Skip to content
BuyLeadPilot

Privacy policy

Last updated

This Privacy Policy explains how BuyLeadPilot ("we", "us" or "our") collects, uses, stores, shares and protects personal data when you use the BuyLeadPilot website, web dashboard and browser extension (together, the "Service"). It also explains the choices and rights you have.

We process personal data in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 together with its rules as they come into force. By creating an account or using the Service you agree to this policy. If you do not agree, please do not use the Service.

BuyLeadPilot is an independent service. It is not owned by, affiliated with, or endorsed by IndiaMART InterMESH Limited. Your use of the IndiaMART website is governed by IndiaMART's own terms and privacy policy.

1. Who is responsible for your data

For your account, billing and usage data, BuyLeadPilot, Deesa , Banaskantha , Gujarat - 385535 decides why and how the data is processed (the "data fiduciary"). Lead details that the extension reads from your own IndiaMART seller panel are processed on your instructions to provide the Service to you; you decide which leads are evaluated and which actions run.

2. Personal data we collect

Account and contact data

  • Your name, email address, business (organization) name and time zone, and the names, email addresses and roles of team members you invite.
  • Your password, stored only as a one-way Argon2id hash. We cannot read it.
  • If you sign in with Google: your Google account name, email address and Google account identifier. We do not receive your Google password.

Billing data

  • Your plan, billing period (monthly or yearly), subscription status, renewal dates, invoices and payment references.
  • Card, UPI, net banking and wallet details are collected and processed by our payment gateway (Razorpay). We do not receive or store them.

Browser extension and device data

  • The name you give a connected browser, its browser and operating system type, the extension version, its connection status and when it was last online.
  • A device credential issued when you connect a browser. It is stored on our side only in hashed form.

Lead data from your seller panel

  • When the extension runs on your IndiaMART BuyLeads page, it reads the lead details shown there: title, description, category, location, quantity, budget, the IndiaMART lead ID and the time it appeared. These are sent to our servers to apply your filters, enforce your limits, prevent duplicate purchases and keep your lead history.
  • Buyer names are not collected unless this is specifically enabled for the platform; it is off by default.
  • After a lead is purchased, IndiaMART shows the buyer's contact details (such as name, company, mobile number, email address, address and GSTIN). The extension uses them to confirm the purchase, reads them from that window and sends them to us, so the lead is listed under Bought leads with the buyer's details for your follow-up. Only members of your organization can see them.

Imported lead titles (optional)

  • If you import titles from your earlier leads using your IndiaMART Pull API key, the key is stored encrypted and used only while the import runs; it is deleted when the import finishes or stops.
  • From the import we keep only product and category titles and a one-way fingerprint of each lead (to avoid importing it twice), not buyer contact details.

Automation and usage records

  • Your profiles, keywords, rules, limits and settings; the decision taken for each lead; purchase results; your Right / Wrong review marks; the follow-up status, notes, follow-up dates and order values you record for bought leads; notifications; and an activity log of automation events.

Technical and security data

  • Sign-in and session times, the browser of each signed-in session, and a shortened (anonymised) network prefix of your IP address rather than the full address.
  • Audit records of important account, security and billing changes, and error logs needed to keep the Service working.

Communications

  • What you send us through the Contact us page (name, email, company, phone and message) and your emails to support.

3. What we never collect

  • Your IndiaMART password or one-time passwords (OTPs). The extension works in the IndiaMART session you sign in to yourself.
  • Content from other websites. The extension runs only on IndiaMART pages; on any other site it does nothing. It never reads the contents or addresses of your other tabs.
  • Card, bank or UPI details (handled by the payment gateway).

4. How we use your data

  • To provide the Service: evaluate leads against your filters, run the actions you configured, enforce limits, prevent duplicates, show statistics and send the alerts you choose.
  • To create and secure your account: sign-in, email verification, password reset codes, session management, fraud and abuse prevention.
  • To process subscriptions, issue invoices and meet tax and accounting obligations.
  • To answer your questions and provide support.
  • To send service messages, for example about security, billing, plan changes and changes to these documents. We do not send marketing emails without your consent, and you can opt out of any we send.
  • To understand and improve the Service using aggregated statistics that do not identify you.
  • With your consent only: analytics on our public website (see section 10).
  • To comply with law, respond to lawful requests from authorities, and establish or defend legal claims.

We process personal data on the basis of your consent, which you give when you register and use the Service, and for legitimate uses permitted by law, such as providing the Service you asked for and complying with legal obligations. You may withdraw consent at any time (section 8); this does not affect processing already carried out, and some features may stop working.

5. Who we share data with

We do not sell, rent or trade personal data. We share it only as follows:

  • Service providers who process data on our instructions and under confidentiality obligations: cloud hosting and storage, email delivery, payment processing (Razorpay), Google (for Sign in with Google and, with your consent, Google Analytics) and backup storage.
  • Members of your own organization, according to the roles you give them in the dashboard.
  • Authorities, courts or others when required by law, or when needed to protect the rights, property or safety of our users, the public or us.
  • A buyer or successor in a merger, acquisition or sale of assets, who will be bound by this policy.

We do not send your data to IndiaMART. The actions you configure are carried out by your own browser, in your own IndiaMART session.

6. Where your data is stored

Your data is stored on servers used by our hosting providers, which may be located in India or in other countries. Any transfer outside India is made only as permitted under Indian law and with appropriate safeguards.

7. How long we keep data

  • Lead records: 180 days (our standard period), then deleted automatically.
  • Bought leads, with the buyer's contact details, your notes and their follow-up history: until you delete them (one by one, or with your account).
  • Automation activity log: 90 days (standard period). Notifications: 60 days.
  • Security and audit records: about 13 months (400 days).
  • Contact us messages: 12 months.
  • Signed-in sessions: until you sign out, or 30 days after last use.
  • Payment gateway event records: 180 days. Invoices and billing records: as long as tax and accounting laws require (generally up to 8 years).
  • Account and organization data: while your account is active. When you delete your account it is deleted from the live system at once.
  • Encrypted backups: 30 days by default, after which they are deleted in rotation. Deleted data disappears from backups when those backups expire.

We may keep data longer where the law requires it or to resolve a dispute, and only for as long as necessary.

8. Your rights

Subject to applicable law, you have the right to:

  • Access a summary of your personal data and how it is processed.
  • Correct, complete or update your data. Most of it can be edited directly in the dashboard.
  • Erase your data. You can delete your account at any time from Settings → Delete account; as the owner this deletes your organization and all its data.
  • Withdraw your consent, by deleting your account or writing to us.
  • Nominate another person to exercise your rights in the event of death or incapacity.
  • Have your grievances redressed (section 15).

To exercise a right, write to support@buyleadpilot.com from the email address of your account. We may need to verify your identity, and we respond within 30 days.

9. How we protect data

  • All traffic between your browser, the extension and our servers is encrypted with HTTPS (TLS).
  • Passwords are hashed with Argon2id; sign-in, verification, reset and device tokens are stored only as hashes.
  • Secrets such as an IndiaMART Pull API key are encrypted at rest, and backups are encrypted with AES-256-GCM.
  • Each organization's data is kept separate and can be reached only by its own members; administrative access is limited and logged.
  • Rate limits, automatic sign-out of compromised sessions and security monitoring protect against abuse.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will inform you and the authorities as required by law.

10. Cookies and local storage

  • Essential cookies (always on): a secure, HttpOnly sign-in cookie that keeps you signed in, a cookie that tells the website a session exists, and a short-lived (10 minutes) cookie that protects Sign in with Google.
  • Local storage in your browser remembers your cookie choice and small display preferences.
  • Analytics cookies (Google Analytics) are set only if you accept them in the cookie banner. To change your choice, clear this site's data in your browser.
  • The extension keeps its settings, its device credential and recent lead fingerprints (to avoid processing the same lead twice) in your browser's extension storage.

11. Data you receive about buyers

Buyer details you obtain from IndiaMART, including after a purchase, are received by you from IndiaMART. You are responsible for using them lawfully, in line with IndiaMART's terms and applicable data protection law.

The buyer details saved under Bought leads are processed by us on your behalf and only to provide the Service to you. We do not use them for any other purpose, sell or share them, or contact the buyers. You decide how long to keep them and can delete them at any time.

12. Children

The Service is meant for businesses and is not directed at anyone under 18 years of age. We do not knowingly collect personal data of children. If you believe a child has given us personal data, contact us and we will delete it.

13. Third-party services

The Service works with websites and services we do not control, including IndiaMART, Google, Razorpay and the Chrome Web Store. Their own terms and privacy policies apply to your use of them.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or in the dashboard before it takes effect.

15. Grievance Officer and contact

For any question, request or complaint about your personal data, contact our Mali Manishbhai, Grievance Officer, at support@buyleadpilot.com, or by post at BuyLeadPilot, Deesa , Banaskantha , Gujarat - 385535. We acknowledge complaints within 48 hours and resolve them within 30 days.

If you are not satisfied with our response, you may approach the Data Protection Board of India once it is available for your complaint under the Digital Personal Data Protection Act, 2023.