Privacy Policy

Last updated: October 29, 2026

This Privacy Policy explains how QoCRM ("QoCRM", "we", "us") collects, uses, stores and protects personal data when businesses and their staff use the QoCRM web application at qocrm.com and its subdomains (the "Service").

1. Who we are

The Service is operated by Individual Entrepreneur Hmayak Melkonyan, registration no. 85.1096811, tax ID 40575579, 2nd district, house 3, Hrazdan, Kotayk 2316, Armenia. Contact: support@qocrm.com.

2. Our role

• Business customers' data about their own customers (contacts, orders, messages and similar records that a business stores in its QoCRM account): the business is the data controller, and QoCRM processes this data on the business's behalf and on its instructions, as a data processor.
• Data about the people who use QoCRM (owners, administrators and managers of a business account) and about people who request access: QoCRM is the data controller.

3. Data we process

3.1 Account users

• Name, email address, interface language, role and project access within a business account.
• Password (stored only as a one-way hash) and two-factor authentication settings (stored encrypted).
• Technical data needed to run and secure the Service: session data, IP address, browser information, and records of important actions in the account (audit log).

3.2 Access requests

Name, email, phone number, company name, website and the message sent through our access request form. We store a hashed IP address to prevent abuse.

3.3 Demo requests

When you book a demo on qocrm.com, we collect your name, business name, WhatsApp number and/or e-mail, preferred time, the page language and a hashed (irreversible) IP address used only to prevent abuse. We use this data only to contact you about the demo. We delete it 90 days after the request is closed and in any case within 180 days. You can ask us to delete it earlier at support@qocrm.com.

3.4 Data that businesses store about their customers

• Contact details such as name, phone number, email, country and preferred language.
• Inquiries, orders, amounts, delivery details, recipients of orders, occasions (for example birthdays) and notes entered by the business.
• Files the business imports (for example spreadsheets of its customers).

3.5 Messages received through the WhatsApp Business Platform

When a business connects its own WhatsApp Business number to QoCRM, we receive, through Meta's official WhatsApp Business Platform (Cloud API), the messages exchanged between that business and its customers, the customers' WhatsApp phone numbers and profile names, message delivery statuses and, if the business chooses, chat history shared when the number is connected. We use this data only to display the conversations and customer history to that business and to send the messages that the business requests (for example message templates for reminders). We do not use WhatsApp data for advertising, and we do not sell or share it with third parties except as described in section 6.

4. Why we use data and legal bases

• To provide the Service to a business under our agreement with it (performance of a contract).
• To keep the Service secure, prevent abuse and fix errors (legitimate interests).
• To answer access requests and support questions (steps at the request of the person / legitimate interests).
• To meet legal obligations such as accounting and tax requirements.

We do not use personal data for automated decisions with legal effects, and we do not sell personal data.

5. How long we keep data

• Business account data is kept while the account is active. A business can delete its customers' records at any time; records moved to the trash can be restored or permanently deleted by the business.
• Imported files are deleted immediately after the import finishes (or within 24 hours if an import was not started). Import error reports are deleted after 7 days.
• Access requests are deleted 90 days after they are approved or rejected.
• Demo requests are deleted as described in section 3.3.
• When a business account is closed, its data is deleted from the Service; copies in backups are removed as backups expire.

6. Who we share data with

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it, and only as needed:

• Hosting and infrastructure providers (servers, databases, backups).
• An email delivery provider for account emails (for example password setup and reminders).
• Meta Platforms (WhatsApp Business Platform), when a business connects WhatsApp, to send and receive the business's messages.

We may disclose data if required by law or to protect the rights and safety of users and the Service.

7. International transfers

Our servers and providers may be located outside the country where you live. When data is transferred, we use appropriate safeguards required by applicable law, such as standard contractual clauses where the EU General Data Protection Regulation (GDPR) applies.

8. Security

Data is transmitted over encrypted connections (HTTPS). Each business account's data is isolated from other accounts at the application and database level. Access inside a business account is limited by roles and projects. Passwords are hashed, two-factor authentication is available, and personal data such as phone numbers and message texts is not written to ordinary application logs.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to lodge a complaint with a data protection authority.

• If you are a customer of a business that uses QoCRM, please contact that business first, as it controls your data. You can also write to us and we will forward your request to the business.
• If you are an account user or sent us an access request, contact us at support@qocrm.com.

See also how to request deletion of your data.

10. Children

The Service is intended for businesses and is not directed at children under 16. We do not knowingly collect data from children through the Service.

11. Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be communicated to account owners by email or in the Service.

12. Contact

Questions about this policy or your data: support@qocrm.com.