Privacy Policy

Sahayakbuildcon is a CRM for real estate agents, brokers, builders, and their teams. We are the Data Fiduciary for the account data of the people who sign up and use the Services.

When you (the agent or business using Sahayakbuildcon) record buyers, customers, or other contacts in the CRM, or receive enquiries from your public pages, WhatsApp, or connected ad accounts, you are the Data Fiduciary for that data and we process it on your behalf as a Data Processor, only to run the Services for you.

We collect the following categories of personal data:

• Account and team data: your name, business name, phone number, email address, profile photo, language preference, and the details of team members you add (name, phone number, role, and the projects, localities, or groups assigned to them). Sign-in uses a one-time password (OTP) sent to your phone.
• Buyer leads and customers: names, phone numbers, email addresses, budgets, preferred locations, property requirements, lead stage, call outcomes, notes, follow-up reminders, site visits, and the properties or projects a buyer is interested in.
• Properties and projects: listing details you add, such as titles, prices, addresses and map locations, unit configurations, amenities, photos, videos, brochures, floor plans, RERA numbers and certificates, builder details, banner card content, and SEO text for public pages.
• Public page enquiries: when a visitor fills an enquiry, call-back, or brochure form on a public property or project page, we receive the name, phone number, message, and the units or listing they asked about, and pass them to the agent who owns the page as a lead.
• Connected ad accounts: if you connect Meta Lead Ads or Google Ads lead forms, we receive the leads submitted on those forms (typically name, phone number, email, and the answers given) together with campaign and form identifiers.
• WhatsApp Business account data: when you connect your WhatsApp Business number through Facebook Login for Business (Embedded Signup), we receive and securely store your WhatsApp Business Account (WABA) ID, phone number ID, Meta business ID, and an encrypted access token. These are used only to send and receive CRM messages (such as brochures, property suggestions, reminders, and messages you send to your customers) from your connected number on your behalf.
• WhatsApp message data: inbound messages, delivery status updates, and media shared by your leads on WhatsApp may be received through Meta's Cloud API webhook and stored to show the conversation history in your CRM.
• Notification data: a device token for push notifications (for example, new lead and reminder alerts) if you allow notifications in the browser or mobile app.
• Device and usage data: IP address, device type, browser, operating system, pages visited, timestamps, and crash reports.
• Location data: approximate location derived from IP address, or precise location only if you grant permission (for example, to pick a location on the map).
• Install check: once per browser session, every copy of our dashboard software, including copies run by third parties, sends Sahayakbuildcon the website address it is running on, its database project identifier, the page opened, and the visitor's IP address, approximate location, and browser type. We use this only to know where our software is deployed and to protect it from unauthorised use. No account, lead, or property data is sent.

We do not ask for or knowingly collect sensitive personal data such as passwords to financial accounts, biometric information, or health data. Please do not record such data about your leads in the CRM.

We use personal data to:

• create and secure your account, including OTP verification;
• capture leads from your public pages, WhatsApp, connected ad accounts, and manual entry, and organise them by stage, project, and customer;
• assign leads to your team members according to the rules you set (for example, project or locality rotation);
• match buyers with suitable properties and projects, and show interest and activity history on each lead;
• send reminders and push notifications about new leads, follow-ups, and site visits;
• send WhatsApp messages from your connected number when you or your settings ask us to (for example, an automatic brochure or a message you send to selected customers);
• publish the public property and project pages you create;
• respond to support requests, feedback, and complaints;
• detect, prevent, and address abuse, fraud, and security issues;
• maintain, fix, and improve the Services; and
• comply with our legal obligations.

We do not sell personal data or use your leads for our own marketing.

Under the DPDPA, we process personal data on the following grounds:

• Consent: free, specific, informed, and unambiguous consent for clearly defined purposes (for example, analytics cookies on public pages, or a visitor submitting an enquiry form). Consent can be withdrawn at any time; withdrawal does not affect earlier processing.
• Legitimate uses: purposes such as providing a service you have asked for and complying with law, as permitted by Section 7 of the DPDPA.

As the Data Fiduciary for your leads and customers, you are responsible for having a lawful basis to record them and to contact them, including by WhatsApp.

We use a small number of strictly necessary cookies and local storage entries to keep you signed in, remember your preferences, and protect the Services. We do not use third-party advertising cookies inside the CRM.

Public property and project pages show a cookie banner. Agents may add their own Google Tag Manager, Google Analytics 4, or Search Console IDs to their public pages; analytics and similar tags load only after the visitor accepts them, and the agent is responsible for how they use that data. You can clear cookies and local storage from your browser settings at any time; doing so may sign you out and reset your preferences.

We share personal data only with:

• Your own workspace: leads and listings are visible to you and to the team members you give access to, according to their assignments.
• Service providers (Data Processors) who run our infrastructure under written contracts: Supabase (database, storage, and authentication), our hosting and CDN provider, SMS and email delivery partners, Google Maps (maps and place search), and Google and Apple push notification services.
• Meta Platforms, Inc. when you connect your WhatsApp Business number or Meta Lead Ads. Data exchanged with Meta's APIs is governed by Meta's Platform Terms (developers.facebook.com/terms) and the WhatsApp Business Terms of Service. We act as a Technology Provider on the WhatsApp Business Platform; your WABA remains yours and is not shared with any third party other than Meta.
• Google when you connect Google Ads lead forms, under Google's terms for those services.
• Regulators, courts, and law enforcement when disclosure is required by an order of a competent authority or by law.
• Successors in the event of a merger, acquisition, or restructuring, subject to the same privacy commitments.

We keep personal data only for as long as needed to provide the Services and meet our legal obligations. Account, lead, and listing data is kept while your account is active and for up to 24 months after the account is closed, unless you ask us to delete it sooner or the law requires a longer period. Leads and listings you delete from the CRM are removed from active use and cleared from backups on their normal cycle.

WhatsApp Business credentials (WABA ID, phone number ID, access token) are deleted immediately when you disconnect your WhatsApp number from the Services, or within 30 days of account closure, whichever comes first. WhatsApp conversation history stored in our database is deleted at the same time.

You can connect your WhatsApp Business number, Meta Lead Ads, or Google Ads lead forms from the Integration section of the CRM. Connecting authorises us to receive leads and, for WhatsApp, to send messages from your number using the WhatsApp Business Cloud API. You remain the owner of these accounts.

You can disconnect any of them at any time. When you disconnect:

• we stop using the connection and delete the stored credentials;
• no more messages are sent from, or leads received through, that account;
• your WhatsApp Business app and ad accounts keep working normally outside Sahayakbuildcon;
• WhatsApp conversation history stored in the CRM is deleted within 30 days.

You may also ask us to delete your Meta-related data by visiting our Data Deletion page.

We follow reasonable security practices and procedures as required by Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including TLS encryption in transit, encryption of stored access tokens, row-level access rules so that each workspace and team member sees only the data they are allowed to, and regular security reviews. No system is perfectly secure, and we cannot guarantee absolute security.

Under the DPDPA, you have the right to:

• access a summary of the personal data we process about you;
• correct, complete, update, or erase your personal data;
• nominate another individual to exercise your rights in the event of your death or incapacity;
• withdraw consent that you previously gave us;

If you are a buyer or visitor whose details were shared with an agent through Sahayakbuildcon, please contact that agent first, as they decide how your data is used. We will help them act on your request.

The Services are not directed to anyone below 18 years of age. We do not knowingly process personal data of children. If you believe a child's data has been provided to us, please contact us so we can delete it.

Some of our service providers may process personal data outside India. We transfer personal data only to countries that are not restricted by the Central Government under Section 16 of the DPDPA, and we put contractual safeguards in place to protect it.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date above. If changes are material, we will give you reasonable notice (for example, by email or an in-app message) before they take effect.