1. Overview
This policy explains what personal data LeadlyCRM (“we”, “us”) collects, why, who it is shared with, and what rights you have. It applies to our website at leadlycrm.site and to the LeadlyCRM web app.
LeadlyCRM is a CRM for small businesses that collect leads from their website, Facebook and Instagram lead ads, and WhatsApp. So this policy covers two kinds of data: data about you, the business owner or team member who uses LeadlyCRM, and data about your leads and customers, which you store in LeadlyCRM. Section 4 explains the second kind.
2. Who we are
LeadlyCRM is operated from India. For any privacy question, write to [email protected].
3. Data we collect about you
- Account data: name, email, business name and the team members you invite. Sign-in is handled by a secure third-party authentication provider, so we never see or store your password in readable form.
- Billing data: the plan you buy, order and payment IDs, amount, GST and validity dates. Card, UPI and bank details are collected by Razorpay and never reach us.
- Usage and technical data: IP address, browser type and error logs, used to keep the service secure and to fix problems.
- Connection data you choose to set up: described in sections 4 and 5 (Facebook and Instagram, WhatsApp).
- Messages to us: anything you send to our support email.
4. Lead and customer data you store in LeadlyCRM
Names, phone numbers, emails, notes, activity history and chat messages of your leads belong to you. For that data, you are the data controller (the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023) and LeadlyCRM is a processor that handles it only on your behalf, to run the service.
- We do not sell, rent or use your leads’ data for our own marketing.
- We access it only to run features you switched on, to give support when you ask, or to keep the platform secure.
- You are responsible for having a lawful basis, including consent where needed, to collect and contact your leads.
5. Facebook, Instagram and WhatsApp
Facebook and Instagram (Meta)
If you press “Connect Facebook”, Facebook asks you to approve permissions and choose Pages. LeadlyCRM then stores your Facebook name, and for each Page you chose: the Page ID, name, linked Instagram username and a Page access token. The token is kept only on our servers and is never sent to your browser.
We use this access only to:
- subscribe your Page to lead notifications;
- read the lead-form submissions of that Page (contact details, form answers, campaign, ad set, ad and form names) when Meta notifies us; and
- save each submission as a lead in your own LeadlyCRM account.
We do not post to your Page, message your followers, run ads for you, use this data for advertising, or share it with other customers or data brokers. You can disconnect at any time (see section 11).
If you connect a WhatsApp provider (Interakt, AiSensy or apitxt), we store your provider API key and settings on the server, never in your browser. We send template messages to your leads on your instruction and, with apitxt, store the incoming and outgoing chat messages so you can read and reply to them in LeadlyCRM. A phone number that messages you may also be saved as a new lead.
Optional AI assistant
If you turn on the WhatsApp AI assistant, the latest messages of that chat and the business facts you entered are sent to a third-party AI provider to write a reply. This happens only for chats where the assistant is on, and you can turn it off at any time.
6. How we use data
- To provide, secure and improve LeadlyCRM.
- To send service emails: welcome, password reset, payment receipt and plan or trial expiry notices.
- To process payments and keep tax records.
- To answer support requests.
- To prevent fraud and abuse, and to meet legal duties.
7. Who we share data with
We use a small number of service providers. Each gets only what it needs. We do not sell personal data.
| Provider | Purpose | Data involved |
|---|---|---|
| Authentication and database provider | Sign-in and secure data storage | Account, lead, chat and settings data |
| Hosting provider | Hosting and running the app | Requests to the app, and the data it handles |
| Meta (Facebook, Instagram) | Lead ads delivery | Login, Page and lead-form data you authorise |
| Interakt, AiSensy, apitxt | WhatsApp messaging, only if you connect one | Lead phone number, message content, your API key |
| Razorpay | Payments | Order and payment details; card and UPI data stay with Razorpay |
| Resend | Service emails | Your name, email address and email content |
| AI provider | AI assistant, only if you turn it on | Recent chat messages and your business facts |
We may also disclose data if the law requires it, to protect our legal rights, or in a business transfer. In that case we will tell affected customers first.
8. Cookies and browser storage
The app uses browser storage and cookies only for essential things such as keeping you signed in. We do not use them to build advertising profiles.
9. Security
- All traffic uses HTTPS encryption.
- API keys and Page tokens are stored on the server only. Browsers cannot read them.
- Every request to the server is checked against your sign-in, and team members only see what their role allows.
- Webhooks from Meta and WhatsApp providers are verified with signatures or secret tokens before we accept them.
No system is perfectly secure, so please use a strong password and tell us quickly if you suspect misuse.
10. How long we keep data
We keep your account and lead data while your account is active. If your trial or plan expires, your account is limited after the grace period shown in the app, and we keep your data for a limited time so you can renew. We will email you before permanently deleting an expired account. You can ask for earlier deletion at any time. Invoices and payment records are kept for as long as tax law requires. Backups expire on their normal cycle.
11. Your rights and choices
Under applicable law, including India’s Digital Personal Data Protection Act, 2023, you may:
- ask for a copy of the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data;
- withdraw consent you gave, and nominate someone to exercise your rights on your behalf; and
- complain to us, and to the relevant authority if you are not satisfied.
Disconnect Facebook: press “Disconnect” on the Facebook and Instagram card in LeadlyCRM. This stops lead delivery and deletes the stored Page tokens. You can also remove LeadlyCRM in Facebook under Settings, Business Integrations.
Delete your account: follow the steps on our data deletion page.
If you are a lead of one of our customers, please contact that business first. You may also email us and we will pass your request on.
12. Children
LeadlyCRM is a business tool for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18.
13. International transfers
Our providers may store and process data on servers in India or in other countries. Where data is transferred abroad, we rely on providers that apply appropriate safeguards.
14. Changes to this policy
We may update this policy as the product or the law changes. We will change the effective date above and, for significant changes, make a reasonable effort to tell you by email or in the app.
15. Contact us
Questions or requests: [email protected].