This policy explains what SUBANDGAIN LTD ("we", "us") collects when you use Sagscrm, why we collect it, and what you can ask us to do about it. It covers the website, the application, the order forms a business publishes through us, and the integrations it connects.
Two kinds of people appear in this policy. A business that signs up and runs its workspace here, and that business's own customers, whose details it records. For the first we decide what is collected and why. For the second the business decides, and we only hold and process the data on its instructions — so a request about your order should go to the business you ordered from, and we will help them answer it.
1. What we collect
From a business using the platform
- Account details — name, email address, phone number, business name, and a password (stored only as a one-way hash, never in a form we can read).
- Workspace content — products, stock movements, orders, agents, staff accounts, finance entries and settings you create.
- Billing records — the plan you are on, invoices, and payment references returned by the gateway. We never see or store your card details; those go directly to the payment provider.
- Technical records — the IP address and time of each sign-in, and a log of significant actions taken in your workspace, kept so you can see who changed what.
About a business's customers
When a business records an order or publishes an order form, we store what it collects — typically a name, phone number, WhatsApp number, delivery address and state, and the order itself. We do not decide what those forms ask for, and we do not use this data for our own purposes.
2. Why we use it
- To run the service: signing you in, showing your data, sending order notifications you have enabled.
- To take payment for a subscription or notification credit, and to raise invoices.
- To keep the service secure and working — detecting abuse, diagnosing faults, and keeping the audit trail a business needs to know who did what.
- To contact you about your account: service notices, billing, and support replies.
We do not sell personal data, and we do not use a business's customer records to market anything to them.
3. Where it is stored, and how it is protected
- Traffic is encrypted in transit with HTTPS.
- Passwords are hashed with bcrypt; we cannot recover them, only reset them.
- Integration credentials and access tokens are encrypted at rest.
- API keys are stored as hashes — a key is shown once, at the moment it is issued, and never again.
- Each business's data is separated at the database level, and every query is scoped to the signed-in workspace.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your data we will tell you and, where required, the regulator.
4. How long we keep it
- While your account is open — we keep your workspace data so the service works.
- After deletion — deleting a workspace removes its records. Invoices and audit logs are kept, because we are required to hold financial and access records, and a record of what was done to an account has to outlive the account.
- Backups — copies persist in backups for a short period after deletion before being overwritten.
5. Cookies
We use cookies that are necessary for the service to function: one that keeps you signed in, and one that protects forms against cross-site request forgery. We do not use advertising cookies or third-party trackers. Blocking the essential cookies will stop you being able to sign in.
6. Your rights
Under the Nigeria Data Protection Act and comparable laws elsewhere, you may ask us to show you the personal data we hold about you, correct it if it is wrong, delete it, or stop a particular use. Write to privacy@sagscrm.com and we will respond within 30 days.
If you are a customer of a business using Sagscrm, contact that business first — the data is theirs to correct or delete. If you cannot reach them, write to us and we will pass the request on.
You may also complain to the Nigeria Data Protection Commission, or to the data-protection authority where you live.
7. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
8. Changes
We will update this page when the service changes, and revise the date at the top. If a change materially affects how we handle your data we will tell you by email or in the application before it takes effect.