Privacy Policy

This explains what data EzzySync collects when you use our travel CRM platform, why we collect it, and what we do with it. It's written in plain language on purpose — if something's unclear, email support@ezzysync.com.

1. What we collect

When you sign up and use EzzySync, we collect:

• Account info — your name, email, phone, agency/company name, and password (stored hashed, never in plain text).
• CRM data you enter — leads, bookings, customer names/contacts, itineraries, invoices, and notes you add for your own agency's use.
• Payment info — handled directly by Razorpay for paid plans; we don't store your card details ourselves.
• Basic usage data — page views on our marketing site via Vercel Analytics, which doesn't use invasive tracking cookies.
• Messages from channels you connect — if you link a WhatsApp number or an Instagram account, the conversations on it (message text, sender phone number or handle, timestamps, and any photos, PDFs, audio or video sent or received) are stored in your workspace so you can read and reply from the CRM.
• Credentials for channels you connect — linking WhatsApp by QR code stores the session keys WhatsApp issues to that device. Connecting Instagram Direct stores your Instagram username and password, encrypted, because Instagram provides no other way for an app to sign in on your behalf. Connecting Gmail stores an encrypted Google OAuth token instead of any password.

2. Why we collect it

To run the CRM: store your leads and bookings, generate invoices, send OTPs for login, process your subscription payment, and let you optionally connect WhatsApp or Gmail for client communication. We don't sell your data, and we don't use your CRM data to advertise to you or anyone else.

3. Third-party services we use

To provide the platform, we send limited data to:

• Resend and our email provider — send system emails (OTPs, password resets) and, where you haven't connected Gmail, your invoices.
• Razorpay — processes plan payments.
• Google Gemini — powers AI features, if you use them. This includes itinerary generation from your prompts and, when you switch on AI auto-reply for a chat, the recent messages in that conversation — including what your customer wrote — so a reply can be drafted. AI auto-reply is off by default and is enabled per chat by you.
• Meta WhatsApp Cloud API — only if you connect your own WhatsApp Business account in Settings.
• WhatsApp (via QR link) — if you link a personal or business WhatsApp number by scanning a QR code, we connect to WhatsApp as a linked device on your behalf to send and receive your messages.
• Instagram — only if you connect an Instagram account for Direct messages; we sign in as you to read and send those DMs.
• Cloudflare R2 — stores files: attachments you upload, generated invoice PDFs, and media sent or received in chats.
• Google OAuth / Gmail API — only if you choose to connect your own Gmail account for sending emails.

Each of these only receives the specific data needed for the feature you're using.

4. How your data is stored

Records — leads, bookings, invoices, messages — are stored in a PostgreSQL database. Files (uploads, invoice PDFs, and chat media) are stored in Cloudflare R2 object storage. Every agency's data is isolated — one agency can never read or write another agency's leads, bookings, customer records, or messages. Your EzzySync password is hashed with bcrypt and cannot be read back by anyone, including us. Credentials for channels you connect — WhatsApp session keys, Instagram sign-in details, Gmail OAuth tokens — are encrypted at rest, because unlike a password they have to be usable to keep the channel connected. Login sessions use signed JWT tokens.

5. Your CRM data belongs to you

The leads, bookings, and customer records you enter are yours. We access them only to operate the platform (e.g. to render your dashboard) or if you ask us for support. We don't use them for any other purpose.

6. Cookies and analytics

Our marketing site uses Vercel Analytics for basic, privacy-friendly page-view stats — it doesn't set tracking cookies or build advertising profiles. The CRM app uses a session cookie or token to keep you logged in; that's required for the app to function.

7. Your rights

You can ask us to:

• Export a copy of your account and CRM data.
• Correct inaccurate account information.
• Delete your account and associated data (subject to what we're legally required to keep, e.g. financial records for tax purposes).
• Disconnect a linked WhatsApp or Instagram account at any time from Settings, which deletes the stored credentials for it. To disconnect Gmail, remove EzzySync from your Google Account's connected apps, or email us and we'll delete the stored token.

Email support@ezzysync.com for any of these.

8. Data retention

We keep your data for as long as your account is active. If you close your account, we delete your CRM data within a reasonable period, except records we're required to retain for legal or tax purposes.

9. Changes to this policy

If we change how we handle data, we'll update the date at the top of this page. Significant changes will be communicated by email.

10. Contact

Questions about your data? Email support@ezzysync.com.