Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, phone number, and password (stored as an Argon2id hash — we never store or can see your plain-text password).
• Business/office information: business name, industry, address, business hours, services offered, gallery images, testimonials, and other content you add to your digital office.
• Lead and enquiry data: the name, phone number, email, and message of anyone who submits an enquiry through your digital office page or scans your QR code, along with notes and status you add to that lead.
• Payment information: we use Razorpay to process subscription payments. We store the subscription status, plan, amounts, and Razorpay transaction/order/payment IDs — we do not store your full card, UPI, or bank account details; those are handled directly by Razorpay.
• Usage and device data: IP address, browser type, device information, pages visited, and timestamps, collected automatically to keep the platform secure and reliable.
• Communications: messages you send us through the Contact page, Account Deletion request form, support tickets, or feedback forms.

2. How We Use Your Information

We use the information we collect to:

• Create and operate your account and digital office(s)
• Route customer enquiries to you and let you manage them as leads
• Process subscription payments and send billing-related communications, including the mandatory payment-method verification charge (₹2–₹5) and recurring charges you have authorized via Razorpay
• Send transactional notifications (new lead alerts, password resets, subscription reminders) by email, push notification, and/or WhatsApp/SMS where applicable
• Detect, prevent, and investigate fraud, abuse, and security incidents (including trial-abuse detection using device/payment fingerprinting)
• Maintain audit logs of sensitive account and security actions for accountability
• Improve and develop the platform, and comply with legal obligations

We do not use your data to train third-party AI models, and we do not sell your personal information to anyone.

3. Data Sharing & Third-Party Processors

We share data only with service providers who help us run LeadAvirat, under contractual confidentiality obligations, and only to the extent necessary:

• Razorpay — payment processing and subscription billing
• Cloudinary — storage and delivery of images you upload (gallery photos, logos, testimonial avatars, banners)
• Our database and hosting providers — to store and serve your data securely
• Push notification and messaging providers — to deliver alerts you have opted into

Some of these providers may process data on servers located outside India. Where that happens, we rely on providers that maintain industry-standard security and contractual data protection commitments. We may also disclose information if required by law, court order, or to protect the rights, property, or safety of LeadAvirat, our users, or the public.

If you submit an enquiry through a business's digital office page, your enquiry details are shared with that business (the office owner) so they can respond to you — this is the core purpose of the platform.

4. Cookies & Similar Technologies

We use essential cookies to keep you signed in (access and refresh tokens) and to remember basic preferences such as theme. We do not currently use third-party advertising or cross-site tracking cookies. Disabling essential cookies in your browser will prevent you from signing in.

5. Data Security

We take security seriously and implement measures that include: password hashing with Argon2id, short-lived access tokens paired with rotating refresh tokens (with reuse detection to catch stolen tokens), role-based access control, rate limiting on authentication endpoints, and audit logging of sensitive account actions. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to protect your data using current best practices and to respond quickly if an incident occurs.

6. Data Retention

We retain your account and office data for as long as your account is active. If you deactivate your account, sign-in is blocked immediately, but your data is retained in case you wish to reactivate. If you request permanent deletion (see below), we erase your personal data within 30 days, except for payment/invoice records, which Indian tax law requires us to retain for 7 years for audit purposes only.

7. Your Rights & Choices

You can, at any time:

• Access and update your account and office information directly from your dashboard
• Instantly deactivate your account from Dashboard → Settings
• Request permanent deletion of your account and personal data via our Account Deletion page
• Ask us what personal data we hold about you, or object to certain processing, by contacting us below

Under India's Digital Personal Data Protection Act, 2023 and applicable IT rules, you also have the right to correction, grievance redressal, and to nominate another individual to exercise your rights in the event of death or incapacity. Contact our Grievance Officer below for any of these requests.

8. Children's Privacy

LeadAvirat is a business tool intended for use by adults operating or working at a service business. It is not directed at, and we do not knowingly collect personal data from, children under 18. If you believe a child has provided us personal data, please contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will update the "Last updated" date above, and for material changes we will make reasonable efforts to notify active account holders by email.

10. Contact Us / Grievance Officer

For any questions about this Privacy Policy, to exercise your data rights, or to raise a grievance under applicable Indian data protection law, please reach out via our Contact page, WhatsApp at +91 93224 47360, or email leadavirat@gmail.com. We aim to acknowledge grievances within 48 hours and resolve them within 30 days, in line with applicable Indian IT rules.