Your data. Your choices.

1. Who operates the service

The service is operated by ABHA, trading as AP Urban Lifestyle (Proprietorship), GSTIN 06EEIPA7833H1ZI, at A-614, Vats Colony, Bahadurgarh, Jhajjar, Haryana 124507, India. Contact: support@elevateleads.tech.

We manage website enquiries, account administration, service security and our business records. Customer organisations determine the purposes of the customer, prospect and employee information they put in their workspace; we process that information to provide the service on their instructions. Their own privacy notices and legal responsibilities also apply.

2. Information we process

The categories depend on the features used and the permissions granted. We do not require every category from every user.

• Account and business information: names, email addresses, phone numbers, organisation details, roles, login credentials stored as password hashes, and authentication/session records.
• CRM records: prospect and customer contact details, enquiries, project interests, source and campaign references, notes, comments, follow-up dates, site visits, booking and collection records, and documents uploaded by authorised users.
• Integration information: connected provider account identifiers, granted permissions, Facebook Page and form identifiers, encrypted access tokens, webhook deliveries and sync status.
• Device and security information: IP address, browser/device information, request and audit logs, session activity and the technical information needed to operate and protect the service.
• Optional field and phone features: attendance times, consent-based location records, call metadata and available recordings when the organisation enables the feature and the user grants the relevant device permissions.
• Support and website enquiries: information you provide when requesting a walkthrough, reporting a problem or contacting support.

3. Facebook and Meta Platform data

When an authorised person connects Facebook, we receive the account identifier and name, the Pages they permit us to access, available lead forms and the submitted lead fields permitted by Meta and the Page owner. Lead fields may include name, phone number, email address and other answers configured on the form. We store encrypted user/Page access tokens to perform the authorised connection.

We use this data to show the available Pages/forms, subscribe selected Pages to lead notifications, retrieve and import selected form submissions, associate their source/campaign, assign leads and enable customer follow-up inside the correct workspace. Optional ad-spend reporting uses additional permission only when requested. Connecting a Facebook account is separate from creating a CRM login.

The integration may request pages_show_list, pages_read_engagement, pages_manage_metadata, pages_manage_ads and leads_retrieval for Page discovery, required Page/form access, webhook subscription and lead retrieval. ads_read is optional for enabled spend reporting. Availability depends on the Meta app’s approved access and your account/Page rights.

We do not sell Meta Platform data, use it to build unrelated profiles, or use it to train general-purpose AI models. We use it for the authorised CRM service and share it only as described in this policy and permitted by Meta’s terms. Removing an integration stops future authorised access; it does not automatically erase CRM records already imported. See Data deletion for requesting removal of those records.

4. Purposes and your choices

We process information to provide and administer workspaces, authenticate users, capture and organise enquiries, support customer follow-up, deliver enabled communications, provide reports, respond to support, prevent misuse and meet legal obligations. We use consent where required and other lawful grounds where applicable.

An organisation is responsible for a valid basis and appropriate notices before collecting prospect or employee information, sending marketing messages, uploading recordings or enabling location tracking. Users can refuse or revoke optional device/provider permissions; the related feature may stop working. A lead submission is not permission for unrelated marketing.

5. Who can receive information

Workspace information is available to authorised users according to the organisation’s roles and access settings. We use infrastructure and service providers for hosting, storage, backups, security and delivery of the service. Current infrastructure includes Hostinger hosting and S3-compatible object storage; encrypted backup storage may use a configured storage provider.

Customer-enabled integrations may send the information needed for that feature to Meta, Google, WhatsApp/SMS/email providers, telephony services, payment gateways or an organisation-selected AI provider. Optional AI can process the enabled prompt, limited CRM context or call audio for transcription according to the feature and configuration. Enable these features only with appropriate authority and review the provider’s terms.

We may disclose information when legally required, to protect rights or security, or in a business transfer subject to appropriate safeguards and notice where required. We do not sell personal information.

6. Storage, security and international processing

Workspace data is separated into organisation databases. The service uses access controls, encrypted integration secrets, password hashing, HTTPS on configured production domains and audit logging. Authorised staff and service providers may access information as necessary for operation, support and security. No system can guarantee absolute security.

Information is stored on our configured infrastructure and may be processed in other countries by an enabled provider. The precise processing location depends on the provider and account configuration. We apply contractual and technical safeguards as required and do not claim that all processing stays in India.

7. Retention

We retain information for the service purpose, the customer organisation’s instructions and settings, security, dispute resolution and applicable legal/accounting obligations. Disabling a workspace blocks access but retains its data; cancellation and deletion require a separate request or agreed process.

We remove authorised connection tokens when the relevant connection data is deleted. Requested data is erased or de-identified unless retention is legally required or necessary for a documented legitimate purpose. Backup copies expire through the configured backup cycle and may remain until that cycle completes; retained backups are restricted and are not used for normal service processing. Ask support for the retention applicable to your workspace or request.

8. Access, correction, deletion and grievances

Contact support@elevateleads.tech with “Privacy request” in the subject. Identify your workspace and the account or record concerned; do not send passwords, access tokens or unnecessary identity documents. You may request information/access, correction, deletion, withdrawal of consent or other rights available under applicable law.

For records held on a customer organisation’s behalf, contact that organisation’s administrator too. We verify identity and authority proportionately and coordinate with the organisation. We explain any legal retention, refusal or limitation that applies and aim to respond promptly within the applicable legal time limit. You may use available statutory grievance or complaint channels if an issue remains unresolved.

Facebook users can also remove the service from their Facebook Business integrations or Apps and websites settings and follow the separate Data deletion instructions. Revoking provider access and deleting imported data are separate actions.

9. Cookies and local device storage

We use essential cookies and browser storage for authentication, security, workspace preferences and supported offline work. Downloaded records may remain on the device until cleared; use trusted devices and remove local website/app data when handing over a device. Third-party login or embedded provider tools may use their own cookies during the feature you choose. This site does not require advertising cookies to browse its product and policy pages.

10. Children, updates and contact

The current service is a business CRM and is not directed to children. The planned education edition is not currently available. Customer organisations must meet any applicable requirements before submitting children’s information. If you believe such information was provided without appropriate authority, contact us.

We may update this policy as the service or requirements change and will publish the updated effective date, with additional notice where required. Privacy and grievance contact: support@elevateleads.tech; postal address: A-614, Vats Colony, Bahadurgarh, Jhajjar, Haryana 124507, India, addressed to AP Urban Lifestyle / ABHA.