Acceptable use policy

• Upload only personal data you have a lawful basis to process — under the DPDP Act 2023 that usually means the Data Principal’s consent or a recognised legitimate use. Purchased or scraped contact lists with no consent trail are prohibited.
• No data of persons under 18 except as Indian law permits and with verifiable guardian consent.
• No sensitive data the product is not designed to hold: SaudaFlow is a CRM, not a repository for financial credentials, health records, or government-ID databases beyond the KYC fields the product explicitly provides.
• Honour Data Principal rights requests you receive for data you hold in SaudaFlow — the product ships the workflow; using it is your obligation as the Data Fiduciary.

• SMS: commercial SMS to Indian numbers requires DLT registration of your entity, headers and templates under TRAI’s TCCCPR regulations. Do not attempt to route promotional content through transactional templates, and respect DND preferences. DLT registration takes 2–3 weeks — plan for it; we surface it on day zero of onboarding, and we will not carry unregistered traffic.
• WhatsApp: use only Meta-approved templates for business-initiated messages and comply with Meta’s Business and Commerce policies. Template content that misrepresents your identity or purpose is prohibited.
• No spam on any channel: send commercial communication only to people who have consented to hear from you or with whom you have an active business relationship, and honour every opt-out promptly.

If you enable call recording, a recording disclosure must play before recording starts, in the language you have configured for your callers — not defaulted to English for a Marathi-speaking buyer. Disabling, truncating or talking over the disclosure is a material breach. You are responsible for meeting any additional consent obligations that apply to your calls.

• Use portal integrations (99acres, MagicBricks, Housing.com and similar) only within each portal’s terms and rate limits. Do not use SaudaFlow to scrape, bulk-harvest, or evade another platform’s access controls.
• Connect only accounts you are authorised to connect. Credentials for integrations must be your firm’s own.

• No malware, phishing, or content that is unlawful under Indian law — including deceptive real-estate listings; RERA compliance for your projects and advertisements is your responsibility.
• No penetration testing, vulnerability scanning, or load testing against SaudaFlow without our prior written consent. Found a vulnerability honestly? Report it to support@saudaflow.in and give us reasonable time to fix it — good-faith reports are welcome.
• No attempts to access another tenant’s workspace or data, to circumvent seat limits, or to resell access to the service without a written agreement with us.
• No use of the service to build a competing product by systematic extraction of its features or data structures.

Proportionate and human: for most breaches we warn first and help you cure. For breaches that endanger other tenants, Data Principals, or carrier/platform relationships — spam runs, unlawful content, security probing — we may suspend immediately, then talk. Repeated or unremedied breaches end in termination under the Terms. Where the law obliges us to report unlawful content or activity, we will.