Privacy Policy

Last updated 23 October 2026

Vialynx CRM (the “Service”) is run by Vialynx Inc., 873 US Route 1 #1196, North Brunswick, NJ 08902, USA (“Vialynx”, “we”, “us”). Businesses use it to manage leads, students and customers, and to run their website forms, chat, booking pages and follow-up. This policy explains what personal information the Service handles, why, who it is shared with, and the choices you have.

1. Our two roles

For businesses that use the Service and their staff, we decide how account information is used, so we are responsible for it (a “controller” or “data fiduciary”).

For the people those businesses deal with (leads, enquirers, students and parents, customers, website visitors who use a business’s chat, form or booking page, and callers to its phone agent), the business decides what to collect and how to use it. We process that information only on the business’s instructions, as its service provider (a “processor”). We call this Customer Data.

If you are a lead, student or customer of a business that uses Vialynx CRM, that business’s own privacy notice applies to you, and it is the right place to send requests about your information. If you contact us instead, we will pass your request to the business and help it respond.

2. Information we handle

Account information

Name, email address, role and workspace for each user, and the password (stored only as a one-way hash by our authentication provider).
Profile and settings, team invitations, sign-in times, and the records of who changed what in the workspace.
Business details the account owner enters: company name, brands, services, logos, contact details and knowledge-base content.

Customer Data

What a business chooses to put into or collect through the Service, for example:

Contact details (name, phone, email, city), course or service of interest, source and campaign of the enquiry, notes, tasks and deal details.
Follow-up history: call outcomes, messages prepared or sent, and opt-out choices.
Student and customer records, family codes, invoices and payment records entered by staff, and the photo, certificate name, phone and address a student gives through the business’s profile link, with their acceptance of its terms.
Submissions to the business’s web forms and lead-intake connections, which we keep exactly as received for 90 days so mistakes in formatting can be fixed.
Chat conversations on the business’s chat widget, with the visitor’s browser type and the campaign tags of the page they came from.
Appointment bookings, and, if the business turns on the phone agent, call details, transcripts and recordings.
Opens of course brochure links that a business sends, so it can see which brochure a lead viewed.

Technical information

Our hosting provider keeps standard request logs (IP address, browser type, page requested, time) to run and protect the Service. We keep these only briefly.
For billing and fair use, we record how much each workspace uses the AI features (number of AI tokens and the cost), not who the AI was talking to.

We do not buy personal information, and we do not use advertising or analytics trackers in the Service.

3. How we use it

To provide the Service: store records, show them to the right staff, run forms, chat, booking, follow-up and reports.
To send service messages: invitations, password resets, booking confirmations and reminders, daily follow-up summaries and other notices about the account.
To keep the Service secure: detect abuse and spam, limit request rates, investigate problems and keep backups.
To support you when you ask for help, and to meet legal obligations.
To improve the Service, using aggregate information about how features are used.

We use Customer Data only to provide the Service to the business that owns it. We do not sell personal information, we do not share it for targeted advertising, and we do not use one business’s data for another.

Where the EU or UK GDPR applies, our legal bases are: performing our contract with the business, our legitimate interest in running and securing the Service, compliance with law, and consent where we ask for it.

4. AI features

The Service includes optional AI features: a website chat assistant, an in-app assistant, suggested follow-up messages, analytics summaries and a phone agent. To produce an answer, the relevant information (for example the visitor’s question and the business’s course facts) is sent to our AI provider, Anthropic. Under its commercial terms, Anthropic processes this information to provide the response and does not use it to train its models.

We do not train AI models on Customer Data.
When staff approve, edit or reject a suggested message, that choice is saved and shown to the AI as an example for the same business only. It is never shared with other businesses.
Suggested follow-up messages are never sent automatically. A person reviews and sends each one.
AI can make mistakes. Businesses are responsible for checking AI output before relying on it.

5. Emails and WhatsApp messages

Email is sent through our email delivery provider, or through the business’s own email provider if it connects one. Login details for a connected email account are stored encrypted.
We do not put tracking pixels in emails.
Marketing and follow-up emails include an unsubscribe link. Once someone opts out, the Service blocks further follow-up messages to them from that business on every channel.
WhatsApp messages open in the staff member’s own WhatsApp, so WhatsApp’s own terms and privacy policy apply to them.

We share personal information only with the service providers below, who process it for us under contract and only to provide their service, and as the law requires.

Provider	What it does	Where
Supabase	Database, sign-in and file storage	USA (Virginia)
Cloudflare	Hosting, network delivery and security	Global network
Anthropic	AI responses for the AI features	USA
Mailgun (Sinch)	Email delivery	USA
Vapi	Phone agent calls, only if the business turns it on	USA
Kie.ai	AI image and video generation, only if the business uses it	Varies by model

A business may also connect its own tools, such as its own email provider or a lead connector like Make or Facebook Lead Ads. Those connections are the business’s choice and the business’s responsibility.

We may disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business, in which case this policy will continue to apply to it.

7. Cookies and browser storage

Sign-in cookies keep staff signed in. They are strictly necessary and cannot be turned off.
Browser storage remembers display preferences (such as the collapsed sidebar and accent colour).
The chat widget stores a random conversation ID and the conversation in the visitor’s browser, so the chat continues if the page reloads. Clearing the chat or the browser’s site data removes it.

We do not use advertising or analytics cookies. A business’s own website may use its own cookies, which its own notice covers.

8. How long we keep it

Account information: while the account is open, then deleted as described below.
Customer Data: until the business deletes it or closes its account.
Raw form and intake submissions: 90 days, then deleted automatically.
Backups: daily, each kept for 30 days.
Request logs: a few days.
Billing and usage records: as long as tax and accounting law requires.

When a business closes its account, we delete its data within 30 days. Copies in backups are removed as those backups expire. A business can ask us for an export of its data before closing.

9. Security

All connections use HTTPS (TLS), and the database is encrypted at rest by our database provider.
Each business’s data is kept apart at the database level, so one workspace cannot read another’s records.
Staff access follows roles and per-section permissions set by the account owner.
Email login details and other connection secrets are encrypted with a separate key, and incoming webhooks must be verified.
Access to production systems at Vialynx is limited to the people who need it.

No system is perfectly secure. If a breach affects personal information, we will tell the affected businesses without undue delay, and within 72 hours of becoming aware of it where the law requires.

10. International transfers

The Service stores data in the United States. If you use it from another country, such as India, the UK or a country in the EU, your information is transferred to and processed in the United States. Where the law requires safeguards for this, we provide them. On request, we will sign a data processing agreement with a business, including the Standard Contractual Clauses where they apply.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, update or delete your personal information, to get a copy of it, to object to or restrict some uses, and to withdraw consent at any time.

India (Digital Personal Data Protection Act, 2023): you can ask to access, correct, complete or erase your data, nominate someone to act for you, and raise a grievance with us. If we do not resolve it, you can complain to the Data Protection Board of India.
EU and UK: you also have the right to data portability and to complain to your local data protection authority.
California and other US states: you can ask what we collect and why, and ask us to delete or correct it. We do not sell or “share” personal information as those laws define it, and we will not treat you differently for using your rights. An authorised agent may make a request for you.

How to ask: email contact@vialynx.com with the subject “Privacy request”. We will confirm your identity and reply within 30 days (45 days where California law allows). If your request is about Customer Data, we will pass it to the business that holds it. To stop messages from a business, use the unsubscribe link in its email or tell the business directly.

Grievances: for questions or complaints about how we handle personal information, contact our privacy contact at contact@vialynx.com or +1 (848) 326-4522.

12. Children

Vialynx CRM is a business tool. It is not meant to be used by children, and we do not knowingly create user accounts for anyone under 18. Some businesses, such as schools and training institutes, keep records about students who are minors. Those businesses are responsible for getting the consent of a parent or guardian where the law requires it, including verifiable parental consent under India’s DPDP Act.

13. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will tell account owners by email or in the Service before it takes effect.

14. Contact us

Vialynx Inc.
873 US Route 1 #1196, North Brunswick, NJ 08902, USA
contact@vialynx.com · +1 (848) 326-4522