Privacy Policy

Leadsensy CRM ("the Service") is a customer relationship management (CRM) service run by CodeTreX Infotech Private Limited ("we", "us"). Businesses use it to receive enquiries (leads), follow them up by call, WhatsApp and email, and turn them into customers. This policy explains what data the Service handles, why, and the choices you have.

Two kinds of data

• Account data. The details of the businesses and team members who use the Service: name, work email, mobile number, company name, password (stored only as a salted hash), role and settings. We decide how this data is used.
• Customer data. What a business keeps in its own workspace: its leads, contacts, companies, deals, calls, notes, follow-ups, WhatsApp and email messages, and products. The business decides what to collect and why; we process it only on its behalf and on its instructions, to run the Service for it.

Where customer data comes from

• Entered or imported by the business's team.
• Lead sources the business connects: IndiaMART, its website forms, and other systems through its API key.
• Facebook and Instagram lead ads, when the business connects its Facebook Page (see below).
• WhatsApp, through the WhatsApp Business number the business connects: messages it sends and the replies its customers send.

Data from Facebook (Meta)

When a business clicks Connect Facebook Page and allows it, the Service receives, through Meta's official APIs:

• the list of Pages the person manages, and an access token for each Page the business chooses to connect;
• for those Pages: the lead forms, and each new lead submitted through them (the answers the person gave, such as name, phone number, email and the form's own questions), with the names of the form, ad and campaign;
• for a connected WhatsApp number: the messages, their delivery status and the approval status of message templates.

We use this data only to show the leads and messages in that business's workspace and to let its team follow them up. We do not use it for advertising, do not build profiles across businesses, and do not sell or rent it. Page and WhatsApp access tokens are stored encrypted, and are deleted when the business disconnects the Page or number. Meta's own use of data is covered by Meta's privacy policy.

How we use data

• To run the Service: show leads, assign them, set follow-ups, send the messages the business asks us to send, and show reports.
• To keep it secure: sign-in, permissions by role, an audit log of changes, and error logs to fix problems.
• To contact account users about the Service (for example a password reset, or a daily follow-up summary the business turns on).

AI features

If a business turns on its AI features, data is sent to our AI provider, OpenAI, to suggest the next step, write a message draft, or suggest a reply:

• parts of the lead's record, such as the stage, the latest enquiry, recent notes, and the recent WhatsApp messages as they were written;
• the business's own product list, prices and knowledge entries;
• for reply suggestions, earlier replies the business's team typed to other customers, with the message they answered, as examples of how the team answers.

The lead's phone number and email address fields are not sent. Text inside a message is sent as written, so a number someone typed into a chat goes with it. OpenAI processes the data to give the answer and, under its API terms, does not use it to train its models by default. A business can turn AI off at any time in its settings.

Who else handles data

We share data only with the providers needed to run the Service, each for its own task: Meta (WhatsApp messaging, Facebook and Instagram leads), OpenAI (AI features, when turned on), the email provider that sends the business's emails, the payment provider for subscription payments, and the infrastructure where the Service runs. Some of these providers (such as Meta and OpenAI) may process data outside India. We disclose data to authorities only when the law requires it.

Cookies

The Service uses cookies only to keep you signed in and to protect forms against misuse. It uses no advertising or tracking cookies. Facebook's sign-in window is loaded only when you choose to connect a Facebook Page.

Security

The Service is reached only over HTTPS. Passwords are hashed, integration tokens are encrypted, each business's data is kept separate from every other business's, and access inside a workspace follows the roles its owner sets. No system is perfectly secure; if a breach affects your data, we will tell the affected businesses and authorities as the law requires.

How long we keep data

Customer data is kept while the business's account is active, and deleted when the business asks us to delete it or closes its account (see Data deletion). Account data is kept while the account is active and for as long as the law requires afterwards (for example invoices).

Your choices and rights

• If you use the Service (a team member or account owner): you can see and correct your details in the Service, and ask us for a copy or deletion of your data.
• If a business holds your details as a lead or customer: that business decides how your data is used. Ask it directly to see, correct or delete it. Removing a lead in the Service archives it; to delete it permanently, the business asks us and we do it. You may also write to us and we will pass your request on.
• Facebook: you can remove the Service's access at any time in Facebook under Settings & privacy → Settings → Business integrations.

Contact and grievances

For questions, requests or complaints about personal data, including under India's Digital Personal Data Protection Act, 2023, write to us at the contact details on our website. We reply within 30 days.

Changes

We may update this policy as the Service changes. The date at the top shows the latest version; for a significant change we will also tell account owners in the Service or by email.