Privacy Policy

Last updated: 18 October 2026

This policy explains what personal data AgentDesk collects when you use our website and the AgentDesk web app (and the iPhone and Android apps, once they are available), why we collect it, who we share it with and the choices you have. If you are a client of an advisor who uses AgentDesk, your advisor’s organisation decides what is recorded about you; see section 2.

1. Who we are

AgentDesk is a customer relationship management (CRM) service for Indian insurance agents, mutual fund distributors, financial advisors and loan DSAs. It is provided by Everspan Solutions LLP, a limited liability partnership registered in India with the Ministry of Corporate Affairs (“AgentDesk”, “we”, “us”). For other information about us, visit https://everspansolutions.com/.

For any question about this policy or your personal data, or to raise a grievance, write to support@agentdesk.co.in (see section 12).

2. What this policy covers

This policy covers personal data we decide how to use, including:

• visitors to our website at agentdesk.co.in, including people who send an enquiry or book a demo;
• people who sign up for AgentDesk and the users their organisation adds (owners, managers, agents and viewers);
• billing contacts of subscribing organisations.

Data your organisation records in AgentDesk. Organisations use AgentDesk to record information about their own clients, family members, nominees, leads and referrers. For that data, the organisation is responsible for deciding what is collected and why, and for informing those people and obtaining any consent required. We process it only on the organisation’s instructions, as described in our Data Processing Terms. If you are a client of an organisation that uses AgentDesk, please contact that organisation about your data; we will help them respond to your request.

3. Information we collect

When you contact us or book a demo

Your name, mobile number, email address and, where you choose to give them, your organisation, city, business type, team size, number of active clients, the problem you want to solve, your preferred demo date and time, and your message.

Before an enquiry form can be sent, we ask you to confirm your mobile number with a one-time code sent by SMS. This is handled by Google Firebase Authentication, which receives your mobile number to send the code and runs Google reCAPTCHA to prevent abuse.

When you sign up or use AgentDesk

• Account details: name, email address, mobile number, organisation name, your role and permissions.
• Sign-in and security: your password (stored only as a one-way bcrypt hash), mobile verification and one-time sign-in codes (sent through Firebase), two-factor authentication settings, failed sign-in attempts and sign-in times.
• Technical data: IP address, browser and device type, operating system, app version and error logs, used to keep the service secure and working.
• Activity records: actions taken in your organisation’s account (for example records created, changed, exported or deleted), so administrators can see who did what.
• Support: messages, screenshots and attachments you send with a support ticket, and replies sent by email.

Billing

Your organisation’s plan, billing contact, GST details, invoices and payment status. Payments are processed by Razorpay. We do not receive or store your full card number, UPI PIN or net banking credentials.

Services you choose to connect

• Google Drive: when an administrator connects Google Drive, we store an encrypted access token so AgentDesk can save and open your organisation’s documents and daily backups in that Drive account. The files themselves are stored in your Google Drive, not on our servers.
• Google Calendar: if a user connects their calendar, we use it to add the Planner activities they choose to sync.
• Meta Lead Ads: if an administrator connects Facebook Pages, we receive the answers people submit in those Pages’ Facebook and Instagram lead ad forms, with the campaign, ad set and ad names, and add them to your Leads. We keep an access token for each connected Page. If you remove AgentDesk in your Facebook settings or ask Meta to delete your data, we delete the connection and its tokens; leads already in AgentDesk stay with your organisation.
• Website forms and webhooks: enquiries your organisation’s own website sends to AgentDesk are added to your Leads.

Mobile apps (coming soon)

When available, the iPhone and Android apps will use your camera, photos or files only when you choose to upload a document or photo. Sign-in tokens will be kept in your device’s secure storage. We will not read your contacts, messages or location.

4. How we use your information

• to provide AgentDesk: create and manage accounts, keep organisations separate, apply roles and permissions, store and back up data, and send the emails the service depends on (for example the 8 AM daily work email, renewal and subscription reminders, password and verification messages);
• to verify mobile numbers and protect accounts (one-time codes, two-factor authentication, lock-outs after repeated failed sign-ins, rate limits);
• to respond to enquiries, arrange demos and provide support;
• to arrange demos and manage subscriptions, invoices and payments;
• to maintain, troubleshoot and improve the service;
• to meet legal, tax and regulatory obligations and to enforce our Terms of Service.

We do not sell personal data, and we do not use the data your organisation records about its clients for our own marketing.

5. Legal basis

We process personal data in line with applicable Indian law, including the Information Technology Act, 2000 and its rules and the Digital Personal Data Protection Act, 2023. We rely on your consent (for example when you submit an enquiry form), on what is needed to provide the service you or your organisation signed up for, and on legal obligations. Where we rely on consent you can withdraw it at any time (section 10); this does not affect processing that has already taken place.

6. Who we share it with

We share personal data only with service providers that help us run AgentDesk, under contracts that require them to protect it and use it only for that purpose:

We may also disclose information when required by law, court order or a government authority, to protect the rights, safety and security of our users or AgentDesk, or as part of a merger or sale of the business (in which case this policy will continue to apply).

7. Where your data is stored

AgentDesk data is stored on servers in Mumbai, India. Some providers listed above (for example Google and Meta) may process data outside India. Where that happens, we rely on their contractual and security commitments and comply with any restrictions the Government of India places on transfers.

8. How we protect it

• All connections use HTTPS encryption.
• Passwords are stored as bcrypt hashes; stored Google access tokens are encrypted (AES-256-GCM).
• Short-lived sign-in tokens, optional authenticator-app two-factor authentication, mobile OTP and account lock-out after repeated failed attempts.
• Role-based permissions down to view, create, edit, delete and export for each module; payout figures hidden from staff without permission.
• Each organisation’s data is kept separate from every other organisation’s.
• Typed confirmation before deleting records or resetting organisation data.
• Daily backups saved to the organisation’s own Google Drive.

No system is completely secure. If a personal data breach affects you, we will inform you and the authorities as required by law.

9. How long we keep it

• Enquiries and demo requests: for up to 3 years after our last contact with you, unless you become a customer.
• Account and organisation data: while the subscription is active. When a subscription ends, the account first keeps full access for a short grace period, then becomes read-only, then is suspended; administrators can download a full backup throughout. We delete a suspended organisation’s data 90 days after suspension, or sooner if an administrator asks us to.
• Billing records: for as long as tax and accounting law requires (generally 8 years).
• Security logs: for up to 1 year.

Documents and backups stored in your organisation’s Google Drive stay under your control and are not deleted by us.

10. Your rights

Subject to applicable law, you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, where we no longer need it or you withdraw consent;
• withdraw consent you have given;
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with us at support@agentdesk.co.in and, if you are not satisfied with our response, complain to the Data Protection Board of India.

Many changes can be made directly in AgentDesk (Profile and Settings). Otherwise, email support@agentdesk.co.in. We may need to verify your identity, and we will respond within the time the law requires. If your request concerns data an organisation recorded about you, we will pass it to that organisation.

11. Cookies and similar technologies

Our website does not use advertising or tracking cookies. It loads fonts from Google Fonts and animation code from a public content network, which receive your IP address in order to deliver those files. When you verify a mobile number, Google reCAPTCHA may set cookies to tell people from bots. Website administrators who sign in to WordPress receive essential sign-in cookies.

The AgentDesk web app stores your sign-in session and display preferences (such as light or dark mode) in your browser’s storage. These are needed for the app to work and are not used for advertising.

If we add analytics or marketing tools in future, we will update this policy and ask for consent where required.

12. Grievance redressal and contact

To raise a grievance about how we handle personal data, or for any other question about this policy, contact us:

Email: support@agentdesk.co.in
Website: https://everspansolutions.com/

13. Children

AgentDesk is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children through our website or sign-up. Organisations that record information about minors (for example a client’s child named on a policy) are responsible for doing so lawfully, including obtaining a parent’s or guardian’s consent where required.

14. Changes to this policy

We may update this policy as AgentDesk or the law changes. We will post the new version here with a new “Last updated” date and, for significant changes, notify account administrators by email or in the app.