Privacy policy

1. Our role

For restaurant owners, their team members and people who contact us through this website, we decide why and how the data is used (we are the Data Fiduciary).

For the restaurant's guests (for example a guest who messages a restaurant on WhatsApp), the restaurant decides why the data is used and we process it on the restaurant's behalf (we act as its Data Processor). Guests should contact the restaurant first; we will help the restaurant answer.

2. What we collect

• Account data: name, phone number, email address, restaurant name and address, GSTIN and FSSAI numbers if you add them, and the names and roles of your team members.
• Restaurant data you enter or create: menu, tables, orders, bills, payments recorded (mode and amount only; we do not store card or UPI details), inventory, expenses, staff attendance and customer records (names, phone numbers, loyalty and dues).
• WhatsApp data for Automation: the guest's phone number and WhatsApp profile name, the messages exchanged, bookings, orders and party enquiries, and whether the guest agreed to receive offers.
• Website enquiries: the name, phone number, email address, restaurant name and message you send through our contact form.
• Technical data: server logs (such as IP address, browser and time of request) kept for security and to fix problems. Phone numbers and access keys are masked in our logs.

This website uses no analytics, no advertising trackers and no cookies.

3. Why we use it

• To provide the service: billing, printing, reports, WhatsApp replies, bookings and owner summaries.
• To bill you for your plan and send invoices.
• To reply to enquiries and support requests.
• To keep the service secure, prevent misuse and fix problems.
• To meet our legal obligations, such as tax records.

We send offers to a guest only if the guest has agreed, and a guest can stop them at any time by replying STOP. We do not sell personal data.

4. AI processing

When a guest's WhatsApp message is not answered by our fixed rules, its text and the restaurant's information (such as the menu and opening hours) are sent to an AI model provider to understand the message and draft a reply. Prices, totals, availability and bookings are always decided by our software and the restaurant's data, not by the AI.

5. How long we keep it

• WhatsApp messages: 365 days, then deleted automatically.
• Account and restaurant data: while your account is active. When a Core year ends without renewal, the account becomes read-only so you can still export your data. The period after which a closed account is deleted is being decided.
• Invoices and payment records: as long as tax law requires.
• Website enquiries: up to 12 months after our last contact with you.
• Server logs: up to 30 days.

6. Who we share it with

We share personal data only with service providers that help us run LeadLoop, under contracts that limit their use of it:

• Meta Platforms (WhatsApp Business Platform): to send and receive WhatsApp messages.
• Razorpay: to process payments for our plans.
• Supabase: our database and file storage.
• Vercel: hosting for this website and the dashboard.
• Our server hosting provider for the messaging service.
• Resend: to send emails, such as replies to website enquiries.
• AI model providers (Anthropic, OpenAI or Google, depending on the task): to understand guest messages, as described above.
• Sentry, if enabled: error reports, with request bodies and message content switched off.

Some of these providers may process data outside India. We do so only as the DPDP Act permits.

We may also disclose data when the law requires it.

7. Your rights: access, correction, export and deletion

You can ask us for a summary of the personal data we hold about you, to correct or update it, or to delete it. You may also nominate another person to exercise these rights for you.

• Restaurant owners can export all their restaurant's data from the dashboard at any time, including while the account is read-only.
• A restaurant can ask us to export or delete a guest's data, including their messages, and we will do it.
• Guests can ask the restaurant, or write to us and we will pass the request on and help.
• For anything else, email hello@theleadloop.in.

We may keep some data after a deletion request where the law requires it, for example invoices.

8. Security

Data is encrypted in transit. Each restaurant's data is separated at the database level, so one restaurant cannot see another's. WhatsApp access keys are stored encrypted, and team members see only what their role allows. No system is perfectly secure; if a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

9. Children

LeadLoop is a service for businesses and is not meant for anyone under 18.

10. Grievance officer

If you have a concern about how we handle personal data, contact our grievance officer: Devansh Lamba or Ritesh Kumar Yadav, hello@theleadloop.in, 381, SBI Colony, Panchsheel Nagar, Chhindwara, Madhya Pradesh 480001. We will respond within the time the law requires.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Changes

We will post any change to this policy on this page and update the date above. For significant changes we will also tell account owners by email.