Privacy policy

Who we are

Leapstream is operated by [Legal entity name], [Registered address], Ahmedabad, Gujarat, India ("we", "us"). This policy explains what we collect, why, how long we keep it, and the choices you have. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

Questions and requests go to hello@leapstream.in, or to our Grievance Officer, Abhi Patoliya, Founder, at hello@leapstream.in. We acknowledge every request within seven days and resolve it within thirty.

Two roles: this website, and the product

We handle personal data in two different roles, and the rules differ.

• On this website, we decide what is collected and why. We are the data fiduciary for it.
• Inside the Leapstream product, each client business (a "workspace") decides which of its customers' data is processed and why. The workspace is the data fiduciary, and we process that data on its instructions as its data processor. If you are a customer of a business that uses Leapstream, your relationship is with that business, and their privacy notice applies. Requests about your data should go to them; we will help them answer.

What this website collects

The contact form. If you ask for a call, we receive the name, business name, email address, WhatsApp number, approximate monthly message volume and message you type. We use these only to reply to you and to prepare for the call. They are emailed to our inbox and kept for as long as the conversation is live, then for up to twelve months in case you return, unless you ask us to delete them sooner.

The quote form. If you ask for a written quote on the pricing page, we receive the options you pick (kind of business, monthly volume, team size, number of WhatsApp numbers, systems to connect, what you use today and when you want to start), your name, business name, WhatsApp number or email, and any note. We use them only to prepare and send the quote, and keep them as we keep contact-form enquiries.

How you found us. While you browse, your browser keeps a short record of this visit in its session storage: the pages you open on this site, the first page, the address of the site that linked you here, and any campaign tags in the link. It stays on your device and is deleted when you close the tab. It is sent to us only when you submit a form or tap one of our WhatsApp buttons, together with an approximate location (city, region and country, derived by our hosting provider from your IP address) and the type of device. We use it to know which pages and sources bring enquiries. It does not identify you.

Free tools. The template checker runs entirely in your browser. What you type is not sent to us or anyone else; your draft is kept in your browser's local storage so a refresh does not lose it, and clearing the site's data removes it.

WhatsApp buttons. When you tap a button that opens a chat with us on WhatsApp, the site sends our inbox a short note with the visit record described above, so that when a message arrives we know which page it came from. The site cannot see your phone number; WhatsApp shares it with us only if you send the message.

A WhatsApp confirmation, only if you ask for it. Where a form offers it and you tick the box, we send one confirmation message to the WhatsApp number you entered, through our own platform and the WhatsApp Business Platform. We send it only because you asked, and after that we reply only to what you write.

Server logs. Our hosting provider records the IP address, browser type, requested page and time of each visit for security and to keep the site running. Logs are kept for up to ninety days.

Analytics. We use Google Analytics 4 to count visits, the pages read, and clicks on our WhatsApp, phone and email links, so we know which pages bring enquiries. It sets a first-party cookie with a random identifier; it does not receive your name or contact details, IP addresses are truncated, and we do not use advertising features. You can block it with a browser setting or extension. We may also use Plausible, which is cookieless. Fonts are served from Google Fonts, which receives your IP address to deliver them.

What the Leapstream product processes for a workspace

When a business uses the product, we process on its behalf:

• Contacts: phone numbers, names, and any attributes, tags, stages and notes the business records, including answers to in-chat forms.
• Messages: the content, media and status events of WhatsApp conversations between the business and its customers, received from and sent through the WhatsApp Business Platform.
• Team members: names, email addresses, roles and activity of the people the business invites to its workspace, together with an audit trail of significant actions, including the IP address and browser used.
• Meta credentials: the access tokens and identifiers of the business's own Meta app and phone numbers, which the business connects itself.
• Usage: counts and Meta pricing categories of messages sent, used to show cost before sending and to prepare the business's invoice.

Meta Platforms, Inc. and its affiliates independently process WhatsApp messages under their own terms and privacy policy, which apply alongside this one.

Why we process it, and on what basis

• To provide the service a workspace has contracted: sending and receiving messages, running campaigns, chatbots and journeys, and showing analytics. This is performance of the agreement with the business.
• To protect the number and the platform: quality monitoring, frequency caps, opt-out enforcement and abuse prevention. This is our and the business's legitimate use in operating the service lawfully.
• To answer an enquiry you send us. This is your consent, given when you submit the form.
• To comply with law, respond to lawful requests, and keep records we are required to keep.

We do not sell personal data, use it for advertising, or use it to train artificial-intelligence models. Where a workspace switches on an AI feature, the text of the relevant conversation is sent to the AI provider the workspace has chosen or to our default provider, only for that feature, and only after the workspace turns it on.

Who else sees it

We share personal data only with providers who help us run the service, under contracts that limit what they may do with it:

• Meta Platforms, for delivering WhatsApp messages. Each workspace connects its own Meta app, so its credentials are not shared with other clients.
• Our hosting and infrastructure providers, who store data on servers we control.
• Our email provider, for transactional emails, notifications and the messages the website's forms and WhatsApp buttons send to our inbox.
• AI providers, only for workspaces that switch on an AI feature, as described above.

We may also disclose data when the law requires it, or to protect the rights and safety of a person. If the business that runs the service changes hands, data moves with it under the same protections, and this policy is updated.

Where it is stored, and for how long

Production data is stored in India on infrastructure we operate. Some providers named above may process data outside India; where they do, we rely on their contractual commitments and on the safeguards permitted by Indian law.

A workspace's data is kept for as long as the workspace is active. When an agreement ends, the business may export its data (contacts, messages, campaigns, forms and analytics all export to CSV or Excel) and we delete the workspace within ninety days of the end date, except for records we must keep by law, such as invoices, and backups, which expire on their own within a further ninety days.

Contact-form messages and server logs are kept for the periods stated above.

How we protect it

• Every workspace is isolated at the database layer, so one client can never read another's data, and this isolation is tested with deliberate breach attempts.
• Meta tokens and integration credentials are encrypted at rest with AES-256-GCM and are never written to logs.
• All traffic uses TLS. Every action in the product is checked against the user's role and permissions, and significant actions are recorded in an audit trail.
• Access to production systems is limited to named people, and every sign-in and change is logged.
• Data is backed up nightly. Backups are encrypted and expire on a schedule.

If a breach affects your personal data, we will tell the affected workspaces and, where the law requires it, the Data Protection Board of India and the affected individuals, without undue delay.

Your rights

Under Indian law you may ask us to tell you what personal data we hold about you, to correct it, to delete it, and to name a person who may exercise these rights for you. You may also withdraw consent you gave earlier, and complain to the Data Protection Board of India if you believe we have not handled your data properly.

If you are a customer of a business that uses Leapstream, please send your request to that business first; they hold the relationship with you, and we will act on their instruction. If you cannot reach them, write to us and we will pass the request on.

To exercise a right about this website, write to hello@leapstream.in. We may ask you to verify your identity before acting.

Opting out of WhatsApp messages

Any customer of a workspace can stop receiving messages by replying STOP, or with any opt-out word the business has set. Opt-outs are recorded on the contact, synced across the business's numbers and enforced at the sending queue, so a later import cannot message that person again. A business can also opt a contact out on request.

Children

This website and the product are for businesses. We do not knowingly collect data from anyone under eighteen on this website. A workspace that serves minors must obtain verifiable parental consent as Indian law requires before adding them as contacts.

Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how a workspace's data is handled, we email every workspace owner before it takes effect.