Privacy Policy

MuraCRM is a sales and booking CRM for travel agencies, operated by MuraCRM. We provide the MuraCRM service to travel agencies, and we are responsible for the operation of that service and for the data it processes on our own behalf.

Travel agencies ("agencies") subscribe to MuraCRM and use it to manage their own customers. For the customer, lead, booking, and message data an agency enters or receives in MuraCRM, the agency decides why and how that data is used and we process it on the agency's behalf. If you are a customer of an agency, please contact that agency first about your data; we will help the agency respond. For agency account data and for the operation of the MuraCRM service itself, we are responsible for the data.

Agency and staff accounts. Agency name, contact phone, WhatsApp number, email, city, address, website and social links, branding images, and the agency's own terms. For each staff user: name, email address, role, a salted hash of the password (never the password itself), sign-in session records, and an activity log of important actions taken in the CRM.

Customer and travel data entered by agencies. Depending on how an agency uses MuraCRM, this can include:

• Customer and lead details: name, phone and WhatsApp numbers, email, country, city, travel interests, destinations, dates, number of travellers, budget, notes, and follow-up history.
• Quotations and bookings: packages, prices, instalment plans, traveller names and dates of birth, uploaded booking documents, supplier expenses, and payment schedules.
• Umrah bookings: pilgrim name, gender, date of birth, passport number, visa number, PNR, and hotel, flight, transport, and contact arrangements.
• Payments: amounts, methods, dates, receipt numbers, and receipt images an agency uploads. MuraCRM does not process card payments and does not collect card numbers.

Agency public pages. When a visitor sends an enquiry through an agency's public page we collect the name, phone number, and message they submit, plus any optional details they choose to add (WhatsApp number, email, country, city, package of interest, travel date, and number of travellers). Reviews include the reviewer's name, rating, and comment.

WhatsApp Business Platform. If an agency connects a WhatsApp Business number through Meta's official WhatsApp Business Platform, we receive and store: the WhatsApp Business Account ID, phone number ID, display phone number and verified business name; an access token issued by Meta (stored encrypted); messages customers send to that number (text, captions, message type, timestamps, and the sender's WhatsApp phone number); replies the agency sends from MuraCRM and their delivery status; and, where the agency keeps using the WhatsApp Business app on the same number, copies of messages sent from that app. Message content is used to show the agency its conversations and, where enabled, to help prepare lead details for staff review.

Technical data. We use a strictly necessary sign-in cookie to keep you signed in. We do not use advertising or analytics cookies on MuraCRM. Our servers may record standard request logs (such as IP address, time, and requested page) for security and troubleshooting.

• To provide the CRM: storing and displaying an agency's records to its authorised staff.
• To authenticate users, enforce roles and permissions, and keep each agency's data separate.
• To send and receive WhatsApp messages for agencies that connect a number, and show delivery status.
• To send service emails, such as follow-up reminders, to agency staff.
• To generate documents the agency requests, such as quotation and booking PDFs and receipts.
• Where an agency has enabled AI assistance, to extract structured details (for example travel dates or payment amounts) from WhatsApp messages or receipt images, for staff to review before use.
• To secure, maintain, back up, and troubleshoot the service, and to meet legal obligations.

We use the following categories of providers to run MuraCRM:

• Hosting and database: Singapore.
• Meta Platforms (WhatsApp Business Platform): only for agencies that connect a WhatsApp number; messages are exchanged through Meta's Cloud API under Meta's own terms and policies.
• Google (Gemini API): only where AI assistance is enabled for an agency; the relevant message text or receipt image is sent to Google to return structured details.
• Email delivery: an SMTP email service used to send service emails.
• Backups: copies of the database kept in system in case of some failure or data loss.

These providers process data only to provide their service to us.

We do not sell personal information and we do not share it for advertising. We share information only:

• with the authorised staff of the agency the data belongs to, according to their role;
• with the service providers listed above, to operate the service;
• with a customer or partner when an agency chooses to share a document link (share links expire after 7 days);
• when required by law, or to protect the rights, safety, and security of our users and the service.

Our platform administrators can access agency data only to operate and support the service.

Our servers are located in Singapore while backups are stored in a separate location. Meta and Google may process data in other countries under their own safeguards. Where data is transferred across borders, we rely on the safeguards offered by those providers and applicable law.

Safeguards currently built into MuraCRM include:

• Each agency's records are scoped to that agency, and staff can only access their own agency's data.
• Role-based access for owners, admins, and sales agents.
• Passwords stored only as salted scrypt hashes; sign-in sessions use HTTP-only cookies.
• WhatsApp access tokens and AI service keys encrypted at rest with AES-256-GCM.
• Incoming WhatsApp webhooks verified with Meta's signature before they are accepted.
• Document share links that expire after 7 days, and an activity log of important actions.

No system is perfectly secure. If we become aware of a security incident affecting your data, we will act to contain it and notify affected agencies as required by law.

• Agency, staff, customer, and booking records are kept while the agency's account is active, or until the agency deletes them where the CRM offers deletion.
• WhatsApp message text and captions are removed automatically after the retention period the agency sets for each connected number (default 180 days, adjustable between 7 days and 10 years). Raw WhatsApp webhook payloads are cleared on the same schedule. Message records without their text (sender number, time, type, and delivery status) remain until the agency's data is deleted.
• Disconnecting a WhatsApp number removes the stored access token.
• Database backups are kept for a limited rolling period, designed to be about 7 days on the server and about 30 days off-site, and are then overwritten.
• We may keep some records longer where the law requires it, for example financial records.

To ask us to delete data, see our Data Deletion page.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to a data-protection authority.

If your data was entered by a travel agency, contact that agency first; it controls those records. You can also contact us and we will forward your request to the agency and help it respond. We may need to verify your identity before acting on a request.

MuraCRM is a business tool and is not intended for children. Agencies may record details of child travellers (such as name and date of birth) when booking family travel; agencies are responsible for having the authority to provide that information.

We may update this policy as MuraCRM changes. We will update the "Last updated" date above and, for significant changes, take reasonable steps to inform agency owners.

For privacy questions or requests, email notifications.crm.pk@gmail.com