Privacy Policy

This policy applies to all information collected or submitted on Graciax’s website and web application.

Information We Collect

When creating an account, you may be asked to enter a phone number and/or email address. These are used for logging in, responding to queries that you initiate, and notifications that you request.

We store information about your clients/leads and the activities you perform in Graciax. We also collect anonymous, aggregate statistics about product usage to help us improve the service.

Google Sheets & Apps Script data (when you connect Google):

Access to the current Google Sheet where you run the add-on (only the sheet you select), including cell values and limited metadata in selected ranges.
Storage of configuration you provide (e.g., panel code, field mappings, selected ranges) and script trigger IDs needed to automate tasks (such as onEdit/onChange/time-based triggers).

Technical Basics

If you enable notifications, we store a token to send them.
If you upload files to Graciax, we store them until you delete them.
We use cookies (and similar local storage) to keep you logged in and remember preferences.
Our servers may store basic technical informationsuch as your IP address and device/browser detailsin memory or logs for security and reliability.
For Google integrations, we may store minimal OAuth information (e.g., your Google user ID/email and Apps Script trigger IDs) strictly to operate the features you enable.

Cloudflare

For performance and overload protection, we may direct your traffic through Cloudflare before it reaches Graciax’s servers. Cloudflare has access to basic technical information (e.g., your IP address) to perform this role.

Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

Analytics

Graciax collects aggregate, anonymous statisticssuch as the percentage of users who use particular featuresto improve the product.

We do not sell personal information or use Google user data for advertising.

Information Usage

We use the information we collect to operate and improve our website, web app, and customer support.

We do not share personal information with outside parties except to the extent necessary to accomplish Graciax’s functionalityfor example, syncing the specific rows you select from your current Google Sheet to your Graciax workspace/CRM and writing back sync statusesor as required by law.

We may disclose your information in response to legal requirements, to exercise our legal rights, defend against claims, investigate illegal activities, prevent fraud or abuse, or protect our rights and property.

Security

We implement measures to help keep your information secure. All communication with the app and website uses HTTPS. Passwords are hashed using industry-standard methods (e.g., bcrypt). Access to production systems and data is restricted to authorized personnel under least-privilege principles.

Accessing, Changing, or Deleting Your Information

You may access or change your information in the Graciax web app at any time.
A workspace admin can delete the whole workspace from inside the app (Settings → Delete workspace). This removes every member’s sign-in, every record and every file the workspace holds — leads, calls and recordings, WhatsApp threads and media, documents, AI files — and cancels billing. It cannot be undone.
A workspace admin can erase an individual person (a lead) from the leads table. Erasure removes the person’s record together with their call recordings and transcripts, WhatsApp thread and media, SMS, form answers and uploads, notes, tasks and consent records. Invoices, bookings and quotes are kept without the link for the period tax and company law require; a do-not-contact mark is kept so the person is not contacted again.
You can also ask us directly — see Data Deletion and the Grievance Officer below. We act within 30 days.
Deleted information may remain in encrypted backups for up to 90 days and is only accessed if needed for disaster recovery.

Your Rights under India’s DPDP Act

Graciax is operated by Keyakash Technologies Private Limited, Bengaluru. For the information you give us to run your account — your name, email, phone number, billing details and how you use the product — we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023. For the information our customers store about their leads, contacts and customers, the customer is the Data Fiduciary and Graciax is a Data Processor acting on their instructions under our Data Processing Addendum; requests about that information should go to the business you dealt with, and we will help them answer.

Where we are the fiduciary, you have the right to:

Access — a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
Correction and completion — fix what is inaccurate or out of date; most of it you can edit yourself in the app.
Erasure — have your personal data deleted once it is no longer needed for the purpose you gave it for, unless a law requires us to keep it (see retention below).
Withdraw consent — as easily as you gave it. Withdrawing consent stops the processing that rested on it; it does not undo processing already done, and it may mean the service can no longer be provided.
Grievance redressal — a reply from our Grievance Officer within 30 days of your request.
Nominate — name a person to exercise these rights for you if you die or become incapacitated.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India after using our grievance process. We do not knowingly collect personal data from children under 18; a business account must be opened by an adult, and our customers agree not to store children’s data without verifiable parental consent.

Where we ask for your consent — for example to send you product news — we tell you at that moment what data we are asking for and why, and you can withdraw it from the same place (an unsubscribe link, a setting in the app, or by writing to us).

How Long We Keep Information

Your account — for as long as the workspace exists. When a workspace is deleted, its data is removed at once and leaves encrypted backups within 90 days.
Leads, calls, recordings and messages stored by a customer — for as long as the customer keeps them. Customers can set their own automatic windows for call recordings and call records (Calls → Retention); a window set there is enforced hourly.
Invoices, payments and tax records — 8 years, as the Companies Act, 2013 and the CGST Act, 2017 require, even after the account they belong to is gone.
Consent and opt-out records — for as long as needed to prove consent was given or to honour a request not to be contacted.
Security and access logs — at least 180 days, as CERT-In’s directions of 28 April 2022 require of Indian service providers.

Third-party Links and Content

Graciax may display links and content from external sources. These have their own independent privacy policies, and we are not responsible for their content or activities.

International Transfers of Information

Information may be processed, stored, and used outside the country in which you are located. Data privacy laws vary across jurisdictions, and different laws may apply to your data depending on where it is processed, stored, or used.

Data Collected from Google API Services (Including Google Apps Script)

Graciax integrates with Google services (Google Sheets and Apps Script) to power CRM sync and automation features you choose to enable.

Scopes and consent: We only access Google data according to the scopes you explicitly approve during OAuth/Apps Script authorization. You can revoke access at any time via your Google Account.
What we access: Only the current spreadsheet you select (specified ranges and any helper/status columns we write), Apps Script trigger IDs and configuration, and your Google user email/profile for authentication and audit purposes.
How we use it: To read selected rows, perform CRM sync, write back results, show configuration UI, and run automations you enable.
Sharing/transfer: We may transmit selected sheet data to Graciax’s backend solely to perform the requested sync and return results. We do not share Google user data with third parties for their independent use.
Retention: Spreadsheet contents remain in your Google account. We store minimal configuration and operational logs only as long as needed to provide the service (typical logs up to 30 days; backups up to 90 days).
Revocation: You can revoke Graciax’s Google access at any time via your Google Account (Security → Third-party access) and remove associated Apps Script triggers from your sheet.
Policy compliance: Graciax’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Privacy Policy: https://policies.google.com/privacy

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

Data from Meta: Facebook, Instagram and WhatsApp

Graciax CRM can connect to your Facebook Page, your Meta ad account and your WhatsApp Business Account through Meta’s login. You choose what to connect, Meta shows you the permissions we ask for, and you can remove the connection at any time.

What we access. With leads_retrieval and the Page permissions we read the leads submitted through your Lead Ads forms and the list of Pages and forms you shared. With ads_read and ads_management we read campaign results and, when you ask us to, create or change campaigns in your ad account. With whatsapp_business_management we read your WhatsApp Business Account: its phone numbers, message templates and business profile. With whatsapp_business_messaging we send messages from your number and receive the messages your customers send to it. With business_management we see which business portfolio those assets belong to, so the right one is linked.

How we use it. Only to operate the features you turned on: leads from your forms become leads in your workspace; WhatsApp messages appear in your Inbox and your replies go out from your number; ad results appear on your dashboards. We do not use Meta data for advertising of our own, we do not sell it, and we do not share it with anyone other than the sub-processors that run our service.

What we store. The access tokens Meta issues (encrypted at rest on our servers), the identifiers of the Pages, ad accounts, WhatsApp accounts and phone numbers you connected, the leads and messages themselves, and delivery receipts. Tokens are never sent to your browser.

How to remove it. Disconnect the integration inside Graciax (Integrations → Meta Leads, Meta Campaigns or WhatsApp Business → Disconnect), which deletes the stored tokens and unlinks the assets. You can also remove Graciax from Facebook → Settings → Business integrations, which revokes our access on Meta’s side. The leads and messages already in your workspace remain yours and are deleted with your account — see our Data Deletion Instructions.

Our use of data received from Meta complies with Meta’s Platform Terms and Developer Policies and the WhatsApp Business Terms.

Data from Shopify

Graciax CRM can connect to your Shopify store, either through the Graciax app on the Shopify App Store or with a custom-app token you create in your Shopify admin. You choose whether to connect, Shopify shows you the permissions we ask for, and you can disconnect at any time from Graciax (Store → Setup) or by uninstalling the app in Shopify.

What we access. With read_orders and read_fulfillments we read your orders, their payment and fulfilment state and tracking. With read_customers we read the customer on an order. With read_products and read_inventory we read your catalogue and stock levels when an agent is asked whether something is available. With read_checkouts we read abandoned checkouts so they can be recovered. With write_orders we cancel an order or add a note and tag when a customer asks and your store policy allows it. With write_price_rules we create a discount code when you approve one. We register webhooks on your store so that order, fulfilment, refund and checkout changes reach your workspace as they happen.

How we use it. Only to run the features you switched on: your orders appear in your Graciax workspace (Store), an order with a contactable customer becomes a lead in your pipeline, and your AI agents — on WhatsApp, in AI Studio and on the phone — answer your customers’ own questions about their orders, stock and returns within the policy you set. We do not use Shopify data for marketing of our own, we do not sell it, and we do not share it with anyone other than the sub-processors that run our service.

What we store. Your store’s domain, name, currency and time zone; the access token and refresh token Shopify issues (encrypted at rest, never sent to your browser); the permissions the token holds and the state of our webhooks; a mirror of your orders (order number, customer name, phone, email, city and country, the items, totals, payment and fulfilment status and tracking details); abandoned checkouts with the contact details and the marketing-consent flags Shopify records; return and cancellation requests raised through your agents; and a log of what each agent answered or did, so you can audit it. We do not store the customer’s full street address or any payment card details.

Who can see it. Only members of your own workspace, according to the roles you set; the Store policy lets an admin limit which roles may open customer details. Your customers’ data is never visible to another Graciax customer.

How it is deleted. Disconnecting in Graciax removes our webhooks from your store and deletes the stored tokens at once; the order mirror stays as your history until you delete it or uninstall. Uninstalling the Graciax app in Shopify disconnects it immediately, and on Shopify’s shop/redact notice, sent 48 hours later, the mirror, checkouts and webhook records for that store are deleted. When Shopify sends a customers/redact notice for one of your customers, their name, phone and email are removed from every order and checkout we hold. A customers/data_request is answered from your own workspace, which already holds everything we have about that customer. See our data deletion page for the general process.

Your customers. For data that reaches us from your Shopify store, you are the controller and Graciax is your processor under our Data Processing Addendum. A customer of yours who wants their data corrected or removed should contact you; if they contact us, we will tell you and act on your instruction.

Payment Gateways You Connect

Graciax CRM can send your customers a payment link for an invoice, on WhatsApp or by email, and mark the invoice paid when they pay. To do this you connect your own payment gateway account (Razorpay today) under Payments → Gateways. You choose whether to connect, and you can disconnect at any time.

Graciax does not handle the money. Each link is created on your gateway account, with your keys, and your customer pays on the gateway’s own secure page. The money goes from your customer to your gateway account and is settled to you by your gateway, under its terms. Graciax never receives, holds or transfers the funds, and card numbers, UPI details and bank credentials are entered only on the gateway’s page — they never reach Graciax.

What we send to your gateway. To create a link: the amount, the currency, the invoice number and, so the gateway can prefill its page and send its own receipt, your customer’s name, email address and phone number as they appear on the invoice.

What we store. Your gateway key identifier; your key secret and the webhook secret (encrypted at rest, never sent to a browser after you enter them); a record of who connected, changed, viewed the webhook secret of, or disconnected the gateway; each link we created (amount, invoice, the customer’s name, email and phone, how and when it was sent, and its status); and each payment your gateway confirms to us (the gateway’s transaction ID, amount, payment method such as UPI or card, the payer’s email and phone, and the time). The transaction ID and amount are also recorded on the invoice.

How we use it. Only to create and send the links you ask for, to mark invoices paid, and to show you your payments. We verify every payment notice with your webhook secret before recording it. We do not use this data for anything of our own and we do not sell it.

Messages. Payment links go out from your own WhatsApp number and your own email sender. A customer who has asked you not to contact them, or who replied STOP on WhatsApp, is not sent one on WhatsApp.

How it is deleted. Disconnecting a gateway deletes the stored keys and secrets at once. When a customer of yours is erased, their unsent and unpaid links are deleted, and the name, email and phone are removed from paid ones. Records of payments received are kept with your invoices for as long as you keep those invoices, because accounting and tax law requires businesses to keep them; they are deleted with your workspace.

Your customers. For this data you are the controller and Graciax is your processor under our Data Processing Addendum. Your gateway is a provider you have chosen and contract with directly; its handling of the payment is governed by its own terms and privacy policy.

AI Agents and Automated Messages

Graciax lets you run AI agents that reply on your WhatsApp number, make and receive phone calls and assist your team in AI Studio. To answer, an agent is given the conversation, the record of the person it is talking to and the facts you configured; that content is sent to the AI model provider for the reply and is not used by us or by them to train models. Agents identify themselves as AI when asked, act only within the limits you set, and every action they take on a record is logged. Calls and messages are stored in your workspace so your team can read them; recordings and transcripts follow the retention you choose.

Sub-processors

We use these providers to run the service, each under a contract that binds them to protect your data. We will give at least 30 days’ notice on this page before adding one that would process customer data in a new way. The named list of our infrastructure providers is available on request to support@graciax.com.

Cloud database and authentication provider — database, file storage and authentication (encrypted at rest; SOC 2 Type II attested).
Cloud hosting provider — application hosting (SOC 2 Type II and ISO 27001 certified).
Cloudflare — DNS, edge network and protection for the website and app.
Anthropic, OpenAI and Google — the AI models behind AI Studio and the agents; only the content needed for a reply is sent, and it is not used for training.
Meta — WhatsApp Business API messaging, when you connect a number.
Twilio, Exotel, Plivo, ElevenLabs, Deepgram and Cartesia — telephony and voice, when you use calling features.
Microsoft and Google — calendar and booking, when you connect one.
Shopify — your store’s data, when you connect a store.

By using our website or web app, you consent to this privacy policy.

Contacting Us

If you have questions regarding this privacy policy, please email support@graciax.com.

Grievance Officer

To exercise a right, withdraw consent, or raise a complaint about how your personal data is handled, write to our Grievance Officer. We acknowledge within 72 hours and reply within 30 days.

Email: grievance@graciax.com
Phone: +91 85480 50741
Post: Keyakash Technologies Private Limited, Attn: Grievance Officer, Rainmakers Workspace, Sree Gururaya Mansion, 8th Main Rd, KSRTC Layout, 3rd Phase, J. P. Nagar, Bengaluru, Karnataka 560078, India