Privacy Policy

1. Data we collect

We collect personal data only to the extent needed to provide our services:

• Account data — your name, email address, phone number, and organisation name when you sign up.
• WhatsApp session data — the WhatsApp number(s) you connect, session authentication state (encrypted), and messages sent and received through the platform on your behalf.
• CRM data — contacts, companies, deals, notes, tasks, and call logs you create inside Leadcues.
• Billing data — plan, payment history, and transaction IDs. Card details are processed and stored by Razorpay — we never see or store raw card numbers.
• Usage data — IP address, browser type, and pages visited, used for security monitoring and product analytics.

2. How we use your data

• To operate and maintain the Leadcues platform and deliver the features you use.
• To connect your WhatsApp number and send/receive messages on your behalf.
• To process payments and manage your subscription.
• To authenticate users and manage team access within your organisation.
• To send transactional emails (e.g. password reset, billing receipts).
• To monitor security, prevent fraud, and resolve platform issues.
• To comply with applicable laws including India's DPDP Act 2023 and GDPR.

We do not sell your personal data. We do not use your data for advertising.

3. Third-party processors

We share data with the following sub-processors only to the extent required to operate our service:

4. Data retention

We retain your data for as long as your account is active. If you delete your account, personal data is removed from production systems within 30 days, and from backups within 60 days. Anonymised billing records (transaction IDs, plan history) may be retained longer for legal and tax compliance. WhatsApp message content is retained for the duration of your subscription and deleted on account closure.

5. Data security

All data is transmitted over TLS. WhatsApp session credentials are encrypted at rest using AES-256-GCM before storage. Database access is controlled by row-level security policies — no user can access another organisation's data. Production infrastructure access is restricted to a minimal set of engineers. See our Security page for full details.

6. Your rights

Under India's Digital Personal Data Protection Act 2023 (DPDP) and the GDPR (for EU residents), you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion (erasure) — request deletion of your personal data. We will comply within 30 days (GDPR) / 7 days (DPDP) unless retention is required by law.
• Portability — receive your data in a machine-readable format (JSON/CSV).
• Withdraw consent — withdraw consent to data processing at any time. Withdrawal does not affect processing already carried out.
• Grievance — raise a complaint with us or with the relevant data protection authority.

To exercise any of these rights, submit a request via our Data Request Form or email privacy@leadcues.pro. We will respond within 30 days.

7. Cookies

Leadcues uses essential cookies for authentication and session management only. We do not use advertising cookies or sell cookie data to third parties. Analytics on the marketing site (leadcues.pro) use Vercel Analytics, which is cookieless.

8. Children's data

Leadcues is a business platform and is not directed at children under 18. We do not knowingly collect personal data from minors.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to account owners at least 14 days before they take effect. Continued use of Leadcues after the effective date constitutes acceptance of the updated policy.

10. Contact

Data protection enquiries: privacy@leadcues.pro
General support: support@leadcues.pro
Postal address: Phanindra Chowdary M, Hyderabad, Telangana, India.