Privacy & Data Policy

This explains what LeadMint stores, where it is kept, who else touches it and what you can ask us to do with it. LeadMint is operated by Wantrix Marketing LLP. Version 2026-10-18, in force from 18 October 2026.

1. What we store

• Company profile: name, short name, city, regions, teams, plan and billing contact.
• Users: name, work email, role, team, and the sign-in metadata Supabase needs (last sign-in, session tokens).
• Leads and contacts: whatever your team enters or a connected source sends, typically name, phone, email, budget, locality, requirement, source and lead score.
• Activity: notes, follow-up reminders, site visits with geo check-in coordinates, deal stages, bookings, payment dues, attendance, targets.
• Call logs: number, direction, time, duration, outcome and the note your agent wrote.
• Operational logs: audit entries of who changed what, and anonymous usage counts we use to find slow screens.

Call recordings are not stored on LeadMint servers. If your company connects Google Drive, the recording file is written to your own company Drive folder and LeadMint keeps only a link to it. If you do not connect Drive, there is no recording.

Site-visit photos: when an agent finishes a site visit, LeadMint asks for a photo taken with the client at the site. Like recordings, the photo is written straight to your company Google Drive folder and LeadMint keeps only a link to it. Agents should tell the client the photo is for the company visit record.

We do not ask for and do not want government identity numbers, health data or card numbers. Please do not put them in free-text fields.

2. Where it is stored

Your database and files sit in an Indian data centre: Supabase in the Mumbai region, ap-south-1. Day-to-day application traffic is served from the edge location nearest your user, but the records themselves stay in India.

3. Who else is involved

We use a small, named set of sub-processors. Each one sees only what it needs to do its job.

• Supabase: the database, file storage and sign-in (Mumbai, ap-south-1).
• Cloudflare: hosting, edge delivery and protection against abuse.
• Google: Sign in with Google; Google Drive for your call recordings and site-visit photos; Google Ads lead form delivery, if you connect it.
• Resend: transactional email such as invitations, reminders and data exports.
• Razorpay: subscription payments and GST invoices.

We will tell company admins before we add a sub-processor that handles lead data. We do not share your data with anybody else, and we do not sell it.

4. Security

• Encrypted in transit (TLS) and at rest.
• Row-level isolation: every row carries its company, and the database refuses to return another company’s row even if the application asks wrongly.
• Role-based access inside a company, so an agent sees their own leads rather than the whole book.
• LeadMint Super Admin support access to a company account is time-boxed, requires a reason, and every action is written to an audit log the company admin can read.
• Backups are encrypted and restores are tested.

5. How long we keep it

We keep your data for as long as the account is active, because a CRM is only useful with its history. Audit log entries are kept for the life of the account so that changes stay traceable.

Retention of call recordings and site-visit photos is set by your company in its own Google Drive, not by us; we only hold the link, and if you delete the file the link stops resolving.

6. Export, any time

Every list in LeadMint, leads, follow-ups, deals, inventory, bookings, dues, attendance and reports, exports to Excel or CSV from its own screen, with the filters you have applied. There is no charge and no ticket to raise. Imports work the same way, from Excel or CSV.

7. Deletion

When a company admin deletes the account, we first email that admin a complete export of the company data as a zip file, then erase the live records. Encrypted backups containing the data roll off within 30 days, after which no copy remains.

If you want a single lead erased rather than the whole account, delete it from the lead’s page; it goes from the live database straight away and from backups on the same 30-day cycle.

8. Your rights under the DPDP Act 2023

If you are a user of LeadMint, you can ask us to show you the personal data we hold about you, correct it, or erase it. Write to our grievance officer at privacy@leadmint.in and we will respond within 30 days.

If you are a lead whose details are in a company’s LeadMint account, that company is the data fiduciary and holds your consent. Ask them directly, or write to us and we will pass your request to them and follow it up.

9. Cookies and tracking

LeadMint stores only what sign-in needs: a session token and your interface preferences, kept in your browser. There are no advertising cookies, no third-party trackers and no cross-site pixels, which is why there is no cookie banner to dismiss.

10. Children

LeadMint is a workplace tool for adults. It is not meant for anybody under 18, and we do not knowingly create accounts for them. If you believe a minor has an account, write to us and we will remove it.

11. If something goes wrong

If personal data in LeadMint is exposed or lost, we will tell the affected company admins and the Data Protection Board of India as the DPDP Act 2023 requires, without undue delay. Our notice will say what happened, what data was involved, what we have done and what you should do.

12. Changes to this policy

This policy is versioned with the terms. The current version is 2026-10-18, in force from 18 October 2026.

We will tell company admins in the product and by email before a change that affects how we handle your data. Questions, requests and complaints: privacy@leadmint.in.

Questions, requests or complaints: privacy@leadmint.in. See also our Terms of Service.