Privacy Policy

1. Who we are, and what this policy covers

m361 is a marketing platform operated by M361 Tech Services Private Limited (“we”, “us”, “our”), a company incorporated in India with CIN [CIN] and its registered office at [REGISTERED OFFICE ADDRESS, CITY, STATE, PIN CODE], India.

This policy covers the m361.in website, the m361 web application, our API, our background services and the m361 tracking script that our customers install on their own websites. It explains what personal data passes through those systems, why, who else sees it and what you can do about it.

It does not cover the websites, apps or campaigns our customers run using m361. If you have landed here after seeing our name in a cookie banner or a tracking script on someone else’s site, the organisation running that site decides what is collected there and answers for it. We are only their supplier — see The two kinds of data on this platform, and ask them for their own privacy notice.

2. The two kinds of data on this platform

Almost every question about privacy on a platform like this one turns on which of two roles we are in.

Data we decide about. Your name, your work email, which workspace you belong to, what plan you are on, whether you paid. We choose why and how that is processed, so for it we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 and the controller under the GDPR. This policy is our notice for that data.

Data our customers decide about. The contacts they import, the enquiries their forms receive, the behaviour their tracking script records, the messages they send. We hold it and act on it, but only on their instructions and only to run the features they switched on. For that data they are the Data Fiduciary or controller and we are the Data Processor or processor. We do not decide what goes in, we do not use it for our own purposes, and we do not sell it or share it for advertising.

If you are a person in a customer’s database and want your data corrected or deleted, the fastest route is that customer, because they can act immediately and we cannot act without them. If you cannot reach them, write to us at privacy@m361.in and we will forward your request and tell you we have done so.

3. What we collect about you as a customer

This is the data we hold in our own right, about the people who use m361 at work.

• Identity and sign-in. Your name, email address, phone number, profile image and sign-in metadata, held in our own database. A password is never stored: what we keep is a scrypt hash of it, from which the password cannot be recovered — not by us, and not by anyone who obtained the database. One-time codes are stored the same way, expire in ten minutes and are destroyed once used. If you sign in with Google, we hold the account identifier Google gives us and the address on it, and never see your Google password.
• Workspace and membership. The workspace you belong to, your role in it, and who invited you.
• Billing. Your plan, subscription status, renewal date, invoices and the identifier our payment provider Razorpay uses for your subscription. Card numbers, UPI handles and net-banking credentials are entered on Razorpay’s systems and are never stored by us.
• Usage and diagnostics. IP address, browser and device information, pages and features used, timestamps, and error traces — the operational logs any hosted service keeps in order to stay up and be debugged.
• Correspondence. What you write to us in support requests, and our replies.

4. What your workspace puts into m361

This is data your organisation is responsible for. We are listing it in detail because you cannot write your own privacy notice without knowing what your tools hold.

• Contacts. Name, email address, phone number in E.164 format, whatever additional attributes your import carried, per-channel consent flags, the source they came from, when they were first and last seen, and their lifecycle stage.
• Leads and notes. The enquiry, its stage, its score, who owns it, where it came from, whatever your form or webhook sent, the notes your team writes, and the value you record against it.
• Behavioural events. Page views, form submissions, message opens and clicks, and custom events, each carrying an anonymous identifier and, once identified, a link to a contact. See The tracking script.
• Attribution. Sources, mediums, campaigns and channels derived from that event stream, so an enquiry can be traced back to the click that started it.
• Messaging. Templates, campaigns and one delivery record per message per contact, carrying its status and the provider’s identifier.
• Web push subscriptions. The endpoint a visitor’s browser issued and the keys that encrypt a push to it.
• Content. Drafts, briefs, tags, media files, brand voice profiles and claims policies, plus the prompt, the output, the token counts and the cost of every AI run, which is what your usage ledger is made of.
• Connected accounts. Access and refresh tokens for the social, video and advertising accounts you connect, and the AI provider keys you supply. All of them are encrypted before they are stored, and none of them are ever sent to a browser.
• Listening data. Publicly posted content matching the keywords you track, together with the handle that published it, as published.

5. The tracking script

Customers can install a small m361 script on their own website. It records page views and custom events and sends them to us under a key identifying that site. Specifically it stores, in the visitor’s browser:

• m361_aid — a random anonymous identifier, so repeat visits can be recognised as the same browser; and
• m361_ft — the first source that browser arrived from, so a later enquiry can be credited to it.

Both are held in localStorage, not in cookies, and both are first-party to the site running the script. A visitor stays anonymous to us until the site’s own code identifies them — typically when they submit a form — at which point the identifier is linked to a contact and the earlier browsing becomes part of that person’s history.

The script sends: the page URL and title, the referring URL, UTM parameters, the event name and its properties, the anonymous identifier and a timestamp. It does not read form fields, does not record keystrokes, does not capture screens, and does not attempt device fingerprinting.

If you are a visitor to a site that runs it: clearing that site’s browser storage removes the identifier and you become a new anonymous visitor. The organisation running the site is responsible for telling you it is there and for obtaining any consent the law where you are requires. If a customer of ours has not done so, tell us at privacy@m361.in.

6. Cookies and local storage on our own site

m361.in sets one cookie to keep you signed in. It holds a random session token — not your identity, not your email, and nothing derived from your password — which our server checks against a record it can revoke at any moment. It is strictly necessary: without it there is no way to be logged in, so there is nothing to consent to and no banner to click. Signing out deletes it and destroys the record behind it.

We also use localStorage for interface preferences, such as whether you collapsed the navigation rail. That never leaves your browser.

We do not run advertising cookies, third-party analytics or cross-site trackers on m361.in, and we do not use our own tracking script to follow you around the internet.

7. AI features, and what leaves the platform

m361 does not hold a platform-wide AI key. Each workspace supplies its own key for Anthropic, OpenAI or Google under Settings, and every model call that workspace makes is billed to its own account with that provider. There is deliberately no shared key we could spend on anyone else’s behalf.

The consequences are worth being explicit about:

• When you use a feature that drafts, rewrites, summarises, tags or scores something, the content of that request is sent to the provider you chose, under your key, and is governed by your agreement with them as well as by this policy.
• We record the prompt, the response, the token counts, the latency and the cost of each run, so that your usage ledger and your plan limits mean something. That record is visible to your workspace.
• We do not use your content, your contacts or your campaigns to train models — ours or anyone else’s. What the provider you selected does is set by the terms of your account with them; the major providers do not train on API traffic by default, but that is their commitment to you, not ours to make.
• AI output is generated text. It can be wrong, and it should be read before it is published. Our Terms and Conditions say the same thing in the language of obligations.

8. Why we process data, and our legal basis

Where the GDPR applies, we rely on the following bases. Where India’s DPDP Act applies, the equivalent ground is consent or a legitimate use, principally the provision of a service you asked for.

• To provide the service — creating your workspace, running the features you switched on, sending what you told us to send. Basis: performance of a contract.
• To bill you — subscriptions, invoices, tax records. Basis: performance of a contract, and legal obligation for the records we must retain.
• To keep the platform secure and working — logging, rate limiting, abuse prevention, debugging, backups. Basis: legitimate interests in running a safe and reliable service.
• To support and communicate with you — answering requests, service notices, changes to terms. Basis: performance of a contract and legitimate interests.
• To improve the product — aggregated, workspace-level usage figures. We publish cross-workspace benchmarks only above a minimum sample size, so no single workspace can be identified from one. Basis: legitimate interests.
• To send you marketing about m361 — Basis: consent, or legitimate interests for existing customers, with an unsubscribe link in every message.
• To comply with the law — responding to lawful requests, keeping statutory records. Basis: legal obligation.

9. Who else processes data, and why

We run on other people’s infrastructure. Each of the following has access to some data because of a specific job it does, is bound by a written agreement, and may use the data only to do that job.

Beyond that list, data goes where you send it. When you connect an advertising, social or video account, we exchange data with that platform on your instruction and under its terms. When you publish a post, the post becomes theirs to distribute.

We also disclose data where the law requires it, to our professional advisers under confidentiality, and to an acquirer if the business is sold — in which case we will say so here before your data moves. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

10. Sending data outside India

Our database, application servers and several of our providers are located in the United States, so data processed by m361 is transferred outside India. India’s DPDP Act permits such transfers except to countries the Central Government restricts, and we will stop transferring to any country that is subsequently restricted.

For personal data protected by the GDPR, transfers outside the EEA are made under the European Commission’s Standard Contractual Clauses, or another approved mechanism, together with the technical measures described in How we protect data. A copy of the clauses we rely on is available on request from privacy@m361.in.

11. How long we keep data

• Workspace data — for as long as the workspace is active. You can delete individual contacts, leads, drafts and events at any time, and a deletion in the application is a deletion in the database, not a hidden flag.
• After a workspace closes — we keep it for 30 days so it can be recovered if the closure was a mistake or a payment failure, then delete it from live systems. Encrypted backups age out within a further 90 days.
• Billing and tax records — for as long as Indian tax and companies legislation requires, currently eight years, regardless of whether the workspace still exists.
• Operational logs — typically 30 days, longer where a log is part of a live security investigation.
• Suppression records — when someone unsubscribes or withdraws consent, we keep the minimum record needed to make sure they are not contacted again. Deleting that record would defeat its purpose.

12. How we protect data

• Everything travels over TLS, and the database is encrypted at rest.
• Credentials we hold on your behalf — platform access tokens, refresh tokens and AI provider keys — are encrypted with a separate key before they are stored, and are never sent to a browser.
• API keys are shown once, at creation, and only a SHA-256 hash is stored. We cannot show you a key again, because we do not have it.
• Every query is scoped to a workspace, and access is checked on the server on every request. Being signed in to one workspace grants nothing in another.
• Access by our own staff is limited to what a specific task requires.

No system is perfectly secure. If we become aware of a breach affecting personal data we will notify the Data Protection Board of India and affected users as the DPDP Act requires, and any supervisory authority and data subjects the GDPR requires, within the applicable deadlines. If you believe you have found a vulnerability, please write to security@m361.in before disclosing it publicly.

13. Your rights, and how to use them

Whoever and wherever you are, you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to a particular use, or withdraw a consent you previously gave.

Write to privacy@m361.in. We will answer within 30 days, and sooner where the law requires it. We may need to verify who you are first — usually by writing back to the address already on the account — and we will not charge you unless a request is repetitive or clearly excessive, in which case we will tell you the cost before doing the work.

If your data is in a customer’s workspace rather than in our own records, see The two kinds of data on this platform: we will pass your request to them and confirm that we have.

14. If you are in India

Under the Digital Personal Data Protection Act, 2023, you are a Data Principal and you have the right to:

• obtain a summary of the personal data we process about you and how we process it;
• have that data corrected, completed, updated or erased;
• nominate another person to exercise these rights if you die or become incapacitated;
• have a grievance answered — see Grievance redressal — before approaching the Data Protection Board of India; and
• withdraw consent as easily as you gave it.

The Act also places a duty on you not to make a false or frivolous complaint or impersonate someone else when exercising these rights.

15. If you are in the EEA, the UK or Switzerland

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting processing already carried out.

Where we rely on legitimate interests, you may object and we will stop unless we can show compelling grounds that override your interests. Where you object to direct marketing, we will stop, with no exceptions and no argument.

You may also complain to your local supervisory authority, or to the Information Commissioner’s Office in the United Kingdom. We would rather you came to us first, but nothing in this policy requires you to.

We are established in India and do not currently have an establishment in the EU. Where Article 27 requires a representative, we will appoint one and name them here.

16. If you are in California

Under the California Consumer Privacy Act as amended by the CPRA, you have the right to know what personal information we have collected, the sources it came from, the purposes we use it for and the categories of third parties we disclose it to; to delete it; to correct it; and not to be discriminated against for exercising any of these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the preceding twelve months. Because we do not, there is no opt-out link for us to give you.

The categories we collect are set out in What we collect about you as a customer and What your workspace puts into m361; the sources, purposes and recipients are in Why we process data and Who else processes data. We do not use or disclose sensitive personal information for any purpose other than providing the service, so the right to limit its use does not arise. An authorised agent may make a request on your behalf with written proof of authorisation.

17. Children, and student data

m361 is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 18 in our own right. Accounts may only be created by adults acting for an organisation.

Customers should read this paragraph carefully. m361 is used by education businesses, and candidates for school and university entrance examinations are frequently under 18. India’s DPDP Act treats anyone under 18 as a child: processing their personal data requires verifiable consent from a parent or lawful guardian, and it prohibits tracking, behavioural monitoring and targeted advertising directed at children. Similar rules apply under the GDPR and, in the United States, under COPPA.

As the Data Fiduciary for the contacts in your workspace, obtaining that consent and refraining from tracking children is your obligation, not ours — we cannot tell how old the people in your database are. Your Terms and Conditions require you to have a lawful basis for every contact you upload, and this is the case where that requirement bites hardest. If you tell us that a record belongs to a child processed without the necessary consent, we will delete it.

18. Grievance redressal, and how to reach us

If you are unhappy with how we have handled your personal data or your request about it, our Grievance Officer, appointed under the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, will answer you within 30 days.

If we cannot resolve it, you may take the matter to the Data Protection Board of India, or to your own supervisory authority if you are outside India.

19. Changes to this policy

We will update this policy as the platform changes — a new sub-processor, a new category of data, a new legal requirement. The date at the top always reflects the current version.

Where a change materially affects how we use data about you, we will tell you by email or in the application before it takes effect, and give you a reasonable opportunity to object or to close your account. Continuing to use m361 after the effective date of a change means the updated policy applies.