Privacy Policy — EU General Data Protection Regulation (GDPR)

Sarama CRM Platform
Controller / Company: Angad Manik, Rebgasse 53, 4058 Basel, Switzerland
Owner: Angad Bank Manik
Brand: angad.swiss is a brand of the company Angad Manik
Swiss UID: CHE-449.720.296
Data Protection Contact: Angad Bank Manik, impact@angad.swiss
Platform: sarama.angad.swiss
Effective Date: 3 September 2026

1. Introduction

This Privacy Policy explains how Angad Manik, operating under the angad.swiss brand ("we", "us", "Controller"), processes personal data in connection with the Sarama CRM platform ("Platform") in compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). The owner of the company is Angad Bank Manik.

We act in the following capacities:

• Controller for account/user data, billing data, and platform analytics;
• Processor for personal data uploaded or connected by our customers (including contact records, form submissions, email content and authorized social activity), where the customer is the Controller;
• Sub-processor where a customer, such as an agency or freelancer, processes personal data for a third-party client that is the Controller. In that case the customer remains responsible for the Art. 28 GDPR processing chain, documented instructions and authorization to appoint us.

2. Data Protection Contact

Angad Bank Manik
Rebgasse 53, 4058 Basel, Switzerland
Email: impact@angad.swiss

You may contact our data protection contact for any questions regarding data protection. We do not describe this contact as a formally appointed Data Protection Officer unless that appointment has been made.

3. Categories of Personal Data We Collect

3.1 Account & Authentication Data

3.2 Billing Data (processed by Stripe)

3.3 Customer-Uploaded Data (we process as Processor)

3.4 Tracking & Analytics Data

3.5 AI & Chat Data

When an AI agent reads or edits content on your behalf, it acts only within your own organisation and within the acting user’s permissions. Agents never receive your encrypted API keys, and they cannot access another customer’s data.

3.6 Integration Credentials

3.7 Audit & Security Data

3.8 Social Publishing & Marketing Performance Data

Social and marketing integrations are initiated by the account owner or an expressly authorized client-side administrator using their own provider authorization, and tokens are stored encrypted. When client_required is enabled, the client-side person connects the account; an invited agency, freelancer or other service provider uses separately assigned delegated permissions to prepare, approve, post, schedule or view analytics. The review requester cannot approve the same revision. Approval is tied to the current content revision, destination, media and provider settings represented by the stored canonical approval payload and its digest; a material edit invalidates it, and applicable permission and approval are checked again before execution. Only the original connector may disconnect an account and delete Sarama’s local token and connection for the workspace. Any other member, including an organization owner, may remove only their own delegated non-approval capabilities; approval authority must be revoked by the connector. The credential is never transferred to another member, and provider-side authorization remains separate. We access platform data only through accounts explicitly connected by their owner or authorized client-side administrator. For LinkedIn Company Page management, the r_basicprofile permission lets Sarama identify the authenticated administrator member behind the authorization through LinkedIn’s /v2/me endpoint. We process that member’s person URN, name and, when LinkedIn returns them, public profile URL and avatar only to link their LinkedIn authorizations and show who authorized the connection. These display fields are refreshed or purged within eight weeks.

An invited external collaborator acts under the customer’s or its client’s authority. The customer must validate that mandate, grant only the permissions needed, review and revoke them, and maintain the controller/processor/sub-processor instructions and authorization described in the DPA. A workspace invitation or technical permission alone is not proof that a social-account owner authorized the collaborator.

LinkedIn Page management can also include comments on the customer’s Page posts, timestamps, reaction counts, the commenter’s actor identifier and type, and profile fields LinkedIn may include inline with the comment response: first and last name, headline, public profile URL and avatar. Sarama does not make a separate commenter-profile lookup. It may display the name, headline and public profile link transiently only to the same LinkedIn member who connected the Community Management authorization and is associated with the Page. Comment activity and inline commenter profile fields are not persisted, added to CRM contacts or leads, exported, combined with other platforms, or sent to AI enrichment.

3.9 Google API User Data and Limited Use

Google integrations are optional and are connected only after a customer starts the relevant authorization flow. Sarama requests and uses the following Google API scopes for the stated user-facing features:

Storage and security. Google OAuth access and refresh tokens are encrypted at rest in Supabase Vault and are restricted to the connected customer workspace. Imported GA4 reports, YouTube metadata/statistics and Tag Manager inventory may be stored in the same organization-isolated platform database so the customer can view its dashboards and connection state. The customer-selected source media and metadata used for a YouTube upload are handled only to complete that requested publishing operation and under the workspace retention settings described below.

Sharing and human access. We do not sell Google user data or disclose it for advertising. We transfer it only as needed to provide or secure the customer-requested feature: to Google when making the authorized API request, to our infrastructure provider listed in Section 5 for encrypted hosting and processing, to a recipient the customer explicitly directs us to use, or where disclosure is required by law. Sarama personnel do not read Google user data except with the customer’s affirmative agreement for support, when necessary to investigate abuse or a security incident, or where required by law.

Retention and deletion. Google OAuth tokens are retained only while the connection remains active. Disconnecting the Google service in Sarama deletes Sarama’s stored tokens and connection; the customer can also revoke Sarama in their Google Account. Revocation prevents further API access. Imported Google reports, metadata, statistics and configuration inventory are deleted when the customer deletes them or the workspace, requests erasure, or when the contract ends after the 30-day export period, unless a shorter provider requirement or a legal retention duty applies. A YouTube video already uploaded to the customer’s channel remains in the customer’s Google account until the customer changes or deletes it there.

Prohibited secondary use. Sarama does not use Google API user data for personalized, interest-based or retargeted advertising; does not sell it; and does not use it to develop, improve or train generalized artificial-intelligence or machine-learning models. Any customer-requested analysis is performed only to return results to that customer and is not used to train a shared model.

Google Limited Use. Sarama’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data We Do NOT Collect

• Plaintext Sarama account passwords. Password sign-in is supported, but password verification is handled by Supabase Auth using a one-way hash; Sarama cannot read the original password.
• First-party tracking cookies beyond those disclosed below (Google Analytics and Cloudflare Turnstile set cookies as described in Section 5)
• Advertising pixels or cross-site trackers inside the Platform application (the public marketing website uses consent-gated Google Analytics as disclosed in Section 5)
• Device fingerprints
• Precise geolocation
• Session recordings
• Biometric data

5. Recipients and Sub-processors

We share personal data with the following categories of recipients:

Important: AI model API calls use the customer's own API keys. We do not control or have access to the customer's accounts with these providers. The customer initiates these data transfers and is responsible for the terms with those providers. An AI feature for which the customer has supplied no key does not run; there is no Provider-operated fallback key for customer AI traffic.

5a. Stripe — two different relationships

Our own Stripe account processes what the customer pays us: subscriptions, domain and storage add-ons, one-time and usage-based Marketplace purchases, and creator payouts. Here Stripe is our sub-processor.

The contracting Stripe entity is Stripe Payments Europe, Limited, Ireland. That follows from our own platform Stripe account being a Swiss account: Stripe’s Services Agreement names Stripe Payments Europe, Limited as the contracting entity for Switzerland, the United Kingdom and Gibraltar, and Stripe’s Data Processing Agreement names the same entity for any Stripe account not located in North or South America. Ireland is in the EEA, so there is no third-country transfer to the party we contract with, including for buyers and users in the EEA and the UK. Where Stripe processes that data onward in the United States it does so through Stripe, LLC, which is self-certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, and which additionally relies on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum under Stripe’s Data Transfers Addendum.

The customer’s own Stripe account is used where the customer sells its own products through its booking pages or chatbots (Section 14a of the Terms). That account is connected by the customer, the payment page belongs to the customer, and the money settles to the customer. In that flow the customer is the controller and Stripe is the customer’s processor under the customer’s own Stripe agreement, not ours. We are not a party to the sale, not the merchant of record, and not a payment service provider or intermediary for it: we neither receive nor hold nor route those funds, and we never see the buyer’s card data. We do process a small, closed set of identifiers as the customer’s processor — on a booking page, no visitor data at all; through a chatbot, the chat session identifier and nothing else, never the visitor’s email address. The privacy notice owed to the buyer is the customer’s. Section 14a.8 of the Terms sets out the full role split and exactly what is and is not sent.

We are moving our own platform Stripe account to a new account operated by the same company. This is an account change, not a change of recipient: the contracting entity remains Stripe Payments Europe, Limited, Ireland, and the processing purpose, the data categories, the recipient country and the safeguards are all unchanged — only the account identifier changes. Because the sub-processor itself does not change, this is not a sub-processor change requiring notice under Section 8.4(g) of the Terms; we record it here for completeness. It affects only our own account: a customer’s connected Stripe account under Section 14a is untouched by it.

5b. Where we use our own AI provider account

All AI features that operate on customer data run on the customer’s own API key (Section 3.5). We hold our own AI provider accounts for three narrowly defined purposes only, none of which processes the data of a customer’s contacts, visitors or buyers:

• Marketplace prompt safety review (Mistral, France) — a paid, optional review a Marketplace creator may buy for their own listing. The only text sent is the creator’s own instruction text (system prompt, behaviour blocks and attached skills). No buyer data and no CRM content is sent at any point.
• Agent instruction review (Mistral, France) — the same kind of automated check, offered inside the product for a customer’s own agent before it is used. Again only the customer’s own instruction text is sent.
• AI model catalogue (OpenAI, USA) — reading providers’ public model and pricing pages so the model pickers can show current models and prices. No customer data is involved.

Any further use of a Sarama-operated AI account is a change to this policy and to the sub-processor list above.

6. International Data Transfers

6.1 Our primary infrastructure is hosted by Supabase in Zurich, Switzerland. Switzerland has been granted an adequacy decision by the European Commission (Commission Implementing Decision (EU) 2024/2272).

6.2 For sub-processors located in the USA, we rely on:

• The EU-US Data Privacy Framework (where applicable);
• Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914;
• Supplementary technical measures (encryption in transit and at rest).

6.3 AI model transfers are customer-initiated: the customer provides their own API keys and chooses which models to use. We facilitate the technical connection but the customer controls the data flow.

7. Data Retention

After contract termination and the 30-day export window, customer data is permanently deleted unless retention is required by law. That general export window never extends a shorter provider-specific maximum. LinkedIn Stored Marketing Data is permanently deleted within 10 days or less after service to the connected customer ends and the data is no longer required, or after a request by the customer or Account Manager. Data requested by LinkedIn is deleted by LinkedIn’s specified deadline, which may be sooner. All Member Data is deleted immediately if Sarama’s participation in or access under the LinkedIn Marketing API Program terminates.

8. Your Rights Under the GDPR

As a data subject, you have the following rights:

For contacts stored by our customers: If you are a contact in a customer's CRM, please direct your request to that customer (the Controller). We will assist the customer in fulfilling the request as Processor.

We respond to data subject requests within 30 days. Complex requests may be extended by an additional 60 days with notification. This GDPR response period is separate from LinkedIn’s operational deletion duties: ten days or less after customer-service cessation or a customer/Account Manager request, LinkedIn’s specified deadline for data it requests, and immediate Member Data deletion when Marketing API Program participation or access terminates.

9. Security Measures

We implement the following technical and organizational measures pursuant to Art. 32 GDPR:

Technical Measures:

• AES-256-GCM encryption for API keys and sensitive credentials
• Supabase Vault for OAuth token encryption
• TLS 1.2+ for all data in transit
• Row-Level Security (RLS) on all database tables — data isolation between organizations
• HMAC-SHA256 token validation for unsubscribe links
• Content Security Policy (CSP) headers
• DOMPurify for HTML sanitization (XSS prevention)
• Rate limiting on public endpoints (5-10 requests/min/IP)
• No CORS wildcard — dynamic domain validation

Organizational Measures:

• Email verification codes, password sign-in, passkeys and linked OAuth identities; password verification is handled by Supabase Auth using a one-way hash
• Role-based access control within organizations
• Audit logging for the security-sensitive and approval-related events described above
• API key rotation recommended every 90 days
• Sub-processor agreements with all third parties
• Regular security reviews

10. Data Processing Agreement (DPA)

Section 8.4 of our Terms contains the contractual data-processing terms required for Sarama’s processor role under Art. 28 GDPR and Art. 9 nDSG. A separately signed copy is available on request from impact@angad.swiss.

The DPA covers:

• Subject matter and duration of processing
• Nature and purpose of processing
• Types of personal data and categories of data subjects
• Obligations of the Processor
• Sub-processor management
• Data subject rights assistance
• Breach notification procedures
• Audit rights

11. Data Breach Notification

In the event of a personal data breach:

• We will notify the relevant supervisory authority within 72 hours of becoming aware (Art. 33 GDPR);
• We will notify affected data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR);
• We will notify affected customers (as Controllers) immediately so they can fulfill their own notification obligations;
• We will recommend immediate API key rotation for all stored credentials.

12. Automated Decision-Making

The Platform does not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects data subjects (Art. 22 GDPR).

AI-generated content may be presented for human review or used in customer-configured automations. Customers choose the permitted workflow and approval gates; Sarama enforces human approval where a feature or provider rule requires it, including before agent-generated LinkedIn content is scheduled or published.

13. Children's Data

The Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that data from a child has been collected, we will delete it promptly.

14. Email Tracking Transparency

Our Platform enables customers to track email opens and clicks. As Processor, we provide the technical mechanism. The customer (Controller) is responsible for:

• Informing recipients about tracking in their privacy policy;
• Obtaining consent where required by applicable law;
• Providing opt-out mechanisms (unsubscribe links are mandatory).

We filter Apple Mail Privacy Protection opens (IP range 17.x.x.x) to improve accuracy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 30 days before taking effect. The current version is always available at sarama.angad.swiss/site/privacy.

16. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. Given our Swiss establishment, the lead authority is:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
https://www.edoeb.admin.ch

For EU data subjects, you may also contact your local Data Protection Authority.

17. Contact

For any privacy-related inquiries:

Company: Angad Manik
Owner: Angad Bank Manik
Brand: angad.swiss (a brand of Angad Manik)
Rebgasse 53, 4058 Basel, Switzerland
Swiss UID: CHE-449.720.296
Angad Bank Manik — Data Protection Contact
Email: impact@angad.swiss

Last updated: 3 September 2026