1. Who we are
LeadSethu is developed and operated by [Registered legal entity name], [Registered office address] (“we”, “us”). In this policy:
- A business customer is a business that subscribes to LeadSethu, and the people who use it on that business's behalf.
- An end customer is anyone who contacts a business customer, for example by sending a WhatsApp message, filling in a lead form or calling its phone line.
2. Our role: processor or fiduciary
Who is responsible for your data depends on how you interact with LeadSethu.
- End customers. The business you contacted is the Data Fiduciary under the DPDP Act (the “controller” in other laws). It decides why and how your enquiry is handled. We act as its Data Processor. We process your data only on its instructions and under a contract with it. Questions about how a business uses your data are best sent to that business first, but you can also contact us, and section 11 explains what we do then.
- Business customers and website visitors. For account, billing and support data, and for anything you send us through this website, we are the Data Fiduciary.
3. The personal data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact details | Name, phone number, WhatsApp profile name, and email address if given. | You, when you message, call or fill in a form; or the business, if it adds you. |
| Message content | The text of WhatsApp messages exchanged with the business, with timestamps and delivery status. | WhatsApp Business Platform (Meta). |
| Call data | Caller phone number, call time and duration, the audio recording, a written transcript and a short summary. | The phone line, via our voice provider. |
| Enquiry details | What you asked about, booking requests (date, time, type), facts you mentioned such as a preferred date or budget, and notes added by the business's staff. | Your conversation; the business's staff. |
| Lead information | A lead score and its breakdown, pipeline stage, assigned staff member, follow-up tasks. | Generated by LeadSethu from the above. |
| Source information | How you first contacted the business. For click-to-WhatsApp ads, this is the ad's identifier, headline and link, as provided by Meta. | Meta; lead forms. |
| Business customer account data | Staff names, email addresses, phone numbers, roles, login records, and an audit log of actions in the account. Also billing contacts and invoices. | The business customer. |
| Technical data | IP address, browser type and request logs when the LeadSethu app or this website is used. | Automatically, from your device. |
We don't ask for, and businesses must not use LeadSethu to collect, sensitive information such as health records, financial account numbers, government ID numbers or passwords. If you volunteer such information in a message, it is stored as part of the conversation. You can ask for it to be deleted.
4. Why we process it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry with information from the business's catalogue, and passing it to a person at the business when needed. | For end customers, a legitimate use under section 7(a) of the DPDP Act: you gave your details voluntarily to make the enquiry, for that purpose. The business is responsible for this basis, and you can object at any time. |
| Recording and transcribing calls to a LeadSethu phone line. | Your consent, requested at the start of the call. See section 5. |
| Scoring and organising enquiries so the business follows up the right ones: scores, stages, tasks, reminders, booking requests. | The same legitimate use, because follow-up is part of handling your enquiry. Elsewhere, the business's legitimate interest in responding to customers. |
| Sending follow-up and booking messages, including message templates outside WhatsApp's 24-hour window. | The business is responsible for having your opt-in, as WhatsApp's Business Policy requires. You can ask the business to stop at any time. |
| Providing, securing and supporting the service for business customers; billing. | Performance of our contract with the business customer; compliance with law. |
| Detecting abuse, keeping the service secure, keeping logs. | Legitimate uses permitted by law, and our legitimate interest in a secure service. |
| Meeting legal obligations, such as tax records or responding to lawful requests. | Compliance with law (DPDP Act section 7). |
We don't use end customers' data to market to them ourselves. We don't sell it, or share it for advertising. We don't combine one business's data with another's.
5. Phone calls and call recording
Some businesses use LeadSethu's optional phone line to answer enquiry calls. The phone line is automated software, not a member of staff.
- You are told before anything is discussed. The greeting says that the call is recorded. The wording is set by the business, and the notice is always given.
- You can refuse without losing help. If you say you don't want to be recorded, you are offered a person at the business or another way to get in touch. You aren't asked to reconsider.
- What happens after you refuse. When the call ends, the transcript of that call is deleted from LeadSethu automatically. Your number is marked so you are not asked again on future calls to that business. You can also ask us to delete the audio recording held by our voice provider. See section 11.
- What is kept if you don't refuse. The audio recording, held by our voice provider, and a transcript and summary attached to your enquiry, so the business can follow up.
- Transfers. If you ask for a person, or ask something the business has marked as needing one, the call is put through to the business's own number.
6. Automated processing, AI and scoring
LeadSethu uses AI language models for specific, limited tasks:
- Drafting replies to enquiries, using only the business's own catalogue and saved answers.
- Extracting facts from a conversation, such as a preferred date or that a booking was requested, so they can be scored.
- Holding the conversation on the phone line, and summarising the call afterwards.
Lead scores come from rules the business configures. Each score is shown with the rules that produced it. Scores help the business decide whom to call first. They don't make decisions with legal or similarly significant effects about you. A person at the business remains responsible for every booking, price agreement and decision about you.
The AI provider we use (see section 7) processes this data under commercial terms that prohibit it from using the data to train its models.
7. Who we share it with
We share personal data only with the business you contacted, and with the service providers below. They act as our sub-processors, under contracts that limit their use of it to providing their service to us. We don't sell personal data.
| Provider | What they do | Location |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivers WhatsApp messages between you and the business, and supplies ad-click information. Meta also processes this data as the operator of WhatsApp, under its own privacy policy. | Global |
| Anthropic, PBC | AI models that draft replies, extract facts for scoring, and run the phone line's conversation. | United States |
| Vapi | Voice platform that runs the phone line, connects calls and stores call recordings. | United States |
| Deepgram, Inc. (through Vapi) | Converts callers' speech to text during a call. | United States |
| Microsoft Corporation (Azure AI Speech, through Vapi) | Converts the phone line's replies into speech. | Varies by Azure region |
| Hetzner Online GmbH | Hosts our servers and the main database. | Helsinki, Finland (EU) |
| Cloudflare, Inc. | Secures and routes traffic to our servers, and stores encrypted backups. | Global network |
We may also disclose personal data where the law requires it, for example to comply with a lawful order from a court or government authority. If LeadSethu is sold or merged, data may transfer to the new owner under the same protections, and we will say so here first.
We will update this list before adding a new sub-processor that handles end customers' personal data.
8. Where data is stored, and international transfers
LeadSethu's servers and main database are in a data centre in Helsinki, Finland, in the European Union. Some processing happens in the United States, with the providers listed in section 7, when a reply is drafted or a call is handled.
The DPDP Act allows personal data to be transferred outside India, except to countries the Government of India restricts by notification. We will stop or change any transfer the Government restricts. Where other laws require safeguards for international transfers, we rely on our providers' contractual commitments, such as standard contractual clauses.
9. How long we keep it
We keep personal data only as long as it is needed for the purpose it was collected for, or as the law requires.
| Data | How long |
|---|---|
| Enquiries, messages, scores, bookings, notes | While the business keeps its LeadSethu account, unless deleted sooner by the business or after a deletion request. Erased within 90 days after the business closes its account. |
| A lead deleted by the business, or erased after your request | Removed from the business's view immediately. Permanently erased from the live database within 30 days. |
| Call transcripts and summaries | As enquiries, above. Deleted automatically after the call if you refused recording. |
| Call audio recordings, held by our voice provider | [Call-audio retention period, in days], or sooner on request. |
| Encrypted backups | Overwritten on a rolling basis. Every backup copy is deleted within [Backup retention period, in days]. |
| Server and access logs | Up to 30 days. |
| Business customer account data | For the duration of the contract and 90 days after. |
| Invoices and billing records | As long as Indian tax and company law requires, currently up to eight years. |
Deleting a business's copy doesn't delete messages from your own phone, or from WhatsApp itself. Meta holds those under its own policy.
10. How we protect it
- All traffic to LeadSethu is encrypted in transit (HTTPS/TLS).
- Each business's WhatsApp access credentials are encrypted at rest with a key held separately from the database.
- Every business's data is isolated in the database, so one business cannot see another's.
- Access to the app needs individual staff accounts, with roles limiting what each person can see and do. Significant actions are recorded in an audit log.
- Database ports aren't exposed to the internet, and server access is restricted to authorised personnel.
- Backups are encrypted and stored separately from the primary servers.
If a personal data breach occurs, we will notify the Data Protection Board of India and affected people as the DPDP Act requires. For end-customer data, we will also notify the affected business without undue delay.
11. Your rights, and how to use them
Under the DPDP Act, you have the right to:
- Access. Get a summary of the personal data processed about you and how it is processed, and the identities of those it has been shared with.
- Correction and completion. Have inaccurate or incomplete data corrected, completed or updated.
- Erasure. Have your data deleted, unless keeping it is required by law. See data deletion for the step-by-step process.
- Withdraw consent. For example, to call recording, as easily as you gave it. Processing already done before withdrawal stays lawful.
- Grievance redressal. Have a complaint answered by our grievance officer (section 15).
- Nominate. Name a person to exercise these rights for you in the event of your death or incapacity.
How to make a request. Email [Privacy email address], or message us on WhatsApp. Tell us the phone number you used and, if you know it, the business you contacted. To protect you, we confirm the request comes from the owner of that phone number before acting on it. We acknowledge requests within 7 days and complete them within 30 days.
If you contacted a business that uses LeadSethu, you can go to that business directly, or come to us. If you come to us, we pass your request to the business within 3 working days and help them carry it out. If the business has not acted within 30 days, we will carry out an erasure request ourselves, unless the law requires the data to be kept.
Complaints to the regulator. If you're not satisfied with our response, you can complain to the Data Protection Board of India, after first using our grievance process.
12. Children
LeadSethu is a tool for businesses and isn't directed at children. Some businesses, such as tuition centres, receive enquiries about children, usually from parents. The business is responsible for getting verifiable parental consent where the DPDP Act requires it. We don't track, monitor the behaviour of, or target advertising at children. If you believe a child's data has been processed without proper consent, contact us and we will help the business erase it.
13. This website
This website (leadsethu.com) uses no analytics, advertising or tracking cookies, and loads nothing from third parties. If you switch between light and dark theme, your choice is saved in your browser's local storage on your own device and never sent to us. Our servers keep standard request logs, including IP address, for up to 30 days for security.
If you email or message us, we use what you send only to reply and, if you become a customer, to set up your account.
14. Changes to this policy
We will update this policy when our processing changes, and change the date at the top. If a change materially affects how end customers' data is processed, we will tell business customers in advance so they can tell their own customers.
15. Contact and grievance officer
For privacy questions, requests and complaints, contact our grievance officer:
- Name: [Grievance officer's name]
- Email: [Grievance officer's email]
- Post: [Registered legal entity name], [Registered office address]
We respond to grievances within 30 days.