Draft, not yet in force. This page is being reviewed and will apply once it is published with a date.

Who we are, and our roles

Paralleon CRM is sold and operated by:

In this policy, "Raysho", "we" and "us" mean Raysho OPC Private Limited (One Person Company). Paralleon CRM is for businesses; "customer" means the business that holds the account, and "you" means anyone whose data this policy covers.

• Controller. We decide how and why your account data, billing data and the data from visits to this website are used, and are responsible for them.
• Processor. For everything a customer stores in Paralleon CRM or syncs into it (contacts, companies, deals, notes, mail and calendar), the customer is the controller and we process it only on their instructions, under our Data Processing Agreement. If you are a customer's contact and want to reach your data, ask that business first; we will help them answer.

What we collect

• Account data: your name, email address, password (stored only as a one-way hash), time zone, photo if you add one, and your workspaces and roles.
• Customer data: the records a workspace keeps (contacts, companies, deals, projects, tasks, notes, billing records, prospects) and anything imported.
• Mail, calendar and address-book data, only when a person connects their own Google or Microsoft account: see the Google and Microsoft sections below.
• Usage logs: sign-ins, the pages and actions used, IP address, browser, and errors, to keep the service secure and working.
• Billing data: the billing contact, plan, seats, invoices and payment status. Card and bank details go straight to our payment provider; we never see or store them.
• What you send us: support emails and anything you include in them.

Why we use it, and the legal basis

We do not sell personal data, share it for cross-context advertising, or use it for advertising of any kind.

AI

• The AI features use Anthropic's models: nightly summaries of a record's activity, a summary or a reply draft when you click for one, and the assistant when you ask it a question.
• Each feature sends Anthropic only the text it needs: the record's notes and activity, and the mail with that person only where a workspace owner has allowed AI to read synced email. Attachments are never sent.
• Anthropic's commercial terms forbid it from training models on customer content. Nothing you keep in the service is used by us or anyone else to build or train any AI model.
• AI output can be wrong. It is offered as a suggestion, and nothing is sent or changed until a person clicks.

Google user data

This section covers what Paralleon CRM does with data from Google accounts. It applies when a person signs in with Google or connects their Gmail or Google Calendar.

What we access

How we use it

• Mail: we keep only the messages between you and the people already in your workspace's CRM (contacts and prospects), and show them in Chat, on those people's records and in Waiting on you. Mail with anyone else is skipped and not stored. Attachments are fetched only when you open one.
• Sending: we send only an email you have written or checked and confirmed with a click, from your own address.
• Calendar: we show meetings with your contacts on Today and on their records.
• Profile: to sign you in and show who connected a mailbox.
• Mail content goes to Anthropic for summaries and drafts only if a workspace owner turns on "Allow AI to read synced email", and only as the AI section above describes. It is never used to train AI models.

How we store it

Synced messages and events are stored in your workspace in our database (Tokyo), encrypted at rest, and seen only by members of your workspace. Google access tokens are encrypted again with their own key.

How we share it

We share Google user data only with the sub-processors that run the service (hosting, database and, where allowed, AI), as listed on Sub-processors, and only to provide the features above, or where the law requires it. We never sell it, never use it for advertising, and never let people read it except your workspace's members, and our staff only with your permission for support, for security, or where the law requires.

Keeping and deleting it

Google data is kept while the mailbox stays connected and the workspace exists. When you disconnect a mailbox, we stop syncing and revoke our access at Google, and you can choose to delete the mail synced from it at once. When a workspace is deleted, its data goes within 30 days. You can also remove our access at any time from your Google account's Third-party connections page.

Limited Use

Paralleon CRM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Its use of information received from Google Workspace APIs also adheres to the Google Workspace API User Data and Developer Policy.

Microsoft user data

When a person connects Microsoft 365, Paralleon CRM asks for User.Read, Mail.Read, Mail.Send, Calendars.Read and offline_access. It uses them exactly as for Google above: mail with the contacts and prospects in your CRM is kept and shown; other mail is skipped; it sends only what you confirm; it shows meetings with your contacts; it never changes or deletes mail or events, never sells the data or uses it for advertising, and never uses it to train AI models. Tokens are encrypted with their own key.

Disconnecting a mailbox in Settings stops the sync and deletes our tokens, and you can delete the synced mail at once. Microsoft has no way for us to remove the app from your account, so to remove it fully, go to myapps.microsoft.com (work or school accounts) or account.live.com/consent/Manage (personal accounts). An admin can remove it for a whole organisation in the Microsoft Entra admin centre; see For IT admins.

Faces and logos

To show a person's photo and a company's logo, our server (never your browser) asks Gravatar for a photo using a SHA-256 hash of the email address (never the address itself), and asks DuckDuckGo's icon service for a logo using the company's web domain, after trying the company's own website. Workspace owners can turn this off with “Show photos and logos”.

Who else receives data

Our sub-processors, each under a written agreement: see Sub-processors. Otherwise we disclose personal data only when the law requires it, to protect people's rights or safety, or to a buyer of the business under the same promises.

International transfers

We are in India; the database is in Tokyo, Japan; Cloudflare serves the app from data centres worldwide; Anthropic processes AI requests in the United States. Where data from the EU, the UK or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses (2021), with the UK International Data Transfer Addendum, in our agreements with customers and with each sub-processor.

How long we keep it

• Customer and account data: while the account lasts. When a workspace is deleted, its data is deleted within 30 days.
• Backups: each workspace's nightly backups are kept for 30 days, then deleted; deleting a workspace deletes its backups.
• Invoices and the billing records the law requires: for as long as tax law requires (8 years in India).
• Usage logs: up to 12 months, unless needed longer to look into a security incident.

Security

Encryption in transit and at rest, mailbox tokens under their own key, every workspace walled off from the others, and nightly backups. More on Security.

Your rights

Depending on where you live (the GDPR in the EU and UK, India's Digital Personal Data Protection Act, Canada's PIPEDA and Québec's Law 25, California's CCPA and similar laws), you may have the right to:

• know what we hold about you and get a copy, in a portable form;
• have it corrected or completed;
• have it deleted;
• object to or restrict how we use it, and withdraw consent where we rely on it;
• nominate someone to act for you (India);
• complain to your data-protection authority.

Write to contactus@raysho.ai. We answer within 30 days and will not treat you differently for asking. Our grievance officer, under India's IT Rules and DPDP Act, is [to fill: grievance officer], [to fill: grievance officer's email]. If your data is in a customer's workspace, we pass your request to that customer, who decides on it.

Cookies

We use only cookies that are strictly necessary for the service, so there is no cookie banner. There are no analytics, advertising or third-party cookies.

Children

Paralleon CRM is for businesses and is not for anyone under 18. We do not knowingly collect children's data; if you think we have, write to us and we will delete it.

Changes

If we change this policy, we publish the new version here with its date, and email account owners about any significant change before it applies. This is version 1.0.