Privacy policy

Last updated 22 October 2026

Custin is a CRM used by education consultancies and institutions to manage student enquiries. This policy explains what we collect, why, and what you can ask us to do with it. In it, “we” is Custin, “customer” is the organisation that uses Custin, and “you” is anyone whose data is in it.

Who controls the data

A customer decides what leads and student records go into its account and why; for that data the customer is the data fiduciary (controller) and we process it on its behalf. For the accounts of the people who sign in to Custin, and for our own billing, we are the fiduciary.

What we collect

Account data: name, email, phone, role, password hash, two-factor settings, sign-in times and addresses.
Lead and student data the customer enters or connects: names, contact details, course interest, notes, documents, activities, tasks.
From connected sources the customer switches on: leads submitted on Meta (Facebook/Instagram) lead forms and Google ad forms, website forms, and call details from the Custin phone app (number, time, duration, direction — never recordings or call audio).
Usage data: pages opened and load, kept per organisation to run and size the service.

Meta and Facebook data

When a customer connects Facebook Lead Ads, Custin receives the leads submitted on that customer’s own lead forms, the list of Pages it manages, and a Page access token. We use these only to put those leads into that customer’s Custin account. We do not use Meta data for advertising, do not sell it, and do not share it with anyone other than the customer whose form it came from. Disconnecting the integration stops new data at once; see Data deletion to remove what was received.

How we use it

To provide the CRM: show, sort, assign and report on leads; send the emails and notifications the customer sets up.
To keep it secure: sign-in checks, rate limits, audit logs, backups.
To bill the customer and support it.

We do not sell personal data and do not use it to train models.

Where it is kept and for how long

Data is stored on Amazon Web Services in Mumbai (ap-south-1), encrypted at rest and in transit. Customer data is kept while the customer’s account is active and deleted after the account closes, apart from what the law requires us to keep (invoices). Backups roll off within 30 days.

Who else sees it

Only the service providers we need to run Custin (hosting, email delivery), under contracts that limit them to that purpose, and authorities where the law requires it. Our staff open a customer’s account only when that customer turns on support access.

Your rights

You can ask for a copy of your data, a correction, or its deletion. If the data is in a customer’s account (you are their student or enquiry), ask that organisation first; we help them act on it. Otherwise write to support@custin.in. We reply within 30 days. If something goes wrong with your data we will tell you and the Data Protection Board of India as the law requires.

Changes

We will post changes here and change the date at the top.

Contact

Grievances and questions: support@custin.in.