Tech Whirl CRM Privacy Policy
Effective date: 11 September 2026
1. Who we are and what this policy covers
Tech Whirl CRM is a customer relationship management and social publishing application operated by T E C H W H I R L INFORMATION TECHNOLOGY CO. L.L.C, a single-owner limited liability company registered in Dubai, United Arab Emirates ("Techwhirl", "we", "us"). Techwhirl Infotech is the brand name used in connection with Tech Whirl CRM.
Our business address is Office D-71, Ibrahim Hussain Ahli Building, Al Muteena, Dubai, United Arab Emirates. Our Dubai commercial license number is 1357639 and commercial registration number is 2305448. The license is issued by Dubai's Department of Economy and Tourism and identifies its category as Department of Economic Development.
This policy describes personal information processed through Tech Whirl CRM at https://crm.techwhirl.io, including its connected social accounts, contact records, communications and publishing tools. It applies to authorized users and people whose information is entered into or received by Tech Whirl CRM.
This policy does not cover a separate Techwhirl product merely because its brand appears in a Tech Whirl CRM project. In particular, it does not describe the operation of the Coinductor wallet or the processing of wallet transactions.
For privacy questions or requests, contact office@techwhirl.io with the subject “Tech Whirl CRM privacy”.
2. Information we process
The information processed depends on the features used and accounts connected:
| Category | Information and source |
|---|---|
| User accounts | Name, email address, password hash, project membership, role and invitation information supplied by users or administrators. |
| CRM contacts | Names, company names, email addresses, telephone numbers, social profile links, contact methods, notes, relationship stages and assignments entered by authorized users or received through enabled integrations. |
| Communications | Message content, sender or recipient identifiers, channel identifiers, timestamps and delivery status for supported, connected messaging services. |
| Publishing | Draft text, uploaded media where supported, selected destination, schedule and time zone, authorizing user, publication identifiers, links, status and error records. |
| Connected accounts | Provider account identifiers, display names, connection status and credentials needed to perform authorized actions. |
| Authentication and operation | Session identifiers, authorization-state records, security rate-limit records and technical information needed to operate and troubleshoot the service. Hosting systems may also process connection and request logs. |
| Privacy and support requests | Contact details, request contents and information reasonably necessary to verify and resolve a request. |
Please do not put passwords, wallet recovery phrases, private keys or unnecessary sensitive personal information into contact notes, messages or drafts.
3. LinkedIn integration
Connecting LinkedIn is optional. LinkedIn presents its authorization screen, and you decide whether to grant access. Tech Whirl CRM does not request or receive your LinkedIn password.
The current integration requests these permissions:
| Permission | Purpose |
|---|---|
| openid and profile | Identify the LinkedIn member who authorizes the connection. |
| w_member_social | Publish text posts to that member’s personal profile following an authorized publishing instruction. |
LinkedIn’s identity response may include basic profile information. The current integration saves the member identifier and display name, together with an encrypted access token and its expiry information. It does not request the LinkedIn email permission or save a profile photo from that response.
Tech Whirl CRM also stores the drafts, uploaded images, videos and documents, schedules and publication records associated with the connection. Uploaded files are stored on our server and accessible to authorized project users. When you authorize publication, the attachment is uploaded to LinkedIn for processing and inclusion in your public post. Posts published through the current LinkedIn integration are public. Authorized owners or administrators can publish immediately or schedule posts for the connected profile; connecting an account alone does not publish a post.
The current LinkedIn integration does not import connections, read a personal inbox, send private messages, retrieve a feed, or manage company Page posts. A contact’s LinkedIn profile URL can be entered separately by a CRM user; saving that link does not import the person’s LinkedIn profile.
LinkedIn processes information it receives under its own Privacy Policy.
4. Why we use information
We use information to provide account access and project permissions; organize contacts and communications; connect accounts selected by administrators; carry out authorized publishing and messaging actions on supported services; show delivery results; investigate errors and misuse; respond to support and privacy requests; and meet applicable legal obligations.
Where consent is required, we request it for the relevant processing. Where applicable law permits, processing may also be necessary to provide an agreed service or comply with a legal obligation. Authorizing a social connection is permission for the described integration, not blanket permission for unrelated uses of personal information.
We do not sell LinkedIn information or use it for advertising targeting, mass unsolicited messaging, or unrelated profiling. We do not use LinkedIn information to train AI models. Any future material change in purpose or integration access will be explained before that processing begins, with additional consent where required.
5. Access and disclosure
Authorized members of a Tech Whirl CRM project can access information according to their role and assignment. Project owners and administrators control membership and permissions. Connecting a personal profile to a shared project enables authorized project administrators to manage its publishing workflow, so only connect it to a project you trust.
Information is disclosed to the social or messaging provider required to execute an authorized action. Public posts become accessible to the public under the destination platform’s rules.
Hosting, database, email, backup and technical support providers may process information when needed to operate Tech Whirl CRM. Access must be limited to the service they provide and subject to appropriate confidentiality and data-protection arrangements. We may disclose information where required by law or necessary to establish, exercise or defend legal claims, subject to applicable law and platform restrictions.
We do not make CRM records generally public. Public availability of a social profile does not mean that its information is unrestricted for reuse.
Personal Telegram connections
If you choose to connect a personal Telegram account, we store its authorized session encrypted on the CRM server. Login codes and two-step passwords are used to complete sign-in and are not saved. Temporary sign-in state expires after five minutes. The service uses its Telegram application ID and hash to connect.
We retrieve chat names so you can choose conversations. Only selected conversations are imported into the project inbox: initially their latest 30 messages, followed by new messages. Imported text, sender labels, timestamps and message identifiers are visible to project members according to CRM permissions. They can reply using the connected personal identity. Unselected conversation messages are not imported. Secret chats and attachment downloads are not supported by this connection.
Stop sharing a conversation to stop synchronization and replies from CRM. Disconnect to remove the locally saved authorized session and request Telegram sign-out. Existing imported messages are retained under the general deletion policy. You can independently revoke the session in Telegram Settings → Devices. If remote sign-out fails, the interface tells you to revoke it there.
6. Location and international processing
Techwhirl is registered in Dubai, United Arab Emirates. Registration in Dubai does not mean that all Tech Whirl CRM information is stored in the UAE. Connected platforms and infrastructure providers may process information in other countries.
Where a transfer is subject to data-protection restrictions, we must establish the safeguards or other lawful conditions required by the applicable rules. You can request information about the relevant recipients, processing locations and safeguards using the privacy contact above.
7. Retention, disconnection and deletion
We retain personal information only for as long as needed for the stated purpose, subject to applicable legal requirements and the connected platform’s rules. Relevant criteria include whether the account or project remains active, whether a record is needed to complete an authorized action or resolve an incident, and whether retention is legally required. Information no longer needed must be deleted or anonymized.
Disconnecting LinkedIn: an owner or administrator can disconnect the account in Tech Whirl CRM’s LinkedIn integration settings. This clears the locally stored connection credentials and cancels pending authorization attempts. It does not automatically delete the saved member identifier, display name, CRM account, drafts or publication history.
Cancel unwanted scheduled posts separately. A queued post cannot publish while its connection remains disconnected, but reconnecting before its scheduled time can allow it to run. Disconnecting cannot retract a post already sent or guarantee cancellation of an action already in progress.
You may also revoke Tech Whirl CRM’s permission in LinkedIn’s account settings. Revocation does not itself erase data already stored by Tech Whirl CRM.
Deleting data: contact office@techwhirl.io to request deletion of your Tech Whirl CRM account or associated LinkedIn information. We will verify your authority, stop the affected processing and arrange deletion of information no longer lawfully required. If a limited record must be retained, we will explain the reason and restrict its use. Deletion is handled through this request process; disconnecting is not a full-data deletion function.
Deleting a local draft or record does not delete a published post from LinkedIn. Manage already-published posts through LinkedIn. Backups are maintained for recovery and may contain information removed from the live application. The current application does not automatically expire these backups. Backup removal and any necessary restriction of access are handled by the administrator as part of a verified deletion request and applicable retention review. We will explain any backup copies that remain, why they remain, and the applicable removal arrangements when responding to your request. Information subject to a completed deletion request must not be restored to active use.
8. Cookies and security
Tech Whirl CRM uses the socialhub_session cookie to maintain authenticated access. Its configured maximum lifetime is seven days. Blocking it prevents normal signed-in use. The application also uses short-lived authorization records to validate LinkedIn connections.
The reviewed application uses password hashing, encrypted integration credentials, project and role access checks, and secure session-cookie settings in production. These measures reduce risk but cannot guarantee absolute security. Do not share account credentials; review project access and report suspected unauthorized use promptly.
9. Your choices and rights
Depending on the law that applies, you may have rights to request access to your personal information, correction, deletion, a portable copy, restriction or cessation of particular processing, and withdrawal of consent. Withdrawal does not make earlier lawful processing unlawful. Some requests may be limited by legal obligations or the rights of others.
Send requests to office@techwhirl.io. Identify the relevant project or connected account, but do not send passwords, access tokens or identity documents unless specifically requested through an appropriate secure process. We may ask for proportionate identity or authority verification. We will respond within the period required by applicable law and explain any lawful refusal or limitation.
You may also complain to the competent data-protection authority under the applicable legal regime.
10. Changes
We will publish updated versions on this page and change the effective date. We will give appropriate notice of material changes and obtain additional consent where required. New company Page or messaging functionality will require an updated description of the information and permissions involved before it is enabled.