Privacy Policy

Arthaleads ("we", "us", or "our") is a real estate customer relationship management (CRM) platform operated by Prophunt LLP. This Privacy Policy explains how we collect, use, store, and protect information when you use our platform ("the Service").

Arthaleads is committed to compliance with India's Digital Personal Data Protection (DPDP) Act, 2023. This policy describes our obligations as a Data Processor (and in some contexts, a Data Fiduciary) and your rights as a Data Principal.

Understanding our data roles helps clarify our responsibilities:

• Arthaleads as Data Processor: When you (the organisation) use Arthaleads to store and manage your leads' personal data, Arthaleads acts as a Data Processor on your behalf. We process that data solely to operate the CRM service for you, under your instructions.
• Your organisation as Data Fiduciary: You, as the organisation using Arthaleads, are the Data Fiduciary for the personal data of your leads and customers. You are responsible for obtaining appropriate consent and providing privacy notices to your leads.
• Arthaleads as Data Fiduciary: Arthaleads is the Data Fiduciary for the personal data of our own customers (the organisation admins and users who create accounts with us).

We collect the following types of information:

• Account information: Name, work email address, phone number, and hashed password when you create a CRM account.
• Lead data: Names, phone numbers, email addresses, and property preferences of prospective real estate customers — collected via Facebook Lead Ads, Google Ads, WhatsApp enquiries, or manual entry. This data belongs to your organisation.
• Facebook page and form data: When you connect your Facebook account, we access your Pages and Lead Ad Forms to retrieve lead submissions. We store the Page ID, Form ID, and Page Access Token to receive leads via webhook.
• WhatsApp Business Platform data: Arthaleads is a Meta Tech Provider for the WhatsApp Business Platform. When you connect WhatsApp — whether through Arthaleads' own Meta-hosted onboarding ("Embedded Signup") or by entering your own credentials — we store your WhatsApp Business Account (WABA) ID, phone number ID, business profile fields (verified business name, display phone number, quality rating), the access token issued to us for your account, and the number's registration PIN (encrypted at rest). We also store message delivery metadata and conversation thread IDs, and message content, to display your conversation history in the CRM. See Section 6 for full details.
• Telephony data: When telephony (EnableX) is connected, we store call logs (caller, receiver, duration, timestamp) and, where enabled by your organisation, call recordings. Call recordings are accessible only to authorised users within your organisation.
• Usage and activity data: Login timestamps, actions performed inside the CRM, and activity logs maintained for security, audit, and support purposes.
• Push notification tokens: Device push tokens to deliver in-app notifications (follow-up reminders, lead alerts). These are stored per-user and deleted when you revoke notification permission.
• Support access records: When Arthaleads support staff access your organisation's account, we record the access event, the stated reason, and the duration of the session. See Section 9 for full details.

• To create and manage your CRM account and organisation.
• To receive and store leads from connected advertising platforms.
• To assign leads to sales agents and track pipeline status.
• To send follow-up reminders and activity notifications within the platform.
• To generate analytics and performance reports for your sales team.
• To power AI features (Artha AI) — see Section 7 for details.
• To maintain security, investigate misuse, and prevent unauthorised access.
• To provide customer support and resolve technical issues.
• To comply with our legal obligations under applicable Indian law.

We do not use your lead data, usage data, or any personal data for advertising, profiling, or selling to third parties.

Our platform integrates with the Meta (Facebook) Graph API and Google Ads to retrieve leads submitted through advertising forms. Specifically:

• We request access to your Facebook Pages, Lead Ad Forms, and lead submissions.
• We store Page Access Tokens securely to enable ongoing lead retrieval via webhooks.
• Lead data received from Facebook or Google (name, phone, email) is stored in your CRM account and used solely for sales follow-up purposes.
• If you turn on Conversion tracking in Integrations, we send Meta the stage a lead reaches (for example a site visit or a closed deal), together with a hashed phone number and email address or Meta's own lead or ad-click ID, so Meta can improve your ads. It is off by default, only your organisation's admins can switch it on, and you can switch it off at any time.
• Apart from that optional step, we do not sell, share, or use this data for advertising or any purpose beyond operating the CRM for you.
• You can disconnect your Facebook or Google account at any time from the Connections page inside the CRM. Disconnecting removes your stored access tokens.

Arthaleads is registered with Meta as a Tech Provider for the WhatsApp Business Platform. This means Arthaleads' own Meta app can connect your WhatsApp Business Account (WABA) directly — you log in with your own Facebook account and pick or create your own WABA and phone number inside Meta's own onboarding flow ("Embedded Signup"); nothing about your business identity, verified name, or phone number becomes Arthaleads'. You can alternatively connect a WhatsApp Business Solution Provider you already use, or enter Meta Cloud API credentials you generated yourself.

Whichever way you connect, once WhatsApp is active on your account:

• We store your WhatsApp Business Account (WABA) ID, phone number ID, and business profile fields (verified name, display phone number, quality rating) to route messages and display your connection status.
• Where you connect via Arthaleads' own Meta Tech Provider integration, we store the access token Meta issues for your WhatsApp Business Account, and the number's registration PIN (encrypted at rest), so Arthaleads can send and receive messages on your behalf.
• Inbound and outbound message content is stored within your organisation's CRM account to display conversation history to your agents.
• Message delivery status and timestamps are stored for operational purposes.
• We do not access WhatsApp messages for any purpose other than displaying them within your CRM and, where applicable, triggering automation workflows (including AI-assisted replies) you have configured.
• Disconnecting WhatsApp from the Connections page revokes and deletes the stored access token and registration PIN. Your WhatsApp Business Account itself is not affected — it remains yours, under your own Meta Business Portfolio, and continues to exist independently of Arthaleads.
• You remain responsible for obtaining consent from contacts before initiating WhatsApp conversations and complying with Meta's WhatsApp Business Policy and Platform Terms.

Arthaleads includes AI-powered features ("Artha AI") for lead scoring, follow-up suggestions, and sales assistance powered by OpenAI's API. When you use AI features:

• Relevant lead context (such as name, status, follow-up notes, and your query) is sent to OpenAI's API to generate a response. This data is processed under OpenAI's data processing agreement.
• OpenAI does not use API data to train their general models (per their API data usage policy).
• We track the number of AI API calls per organisation for billing and abuse-prevention purposes.
• You must not submit sensitive personal data (government ID numbers, financial account details, medical data) to AI features.
• AI-generated suggestions are advisory only. Arthaleads does not warrant the accuracy or suitability of AI responses.

All data is stored on MongoDB Atlas (cloud database) hosted on AWS infrastructure in a region appropriate for Indian data. We use industry-standard security practices including:

• Encrypted connections (HTTPS/TLS) for all data in transit.
• Bcrypt password hashing — plaintext passwords are never stored.
• JWT-based authentication with httpOnly secure cookies to prevent XSS token theft.
• Role-based access control — agents can only access leads within their organisation.
• CSRF protection on all authenticated API endpoints.
• Images and documents uploaded to the platform are stored on Cloudinary (a third-party CDN) using secure, access-controlled URLs.

To provide technical support and resolve issues, authorised Arthaleads platform administrators may access your organisation's CRM account. We operate a strict support access policy to protect your privacy:

• Reason logged: A stated reason is mandatory before any support session begins (e.g. Bug Investigation, Onboarding, Customer Support).
• Audit trail: Every support access event is recorded — who accessed, when, why, and for how long — in a tamper-resistant audit log.
• Notification: Your organisation's administrator receives a push notification when a support request is made or a session is active.
• In-app banner: A visible "Support session active" banner is displayed at the bottom of the CRM screen for the entire duration of any active support session, so any logged-in user can see it in real time.
• Approval option: Your administrator can be asked to approve access before the session begins, and can revoke access at any time by clicking "End Session".
• Access log: A complete history of all support access is available to your organisation administrator at Settings → Security at any time.
• Purpose limitation: Support access is used exclusively to diagnose technical issues or provide assistance. Support staff never copy, export, or share your data for any other purpose.

We do not sell, rent, or share your personal data or your lead data with any third parties for commercial purposes. We share data only with the following categories of sub-processors, strictly as necessary to operate the platform:

• MongoDB Atlas (AWS): Database hosting.
• Cloudinary: Image and file hosting (org logos, blog images, attendance selfies).
• OpenAI: AI feature processing (Artha AI), under their API data processing agreement.
• Resend / email provider: Transactional emails (support replies, notifications).
• EnableX: Telephony services (calls, recordings) when connected by your organisation.
• Meta (WhatsApp Business Platform): WhatsApp message routing, either through Arthaleads' own Meta Tech Provider integration or a third-party WhatsApp Business Solution Provider you connect, when WhatsApp is enabled by your organisation.
• Firebase (Google): Push notification delivery for Android app users.

All sub-processors are required to handle data in accordance with applicable data protection law.

We retain your account data and lead data for as long as your account is active or as necessary to provide the Service. Specifically:

• Lead data: Retained until you delete it or close your account.
• Call recordings: Retained for up to 90 days by default, or as configured by your organisation administrator.
• Audit logs and support access records: Retained for up to 12 months for security and compliance purposes.
• Account data: Deleted within 30 days of account closure upon written request.
• WhatsApp access tokens and registration PINs: Deleted immediately when you disconnect WhatsApp from the Connections page, or within 30 days of account closure — whichever is sooner. Message history is retained under the same terms as Lead data above.

You may request deletion of your data at any time by contacting us at contact@arthaleads.com.

Under the DPDP Act, 2023, and other applicable laws, you have the right to:

• Access: Request a summary of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to our legal obligations.
• Grievance redressal: Lodge a complaint with our Grievance Officer (see Section 15).
• Data portability: Request a copy of your lead data in CSV format (available from inside the CRM for organisation admins).
• Withdraw consent: Disconnect integrations (Facebook, WhatsApp, Google) at any time from the Connections page.

To exercise any of these rights, contact us at contact@arthaleads.com. We will respond within 30 days.

Arthaleads is a business tool intended for use by adults (18 years and above). We do not knowingly collect personal information from anyone under 18 years of age.

We use cookies and similar technologies as described in our Cookie Policy. You can manage your cookie preferences at any time on that page.

In accordance with the DPDP Act, 2023 and IT Act, 2000, we have designated a Grievance Officer to address data-related complaints. If you have any concerns about how your data is handled, you may contact our Grievance Officer:

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify active users through an in-app notification. Continued use of the platform after changes constitutes acceptance of the updated policy.

If you have any questions, requests, or concerns regarding this Privacy Policy or your data, please contact: