Privacy Policy

1. Who we are

Sutra (the "Service") is operated by the Sutra team. Reach us at support@sutra.app for any privacy-related question or request.

2. What we collect

• Account info — email, workspace name, optional name and phone, role, and the auth provider you used (email + password, Google).
• CRM data you enter — contacts, leads, deals, activities, tasks, invoices, attachments. This is yours; we store it to render the product.
• Usage telemetry — page views and web vitals via Vercel Analytics + Speed Insights. No third-party trackers, no personally-identifiable cookies beyond your Sutra session.
• Operational metadata — server logs (request paths, error stack traces) for debugging and security. Logs are retained for 30 days.

3. Where it lives

Postgres database hosted on Supabase (AWS Mumbai region for Indian customers). Application code runs on Vercel. Attachments live in Supabase Storage. We do not transfer your data outside India unless you explicitly opt in to a non-Indian feature (e.g. Stripe USD billing).

4. How it's protected

• TLS 1.3 in transit; encrypted at rest by Supabase / AWS
• Row-level security so org A can never read org B's rows
• Daily logical backups (Supabase Point-in-Time Recovery)
• Service-role keys rotated on any team member change

5. Who we share it with

Sub-processors strictly required to run the product. We never sell your data and never use it to train models we don't own.

• Supabase — database + auth + storage
• Vercel — hosting + analytics
• Anthropic (optional) — AI scoring if you enable it; transcripts of prompts only, no row data sent without your action
• Stripe / Razorpay (optional) — only the org email and amount, when you choose to pay
• Resend / Gupshup / MSG91 / AiSensy / Twilio (optional) — only when you wire them up and send a message

6. Your rights (DPDPA)

• Export all your data as CSV any time from Settings → Data
• Request deletion of your account + all associated workspace data within 7 business days
• Correct any factual mistake we hold about you
• Withdraw consent for optional sub-processors at any time

To exercise any of these, email support@sutra.app with subject "Data request". We respond within 7 business days.

7. Updates

If we materially change this policy, we'll email every active workspace admin at least 14 days before the change takes effect.

Note: this is a starter Privacy Policy intended for our launch phase. For specialised compliance reviews (large enterprise, healthcare, finance), email us and we'll provide an extended DPA on request.