Legal

Privacy Policy

Bridge CRM — a product of Talent Bridge Services (OPC) Private Limited · Last updated 24 October 2026

This policy explains what personal data Bridge CRM handles, why, who else receives it, how long it is kept and what rights you have. It covers the Bridge CRM web app, the Windows and Mac desktop apps, and the Android app. Our Website Privacy Notice covers this marketing website and its enquiries. This policy takes account of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the DPDP Rules, 2025, and the Information Technology Act, 2000 and its rules as they become applicable. The DPDP framework has a phased commencement; this policy does not imply that every provision is already in force.

1. Who we are and which role we play

Bridge CRM is operated by Talent Bridge Services (OPC) Private Limited (CIN U70200UP2025OPC234985), registered office A-62, 2nd Floor, Part-B, Sector 65, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India ("Talent Bridge", "we", "us").

We play two different roles, and it matters which one applies to you:

• Business customers' data (leads, students, customers, call records, messages). The business that uses Bridge CRM (the "workspace") decides why and how this data is used. Under the DPDP Act the business is the Data Fiduciary and we are its Data Processor: we process that data only on the business's instructions, under our Data Processing Addendum. If a business contacted you through Bridge CRM, please contact that business first. We will help it answer you, and you can also write to us (section 14).
• Our own data (account users, billing contacts, website visitors, support requests, and the shared-learning dataset described in section 5). For this data we are the Data Fiduciary.

2. What we collect

We do not ask for, and businesses should not load, sensitive details such as health, religion or caste unless they have a lawful reason and the person's consent.

3. Why we use it

• To provide the service: store and organise records, route leads to agents, place and log calls, send messages the business chooses to send, produce reports.
• Bridgy, the built-in assistant: transcribe and summarise calls, draft messages, answer questions about the workspace, and show what is working (section 5).
• Security and reliability: detect misuse and unauthorised access, keep audit trails, investigate errors.
• Billing and legal duties: invoices, tax records, responding to lawful requests, enforcing our Terms.
• Improving Bridge CRM: usage metrics and, only where a workspace owner opts in, the de-identified shared-learning dataset (section 5).

We do not sell personal data. We do not build advertising profiles of individuals.

4. AI features and the providers behind them

Bridge CRM does not send your data to an outside AI provider unless your business turns on a feature that needs one and connects its own account with that provider. Today no outside AI provider is switched on for our platform. Speech and language processing that we run ourselves stays on our servers in India.

When your business connects its own AI provider account — for example Google Gemini, Deepgram, ElevenLabs or Groq — the content that feature needs is sent to that provider under your agreement and plan with them. Some providers may use what is sent to them to improve their own models, depending on that plan and the settings on that account. That choice sits with you: check your provider’s terms and switch training off there if you do not want it. The providers a feature can use are listed on our sub-processors page.

AI output can be wrong. Bridge CRM does not use AI to make decisions that have legal or similarly significant effects on a person; people at the business review and act on the output.

5. Bridgy learning

Inside each workspace. Bridge CRM keeps a record of how each lead turned out — its source, campaign, ad, ad format, UTM tags, arrival time, and whether it was contacted, qualified or won — without copying names, phone numbers, email addresses or notes. The business uses this to see which channels, campaigns and ads work and to get Bridgy's suggested next moves. This record stays inside that business's workspace, is used only for that business, and is deleted shortly after the lead itself is permanently deleted (normally within one hour).

Shared learning (off unless the workspace owner turns it on). If a workspace owner opts in, we receive a de-identified copy of those outcomes to build and improve Bridgy's marketing models for all customers. The shared copy:

• includes only leads the business collected itself — its own web forms, manual entry, file imports and imports from other CRMs;
• never includes leads from Meta (Facebook, Instagram, WhatsApp, Messenger), Google, LinkedIn, other ad platforms or lead marketplaces, because those platforms do not allow their data to be pooled;
• never includes leads marked do-not-contact or under 18;
• contains no lead ID, name, phone number, email address, note, exact date or time (only the week and hour), or exact fee (only a band); campaign names are cleaned of phone numbers, email addresses and links, and any campaign or UTM label used by fewer than five leads is left out;
• is not used to identify or contact anyone, and is never sold.

The owner can switch shared learning off at any time; sharing stops immediately. Rows already shared cannot be traced back to a person, so they are not removed.

6. Advertising measurement with Meta

A business can choose to tell Meta how its Meta leads turned out (the Conversions API for leads) and to build Meta Custom Audiences from its converted or unsuitable leads. When it does, Bridge CRM sends Meta the Meta lead ID and an outcome event, or phone numbers hashed with SHA-256 for audience matching. Leads marked do-not-contact or under 18 are never sent. If you no longer want your details used this way, ask the business to mark you do-not-contact.

7. Data from platforms

Meta. Data received through Meta's APIs, including Lead Ads, is used only to provide Bridge CRM to the business that connected its Meta account, on that business's instructions. It is never used for our own purposes, never shared with another customer and never included in shared learning, in any form, including de-identified or aggregated form.

Google. Bridge CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only for the user-facing features the business turns on, is not used for advertising, is not sold, and is never used to develop, improve or train generalised AI or machine-learning models.

LinkedIn. Leads received through LinkedIn Lead Gen are used only to deliver them to the business. They are not recorded for Bridgy learning and are not sent to AI features.

8. Who receives data

We share personal data only with the sub-processors that run the service (hosting, AI, telephony, messaging, email and payment providers, listed on the sub-processors page with purpose and country); with the platforms a business connects, when the business sends data to them; with professional advisers under confidentiality; and with authorities when Indian law requires it. If we are part of a merger or acquisition, data moves only under this policy, and we will tell workspace owners first.

9. Where data is stored

The main database and backups are hosted in India (Webyne Data Centre, Ghaziabad). Some sub-processors process data in other countries, mainly the United States and the European Union. The DPDP Act allows such transfers unless the Government of India restricts a country; we will stop transfers to any country it restricts.

10. How long we keep data

11. Security

Each business has its own separate database. Names, phone numbers, email addresses, transcripts and integration secrets are encrypted at rest, and all connections use TLS. Access follows roles set by the business, sensitive actions are audit-logged, and two-factor authentication and passkeys are available. We do not currently hold ISO 27001 or SOC 2 certification.

If a personal data breach happens, we will inform affected businesses without delay, report to CERT-In within 6 hours where its Directions require, and support the Data Protection Board of India and affected people as the DPDP Rules require.

12. Your rights

You can make the following requests under this policy. Statutory rights and regulatory complaint routes under the DPDP Act apply as the relevant provisions come into force under the official commencement notification:

• get a summary of your personal data and who it has been shared with;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed or when you withdraw consent, unless a law requires us to keep it;
• withdraw consent at any time, as easily as you gave it — this does not affect processing that already happened;
• nominate someone to exercise these rights if you die or cannot act;
• have your grievance addressed by our Grievance Officer, and use the Data Protection Board of India complaint route where available under the applicable provisions if you are not satisfied.

For data a business holds about you, ask that business first; it can export, correct, mark do-not-contact or delete your record in Bridge CRM. You can also write to us, and we will pass your request to the business and help it respond. We respond within 90 days at the latest and aim to respond within 30 days. We may need to confirm your identity first.

13. Children

Bridge CRM is a business tool and is not meant for use by anyone under 18. Some businesses, such as schools and coaching institutes, handle enquiries about students under 18. Our Terms require them to obtain verifiable consent from a parent or guardian before loading such data. Bridge CRM marks a record under 18 automatically when the person's own answers give an age, date of birth or school class that shows it, and anyone at the business can mark it by hand. A record marked under 18 is never used for advertising measurement, audiences or shared learning, and we do not track or profile children.

14. Android app permissions

• Call log and phone state: to log calls with leads against the right record and recognise an incoming lead's number.
• Phone: to place a call when the agent taps Call.
• Microphone: for voice notes and dictation. Dictation uses your phone's speech recognition service (for example Google's), which may process audio on the phone or on that provider's servers under its own terms.
• Audio files: to find call recordings the phone itself made, when the business enables recording upload.
• Camera (optional): for face check-in. Photos stay on the phone; only the face template is sent.
• Notifications, alarms and start at boot: to remind agents about callbacks.

The Windows and Mac apps keep the sign-in token sealed by the operating system's credential protection (Windows DPAPI or macOS Keychain), a local copy of recently viewed records that is removed at sign-out, and local diagnostic logs.

15. Cookies

The Bridge CRM app uses only what it needs to keep you signed in. This marketing website uses local and session storage as described in the Website Privacy Notice; it has no analytics scripts, advertising cookies or tracking pixels.

16. Changes

When we change this policy we update the date at the top. For material changes — especially to AI use, shared learning, sub-processors or platform data — we notify workspace owners at least 30 days before the change takes effect.

17. Grievance Officer and contact