Privacy Policy

1. Who this policy covers

• Customers — businesses that create a LeadFlow workspace, and their team members.
• Leads — people who submit a lead-ad form on Facebook or Instagram, or a website form, to one of our customers.

For leads, our customer (the business) decides why and how the data is used; LeadFlow processes it on their behalf. If you are a lead and want your data removed, see Data Deletion.

2. Data we collect

From customers

• Account details: name, mobile number (used for sign-in codes), optional email, language and alert numbers.
• Business details: business name, type, district and the settings you choose.
• Billing records: plan, invoices and payment status. Card or mobile-wallet details are handled by the payment provider (SSLCommerz); we do not store them.
• Technical data: sign-in times, device/browser type and IP address, used for security and to prevent abuse.

From Facebook and Instagram (Meta)

When a customer clicks Connect Facebook page and approves access, we receive:

• The Facebook user’s name and ID, and the list of Pages they manage (with any linked Instagram professional account).
• Access tokens for the Pages the customer chooses, so LeadFlow can receive that Page’s leads.
• Lead-ad submissions for those Pages: the answers the lead entered (for example name, phone number, email and form questions), plus the form, ad and campaign name.

We request only the permissions needed for this: pages_show_list, pages_read_engagement, pages_manage_metadata, pages_manage_ads, leads_retrieval and business_management.

From website forms

The answers a visitor submits on a customer’s LeadFlow form (for example name, phone number and the questions the business asks), and the time of submission.

3. How we use data

• To show leads to the customer who owns them and to the team members they invite.
• To send the alerts the customer turns on (SMS, WhatsApp, browser notifications) and, if enabled, an automatic reply to the lead.
• To sign users in, keep accounts secure and prevent fraud.
• To bill for the service and provide support.
• To produce reports for the customer about their own leads.

We do not sell personal data, do not use lead or Facebook data for advertising, and do not combine one customer’s leads with another’s. Data received from Meta is used only to provide LeadFlow to the customer who connected the Page, in line with Meta’s Platform Terms.

4. Who we share data with

Only service providers that help us run LeadFlow, under contract and only for that purpose:

• Meta (Facebook, Instagram, WhatsApp) — to receive leads and, when enabled, send WhatsApp messages.
• SMS gateways (for example BulkSMSBD) — to deliver sign-in codes, alerts and auto-replies.
• SSLCommerz — to process payments.
• Hosting and email providers that store and run the service.

We may disclose data if required by Bangladeshi law or a valid legal request.

5. Security

• Data is sent over encrypted connections (HTTPS).
• Facebook access tokens and other secrets are stored encrypted; sign-in codes are stored only as one-way hashes.
• Each workspace’s data is isolated; staff access is limited, protected by two-factor authentication and recorded in an audit log.

6. How long we keep data

• Leads and workspace data are kept while the workspace is active, until the customer deletes them.
• When a customer deletes their workspace, there is a 7-day period to undo; after that, the workspace’s leads, forms, team and Facebook connections are permanently deleted.
• Disconnecting a Facebook Page stops new leads from that Page and removes LeadFlow’s subscription to it.
• Billing records may be kept longer where the law requires it.

7. Your choices and rights

• Customers can view, edit, export (Settings → Data & privacy) and delete their data, and disconnect Facebook Pages at any time.
• You can remove LeadFlow’s access from Facebook: Facebook → Settings & privacy → Settings → Business integrations → LeadFlow → Remove.
• Leads can ask the business they contacted, or us, to delete their details — see Data Deletion.

8. Children

LeadFlow is a business tool and is not intended for anyone under 18.

9. Changes

If we change this policy we will update the effective date above, and tell customers in the app or by SMS/email when the change is significant.