 365, and the organisation and billing details of the businesses that subscribe. We decide how this is used, and this policy governs it directly.

C. Operational data we generate to run the service

Security and audit logs, authentication records, error diagnostics and backups. Ours, and necessary to operate the service safely.

Account and identity information

Name, work email address, phone number where provided, a cryptographic hash of your password (never the password itself), your role and permissions, the organisation you belong to, notification preferences, and your login and session history.

Business and billing information

Organisation name, contact details, plan and subscription record, and the invoices and payment records we raise for your subscription, including tax identifiers where required.

When you buy a plan through our online checkout we collect your name, email address, mobile number (optional), company name, and the billing details you give us — legal business name, GSTIN, address and state. We use them to create your account and workspace, to raise tax invoices, and to meet our GST obligations. We also keep the plan, number of users and billing period you chose, and the payment and subscription references Razorpay returns.

CRM records you enter

Leads, contacts, companies, deals, tasks, follow-ups, notes, activity timelines, quotations, invoices, payment records, custom fields and tags. This is category A above: it is whatever you choose to put in.

Files and documents

Attachments uploaded against records. Uploads are size-limited and are virus-scanned before they are stored, and are served through short-lived signed links rather than public URLs.

Communication data

Messages and threads recorded against a record. If your workspace connects WhatsApp through the WhatsApp Cloud API, message content and metadata for those conversations are stored against the relevant record. This integration is available in the product but is enabled per workspace, and no data flows through it unless you connect it.

Call metadata, recordings and transcripts

Where click-to-call is enabled, we store the number dialled, who placed the call, timestamps, duration, the call’s lifecycle state, and the provider’s reference for it. Where recording is enabled, we also store the recording, its transcript, and any AI-generated summary or extracted detail. Transcripts include timed segments and speaker separation.

Lead capture from third parties

If you connect Meta Lead Ads, we receive the lead information the person submitted on the advertising platform’s form and create a record from it. If you use website lead forms, we receive what the visitor submitted.

Technical and log information

IP address, browser and device information, request paths and timestamps, and error diagnostics — recorded to operate the service, diagnose faults, and investigate abuse. Administrative and authentication actions are recorded in audit logs.

The public website at https://instaai365.com sets no cookies and uses no analytics, advertising or tracking technology. There is no tag manager, no advertising pixel, and no third-party telemetry script on it. We have not implemented visitor analytics on the marketing site at all.

The CRM application uses only what is needed to keep you signed in:

• Session cookies holding your access and refresh sessions. They are marked Secure and HttpOnly, so they are sent only over HTTPS and cannot be read by scripts in the page.
• Local browser storage holding your basic profile and the list of organisations you belong to, so the interface can render without re-fetching them on every page. This stays in your browser.

These are strictly necessary for the application to function. Blocking them will prevent you signing in.

The online checkout keeps a reference to your checkout in your browser’s session storage, so the order-status page can find it; it is cleared when you close the tab. When you choose to pay, the checkout loads Razorpay’s payment window, which is operated by Razorpay under its own terms and privacy policy and may use its own cookies.

• To provide the CRM — storing and returning your records, running searches and reports, executing automation rules you configure, generating quotations and invoices, and delivering the features on your plan.
• To authenticate and secure— verifying who is signing in, enforcing roles and permissions, separating one workspace’s data from another’s, scanning uploads, and detecting and investigating abuse.
• To provide AI features — see section 6.
• To support you — responding to your questions and diagnosing problems you report.
• To administer the commercial relationship — managing your subscription, raising invoices, and meeting tax obligations.
• To operate and improve the service — diagnosing faults and understanding failures from our own logs and error records.
• To communicate — service and security notices, and replies to you. We do not sell your details to anyone.
• To meet legal obligations — retaining financial records, and responding to lawful requests.

AI features — including the Ira assistant, call summaries, and suggested next actions — work by sending the relevant content from your workspace to a third-party AI provider, which processes it and returns a result.

The AI provider currently used is OpenAI. Speech-to-text transcription of call recordings also currently uses OpenAI. This means that where these features are used, the text of records and the audio or text of calls leaves our servers and is processed by that provider.

To make the assistant able to answer from your own records, an indexed copy of workspace content is maintained for retrieval. AI conversation history is retained for a limited period — see section 9.

We do not use your data to train AI models, and we do not permit it to be used to train the provider’s general models. AI output can be inaccurate and should be reviewed by a person before it is relied on; see the AI clause in our Terms.

We do not sell personal information and we do not share it for advertising. We share it only in the circumstances below.

Providers we rely on to run the service

OpenAI

AI features and speech-to-text transcription. Receives the record content, call audio or transcript text needed to produce the result requested.

Bonvoice

Telephony for click-to-call. Receives the numbers involved and call metadata, and returns call state and recordings.

Razorpay

Payment processing for plans bought online. Receives your name, email address and, if you gave one, your mobile number to prefill the payment window, and collects your payment details itself.

Vultr

Cloud infrastructure. Our application, database and uploaded files run on servers we manage at this provider.

Services you choose to connect

Where your workspace administrator connects an integration — such as Google Calendar, Meta Lead Ads or WhatsApp Cloud API — data is exchanged with that service on your instruction, under that provider’s own terms. Data received from a connected Meta account is used only to create and maintain the CRM records you connected it for. Data from a connected Google account is covered separately and more strictly below, under Google user data.

Other disclosures

• Legal and safety — where required by law or lawful request, or to establish or defend legal claims, or to prevent fraud or a threat to safety.
• Business transfer — if the business is reorganised, merged or acquired, data may transfer as part of it. The receiving party would remain bound by this policy until it is replaced, and we would notify you of a change of controller. Data obtained from Google APIs is excluded from this. It would transfer in such a transaction only if we had first obtained your explicit consent, and not otherwise.

None of the circumstances above is a sale. We receive no payment or other consideration for disclosing personal information to anyone named here, and we never disclose data obtained from Google APIs for any purpose beyond the ones listed under Google user data.

Online payments are processed by Razorpay. Card, UPI and other payment details are entered in Razorpay’s payment window and handled by Razorpay; we do not receive or store them. We keep the payment and subscription references Razorpay returns, and our invoice records, so we can confirm what was bought and support your account. Connecting WhatsApp after a purchase is done through Meta’s Embedded Signup, under Meta’s own terms.

This section describes every use we make of data obtained through Google APIs. It is deliberately narrower than the rest of this policy, because Google’s terms are narrower, and where the two differ this section governs.

Insta AI 365’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, and what we do not

A workspace administrator may connect Google Calendar. When they do, we ask for permission to work with calendar events (calendar.events) and to read the email address and basic profile of the account being connected (userinfo.email, userinfo.profile, openid) so the connection can show which account it is.

The Calendar connection is one-directional. Insta AI 365 writes the meetings you schedule in the CRM onto your primary Google calendar, and updates or deletes those same meetings when you change or cancel them in the CRM. Where the meeting includes a video call, it creates the Google Meet link on that event and reads it back so the CRM can display it.

We do not read, import, index or store the other events on your calendar. The CRM has no feature that lists your Google events, and no part of the application pulls them. We ask for calendar.events rather than full calendar access precisely so that enumerating or reading your calendars is not something this application is able to do.

What we store

• The access and refresh tokens for the connection, encrypted at rest.
• The email address and display name of the connected Google account, so the workspace can see whose calendar it is writing to.
• For each CRM meeting we created, the identifier of the Google event we created and the meeting link, so we can update or remove exactly that event later.

How we limit its use

• It is used only to provide the feature the administrator connected it for — the calendar sync, or the Google Ads lead connection — and for nothing else.
• It is never sold, rented or traded, and we receive no payment or other consideration for disclosing it.
• It is never used for advertising, ad targeting, ad measurement or any marketing purpose, ours or anyone else’s.
• It is not sent to our AI providers and is not used to train, retrain or improve any AI or machine-learning model, ours or a third party’s. The AI features described above operate on CRM records; they are not given your Google calendar data, because we do not hold it.
• No human at Insta AI 365 reads it, except where you have explicitly asked us to in order to resolve a support issue you raised, where it is necessary for security — for example investigating abuse — or where the law requires it.
• It is not transferred to a third party except to the infrastructure provider that hosts our application, named above, which stores it on our behalf and does not use it for any purpose of its own.

Google Ads

A workspace administrator may also connect Google Ads, so that leads from your Google lead form ads become CRM leads. It works in two parts, and they use different permissions.

The lead submissions themselves use no Google account permission. Google posts each submission to an endpoint we give you, authenticated with a key issued for that connection, and we create a CRM lead from what the person entered on the form — their name, contact details and answers. That is advertising-form data the person gave to you, not data read from your Google account.

Connecting the account uses the Google Ads permission (adwords). When you connect, Insta AI 365asks Google which Google Ads accounts you can access, so you can choose which one this workspace is for, and then reads that one account’s own record — its customer ID, its name, and whether it is a manager account — to confirm the connection really works before marking it connected. Google publishes a single permission for its Ads API, so there is no narrower one to ask for.

Insta AI 365 creates, edits, pauses and deletes nothing in your Google Ads account. It does not read your campaigns, keywords, budgets, bids, spend or performance reports, and it never changes your advertising. The only requests it makes are the two reads described above. We store the customer ID and name of the account you chose, and the connection’s encrypted tokens — nothing else from Google Ads.

Disconnecting and deletion

You can disconnect either Google connection at any time from Settings → Integrations in the CRM. Disconnecting revokes the token with Google and deletes the stored tokens from our systems. You can also revoke our access directly from your Google Account at myaccount.google.com/permissions, which stops any further access immediately.

Tokens are kept only while the connection exists. The event identifiers and meeting links attached to your CRM meetings are CRM records and follow the retention described above; deleting the CRM meeting removes them. Meetings already written to your Google calendar belong to your Google account, and remain there unless you delete the CRM meeting while still connected, or delete them in Google. To have anything else removed, write to privacy@instaai365.com.

Our application, database and file storage run on infrastructure we manage. Some of the providers named above process data outside India — in particular, content sent to OpenAI for AI features and transcription is processed on that provider’s infrastructure, which is located outside India. Where we transfer personal information across borders, we do so to deliver the features you have enabled, and under the terms offered by those providers.

We keep information for as long as your organisation maintains an account, and afterwards only where there is a reason to. We would rather state the few periods the system genuinely enforces than publish a schedule we do not keep.

CRM records, files, communications, calls

Kept for the life of the workspace. They are yours to delete at any time from within the application; deleting a record removes it from the workspace.

AI conversation history

Retained for90 days of inactivity, after which conversations are expired automatically. This period is enforced by the system.

Backups

Encrypted database backups run daily and rotate on a 14 daily and 8 weekly schedule. Data deleted from the live system is not restored into it and ages out with the backup.

Financial records

Invoices, tax records and payment evidence are kept for the period Indian law requires a registered business to keep them, and are used for no other purpose.

Security and audit logs

Retained to investigate incidents and to demonstrate that actions — including deletions — were carried out.

The measures below are in place today:

• Traffic to the service is encrypted in transit over HTTPS.
• Passwords are stored only as cryptographic hashes and are never recoverable.
• Sessions useSecure, HttpOnly cookies with short-lived access sessions and separate refresh sessions.
• Every query is scoped to a workspace, so one organisation’s records are not reachable from another’s, and roles and permissions restrict access within a workspace.
• Uploaded files are virus-scanned before storage and served only through short-lived signed links.
• Credentials for connected integrations are encrypted before being stored.
• Database backups are encrypted at rest with AES-256, run on an automated daily schedule, and are verified.
• Administrative and authentication actions are recorded in audit logs.

We do not currently hold an external security certification such as ISO 27001 or SOC 2, and this page should not be read as claiming one. No system is completely secure; you also play a part by protecting credentials and managing who has access. Report a suspected vulnerability to legal@instaai365.com. See also our security page.

On request, and subject to verifying who you are, we will: tell you what personal information we hold about you; correct information that is wrong; provide a copy of it; and delete it, subject to the retention exceptions in section 9.

If you are a lead or customer of a business that uses Insta AI 365 (category A), that business controls your record. Contact them directly. If you contact us instead, we will refer the request to them where we can identify the workspace, and assist them in acting on it — but we will not unilaterally alter their records.

Send requests to privacy@instaai365.com. We respond as promptly as we reasonably can.

The application includes export tools that let you take your CRM records out in a portable format. Export your data before closing a workspace, because deletion is not reversible. If you need an export we cannot produce from the interface, ask privacy@instaai365.com.

You can delete individual records from within the application at any time. Deleting an entire user account or an entire workspace is handled as a request to us rather than by a self-service button, so that we can verify the request before acting on something irreversible. The full process, what is removed, and what is retained, is set out on the Data Deletion page.

Insta AI 365 is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18 as a user of the service. If you believe a child has been given access, contact privacy@instaai365.com and we will remove the account.

We update this policy as the product and the law change. The “last updated” date at the top of the page shows when it last changed. Where a change materially affects how we handle personal information, we will take reasonable steps to notify workspace administrators.

• Privacy:privacy@instaai365.com
• Legal:legal@instaai365.com
• Telephone:+91 90349 03495