Privacy Policy
Lightng CRM is operated by Celestris AI Pvt Ltd, India. We collect what we need to run your CRM, never sell personal data, and give you control over it: you can export or delete your data at any time. This policy explains the details.
Last updated: 15 October 2026. Contact: hello@celestris.pro.
1. Who we are, and our two roles
Celestris AI Pvt Ltd ("we", "us") provides Lightng CRM at lightng.site. We play two different roles under data protection law, and it matters which:
- For your account (your name, email, password, billing, how you use the product), we decide how the data is used, so we are the controller (a "data fiduciary" under India's DPDP Act).
- For the people in your CRM (the contacts, leads and companies you add, and the emails you send them), you decide what goes in and why, so you are the controller and we are your processor. We handle that data only to provide the service to you, under our Data Processing Addendum.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, hashed password, workspace name, theme | You, at signup and in Settings |
| Billing | Plan, subscription status, payment records | Razorpay, when you subscribe |
| CRM content | Contacts, leads, deals, notes, tasks, calendar events, files you attach | You, your team, imports, the browser extension |
| Connected mailbox settings (password encrypted), messages you send, opens, clicks and replies | You, when you connect a mailbox and send | |
| AI usage | Messages you send Shelly, token counts, proposed and confirmed changes | You, when you use the assistant |
| Technical | Sign-in session, IP address and browser in server logs, cookieless page analytics | Your browser |
We do not collect special-category data on purpose. Please don't store health, biometric or similar sensitive data about people in the CRM unless you have a lawful basis to.
3. How we use it, and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Providing the CRM, the assistant and email features you use | Performance of our contract with you |
| Billing, invoices, tax and accounting records | Contract; legal obligation |
| Account emails: receipts, renewal and trial reminders, security notices | Contract; legitimate interests |
| Keeping the service secure, preventing abuse, debugging | Legitimate interests |
| Aggregate, cookieless analytics to improve the public site | Legitimate interests |
| Anything else | Only with your consent, which you can withdraw at any time |
We do not sell or share personal data for cross-context behavioural advertising, and we do not use your CRM data or your conversations with Shelly to train AI models. Our AI providers process them only to return an answer to you.
4. The AI assistant (Shelly)
- When you message Shelly, your message and the CRM data it needs to answer are sent to our AI provider (see Sub-processors) and the reply is sent back to you.
- Shelly cannot change your CRM on its own. Every add, edit or delete is shown to you as a card and happens only if you press Yes. We keep a record of what was proposed and what you decided.
- AI output can be wrong. Check anything important before you rely on it.
5. Email you send through Lightng
If you connect a mailbox, we store its settings with the password encrypted (AES-256-GCM) and send mail from it on your instruction. Emails can include an open-tracking pixel and tracked links, and every bulk email carries an unsubscribe link and header. People who unsubscribe are suppressed from further sends. You are responsible for having a lawful basis to email your contacts and, where the law requires it (for example under the EU ePrivacy rules), their consent to tracking.
6. The browser extension
The Lightng CRM extension for Chrome reads the LinkedIn profile or Gmail message you have open only when you press Add, and sends just the fields shown to you (name, title, company, email, links) to your Lightng CRM account. It uses your existing Lightng CRM sign-in to do so. It does not track your browsing, does not read other sites, and does not send data anywhere else. Data it saves is handled like any other CRM content under this policy.
7. Who we share it with
Only with the service providers that run the product for us, under contracts that limit them to processing on our instructions. They are listed, with their locations, on the Sub-processors page. We may also disclose data if the law requires it, to protect rights and safety, or as part of a merger or acquisition, in which case this policy would continue to apply.
8. International transfers
Celestris AI Pvt Ltd is based in India, and our main hosting is in the United States. Where we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the receiving provider, plus the safeguards described on our Security page.
9. How long we keep it
- Account and CRM data: for as long as your account exists. When you delete your account, it is deleted from our live systems straight away.
- Backups: deleted data can remain in encrypted database backups for a limited period until they are overwritten.
- Billing records: invoices and payment records are kept by our payment processor, Razorpay, for as long as tax and accounting law requires (generally up to 8 years in India), even after you delete your account.
- Sign-in sessions: expire after 30 days, or when you sign out.
- Unsubscribe records: kept so we keep honouring the opt-out.
10. Your rights
Depending on where you live, you have the right to access, correct, delete, export (portability), restrict or object to the processing of your personal data, to withdraw consent, and to complain to a regulator. Under India's DPDP Act you also have the right to grievance redressal and to nominate someone to exercise your rights. California residents have the right to know, delete, correct and opt out of sale or sharing. We sell or share nothing, so there is nothing to opt out of. We will never treat you differently for exercising a right.
- Export: any board can be exported to CSV from the board itself.
- Correct: edit your details in Settings, or any record directly.
- Delete: delete your account, and your workspace if you are its only member, from Settings → General.
- Anything else: email hello@celestris.pro. We reply within 30 days, and may need to verify it's you first.
If you are a contact in someone else's CRM, please contact the business that added you first, since they control that data. If you write to us, we'll pass your request on and help them deal with it.
11. Cookies
We use one cookie, which keeps you signed in. It is essential, so no consent banner is needed. Our analytics are cookieless. Details are on the Cookies page.
12. Security
Data is encrypted in transit, passwords are hashed with scrypt, mailbox credentials are encrypted at rest, and every query is scoped to your workspace. See Security. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
13. Children
Lightng CRM is a business tool for people aged 18 and over. We don't knowingly collect data from children, and will delete it if we learn we have.
14. Changes
If we change this policy in a way that matters, we'll update the date above and tell account owners by email or in the product before the change takes effect.
15. Contact and grievance officer
Celestris AI Pvt Ltd, India. For privacy requests, complaints and grievances, including under India's DPDP Act and IT Rules, write to our Grievance Officer at hello@celestris.pro. We acknowledge grievances within 72 hours and aim to resolve them within 30 days. You can also complain to your local data protection authority.