Privacy policy

1. Who we are

GetReached CRM is operated by Think to Share IT Solutions Private Limited (CIN U72900WB2022PTC254361), registered at 2nd Floor, Holding No. 341, Noapara Bye Lane, Garulia, LP-32/6/1, Barrackpore, North 24 Parganas, West Bengal 743133, India ("GetReached CRM", "we", "us"). This policy applies to our website, our web application and related services.

We play two roles. For information about our own users — account holders, team members and website visitors — we are the data controller. For the leads, contacts and messages our customers manage in GetReached CRM, our customer is the controller and we act as a data processor, following their instructions under our Data Processing Agreement (DPA, set out in Section 13 below).

2. Information we collect

Information you give us

• Account details: name, work email, company, role, password and team members you invite.
• Billing details: billing contact and address. Card payments are handled by our payment provider; we do not store full card numbers.
• Support and communications: messages you send us, call notes and feedback.

Customer data you bring into GetReached CRM

• Leads and contacts: names, job titles, company details, business email addresses and phone numbers you import (including by CSV upload), find or create.
• Messages: emails, WhatsApp Business API messages and Instagram Messaging API messages sent and received through your connected accounts, and the replies drafted by the AI reply agent.
• CRM records: deals, stages, notes, activities and meetings.
• Social leads: lead details you choose to bring in from Facebook and LinkedIn, such as name, contact details and the form or campaign they came from.

Information from connected accounts

When you connect an account, we access only what the feature needs, within the permissions you grant:

Information collected automatically

• Usage data: pages and features used, device and browser type, IP address and log data.
• Email engagement: where you enable it, open and click tracking on outreach emails.
• Cookies: see Cookies below.

3. How we use information

• Provide and operate GetReached CRM: send outreach, sync replies, update your pipeline and book meetings.
• Generate personalized messages and reply drafts at your request.
• Keep accounts secure, prevent abuse and spam, and protect sender reputation.
• Provide support, send service and billing notices, and, where allowed, product updates you can opt out of.
• Understand usage in aggregate to improve the product.
• Meet legal, tax and accounting obligations.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you; our legitimate interests in running and securing the service; your consent where required (for example, non-essential cookies); and compliance with legal obligations.

4. AI processing

GetReached CRM uses AI models to research prospects from public business information you point it to, write emails, WhatsApp Business API messages and Instagram Messaging API messages, draft replies, summarize conversations, and generate personalized landing pages for individual prospects. This processing happens on your behalf and inside your workspace.

• We do not use your customer data to train models that serve other customers.
• Our AI providers process data only to return results to us, under contractual confidentiality and data protection terms.
• You control how much the AI reply agent can do on each campaign: draft only, approve before sending, or send automatically.
• A personalized prospect page is published at a public web address so the prospect can view it. Do not add information about a lead that you do not want visible to anyone with that link.

5. Sharing and sub-processors

We do not sell or rent personal information. We share it only:

• With service providers who host, secure, process payments, provide AI models or support for us, bound by contracts that limit their use of the data — currently including Render (hosting), Anthropic (AI processing) and GitHub (hosting personalized prospect pages). You can request our current full list by emailing contact@thinktoshare.com.
• With the platforms you connect (such as your email provider, the WhatsApp Business API, the Instagram Messaging API, Facebook or LinkedIn), to carry out actions you ask for.
• With an external CRM (such as Go High Level), only if you choose to connect one and only for the records you sync to it.
• Within your workspace: team members and, for agencies, the clients you give access to.
• With authorized GetReached CRM staff, limited to what is needed to provide support, keep the Service secure, or operate the platform, and subject to confidentiality obligations.
• When required by law, or to protect the rights, safety and security of our users and the public.
• As part of a merger, acquisition or sale of assets, with notice to you.

6. Data retention

We keep account information for as long as your account is active. Customer data is kept until you delete it or close your workspace; after closure we delete or anonymize it within 30 days, except where we must keep records by law. Backups are overwritten on a rolling schedule.

7. Security

We protect data with encryption in transit and at rest, access controls and least-privilege permissions, isolated client workspaces, logging and monitoring, and regular reviews of our systems and providers. No system is perfectly secure; if a breach affects your data, we will notify you as required by law.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, object to or restrict certain processing, withdraw consent, and complain to a data protection authority. This includes rights under the GDPR and UK GDPR, California privacy law, and India's Digital Personal Data Protection Act, 2023.

To make a request, email contact@thinktoshare.com. If your information is held in a GetReached CRM customer's workspace — for example, you received outreach from one of our customers — please contact that company directly; we will help them respond.

9. International transfers

We and our service providers may process information in countries other than yours, including the United States, where our hosting provider, Render, operates its infrastructure. Where required, we use safeguards such as Standard Contractual Clauses.

10. Cookies

We use essential cookies to keep you signed in and secure, and, with your consent where required, analytics cookies to understand how our site is used. You can change your choices in your browser or our cookie settings at any time.

11. Children

GetReached CRM is a business service and is not directed at children. We do not knowingly collect personal information from anyone under 18.

12. Changes to this policy

We may update this policy as our product and the law change. We will post the new version here with a new "Last updated" date and, for material changes, notify account owners by email before they take effect.

13. Data Processing Agreement

This section is the Data Processing Agreement ("DPA") between you (the "Customer", acting as data controller, or, where you process data on behalf of your own clients, as a processor instructing a sub-processor) and GetReached CRM (the "Processor") for the leads, contacts and messages in your workspace ("Customer Personal Data"). It applies automatically to every customer using GetReached CRM to process personal data, and forms part of our Terms and conditions.

Subject matter and duration

The subject matter is the processing described below, carried out so GetReached CRM can provide the Service to you. This DPA runs for as long as the Terms are in effect, and continues to apply to any Customer Personal Data GetReached CRM holds after that until it is deleted or returned.

Nature and purpose of processing

Processor obligations

GetReached CRM will:

• Process Customer Personal Data only on your documented instructions, as given through your use of the Service, unless required otherwise by law (in which case we will tell you before processing, unless the law prohibits this).
• Ensure personnel authorized to process Customer Personal Data are subject to confidentiality obligations.
• Implement the security measures described in Section 7 above.
• Assist you with data subject requests, security and breach obligations, and deletion or return of data, as described below.
• Not sell Customer Personal Data or use it to train AI models that serve other customers.

Sub-processors

You give GetReached CRM general authorization to engage sub-processors to help provide the Service, under a written agreement that imposes data protection obligations equivalent to this DPA. Our current sub-processors are Render (hosting), Anthropic (AI processing), GitHub (hosting personalized prospect pages) and, only if you choose to connect it, Go High Level (external CRM sync). We will tell you about a new sub-processor by updating this page or by email before it starts processing Customer Personal Data, and you may object on reasonable data protection grounds by emailing contact@thinktoshare.com within 30 days; if we cannot resolve your objection, either party may terminate the affected part of the Service.

Assistance and breach notification

• If a lead, contact or your team member asks GetReached CRM directly to exercise a data subject right, we will forward the request to you and may ask them to contact you instead, since you are the controller.
• We will give you reasonable assistance, through Service features or on request, to respond to data subject requests and to carry out data protection impact assessments relating to your use of the Service.
• If we become aware of a breach affecting Customer Personal Data, we will notify you without undue delay and no later than 72 hours after becoming aware of it, and provide the information reasonably available to help you meet your own notification obligations.

Audits

On reasonable written notice, no more than once per year, we will make available the information reasonably necessary to demonstrate compliance with this DPA, including by providing a copy of relevant security certifications or audit summaries where available, and will allow and contribute to audits conducted by you or an auditor you mandate, subject to confidentiality and to not disrupting other customers' data.

Return and deletion of data

You can export Customer Personal Data at any time while your account is active. On termination of the Terms, we will delete or anonymize Customer Personal Data within the period stated in Section 6 above, except where we must keep it to comply with law.

Liability and governing law

Each party's liability arising out of or relating to this DPA, and the law and courts that govern it, are the same as set out in the Terms.

14. Contact us