Privacy Policy

1. Introduction

Welcome to Leadflow CRM ("Leadflow", "Platform", "We", "Us", or "Our"), owned and operated by Rahul Sharma. We provide a multi-tenant Software-as-a-Service (SaaS) platform designed for real estate developers, agencies, and brokers to automate lead ingestion from Meta (Facebook & Instagram) Lead Ads, Housing.com, 99acres, Magicbricks, NoBroker, and Google Ads (Lead Form Extensions), manage customer leads, push webhooks, and trigger automated SMTP email notifications.

We respect your privacy and are committed to protecting your personal data and the lead information you process through our platform. This Privacy Policy explains how we collect, use, store, encrypt, disclose, and safeguard your data when you visit our website at leadflow.jrdizital.com or use our platform services.

2. Information We Collect

We collect information in the following categories:

A. Account & Profile Information

When you register for an account or inquire about our services, we collect:

• Personal Identity Data: Full Name, Email Address, Mobile Phone Number, WhatsApp Number.
• Business Data: Company/Agency Name, Business Address, Expected Lead Volumes.
• Account Credentials: Hashed passwords (stored securely using bcrypt).

B. Facebook & Meta Integration Data (Lead Ads)

When you connect your Facebook Page or Lead Gen Forms to Leadflow CRM via Meta OAuth Graph API (v19.0+):

• Meta Access Tokens: Encrypted Page Access Tokens used strictly to query Leadgen form definitions and subscribe to webhooks.
• Facebook Lead Payload Data: Lead ID, Lead Form ID, Created Time, Full Name, Email, Phone Number, Property Interest, Budget, Location, and any custom questionnaire responses submitted by users on your Facebook/Instagram ads.

C. SMTP Mailer Configuration

To enable automated email notifications, you may optionally provide SMTP Server Host, Port, Username, and Encrypted Password.

D. Technical & Device Logs

IP Address, browser type, operating system, referrer URL, webhook event execution timestamps, and diagnostic logs for security and performance optimization.

3. How We Use Your Data

We utilize the collected information strictly for legitimate operational purposes:

• To deliver, maintain, and automate your Leadflow CRM dashboard services.
• To receive realtime Facebook Lead Ads webhooks and route incoming leads immediately to your registered tenant account.
• To send automated email alerts to you or your sales team via configured SMTP mailers.
• To process subscription billing transactions securely via our payment gateway partner, Cashfree Payments.
• To prevent fraudulent access, monitor webhook health, and maintain strict multi-tenant security isolation.
• To comply with statutory legal obligations under Indian law.

4. Meta (Facebook) Lead Ads Data Privacy Compliance

Leadflow CRM complies strictly with the Meta Platform Terms and Developer Policies:

• Sole Purpose Processing: Facebook lead data is fetched solely to populate your private CRM workspace.
• Token Encryption: All Meta Access Tokens are encrypted at rest using AES-256 cipher encryption.
• Data Minimization: We only request permissions necessary for Lead Ads webhook delivery (leads_retrieval, pages_manage_ads, pages_read_engagement).
• User Control: You can disconnect your Facebook Page or revoke Leadflow's Meta App access at any time from your Facebook Business Settings or Leadflow Dashboard.

5. Compliance with DPDP Act 2023 (India) & GDPR

As an Indian SaaS provider servicing users globally, we adhere to the Digital Personal Data Protection (DPDP) Act, 2023 of India and the General Data Protection Regulation (GDPR).

Data Principal & Subject Rights:

• Right to Access: You can view and download all synced leads in CSV/JSON format at any time.
• Right to Correction: You can edit profile or configuration details via your Account Settings.
• Right to Erasure / Right to Be Forgotten: You can request complete deletion of your account and associated lead records by contacting our Grievance Officer. Data is permanently purged within 7 business days.
• Right to Consent Withdrawal: You may withdraw your processing consent by closing your account or disconnecting integrations.

6. Payment Processing (Cashfree)

Subscription billing and online payments on Leadflow CRM are securely processed via Cashfree Payments India Private Limited. When making a payment:

• Payment transactions are handled directly through Cashfree's PCI-DSS Level 1 compliant payment gateway.
• Leadflow CRM does not store full Credit/Debit Card numbers, CVVs, or Netbanking passwords on our servers.
• Cashfree collects transaction details, billing address, and payment method tokens in accordance with their privacy policy available at cashfree.com/privacy-policy.

7. Data Security & Storage

We employ enterprise-grade administrative, technical, and physical security measures:

• Encryption in Transit: All HTTP traffic is enforced via SSL/TLS 1.3 encryption (HTTPS).
• Tenant Isolation: Database queries strictly scope data by crm_user_id to prevent cross-tenant data leakage.
• Regular Backups: Secure database snapshots stored in encrypted environments.

8. Grievance Officer & Contact Information

In accordance with the Information Technology Act 2000, DPDP Act 2023, and applicable rules, the details of our Founder & Data Grievance Officer are provided below: