Privacy Policy

This policy explains how Vandiya (“we”) processes personal data in LeadFinder, in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the DPDP Rules, 2025 (as they come into force in phases) and the Information Technology Act, 2000. We are the Data Fiduciary for the data described here.

1. Two groups of people

• Customers — people who sign up and use LeadFinder.
• Business contacts — people whose business contact details appear on publicly available business sources, such as a clinic’s own website (for example a named doctor or a role email like appointments@clinic.in).

2. Data about customers

• Account: name, email, password (stored only as a bcrypt hash), Google account ID if you use Google sign-in.
• Billing: billing name, address, state, GSTIN, subscription status and invoices. Card/UPI details are handled by our payment provider, Dodo Payments; we never see or store full card numbers or UPI PINs.
• Usage: searches, saved lists, notes, tags, exports, usage counters, IP address and security logs (rate limiting, abuse prevention).
• Communications: support and request messages.

Purposes and basis: to provide the Service you signed up for (your consent and the contract), to bill you and issue GST invoices (legal obligation), to secure the Service and prevent abuse (legitimate uses permitted under the DPDP Act), and to send service emails (verification, receipts, payment failures, plan changes). We do not sell customer data or use it for third-party advertising.

3. Data about business contacts

We process only information that is made publicly available by the business or the person in a business context (for example on the business’s own website): business name, address, business phone numbers, business email addresses, social profile links, and names and roles of people listed on the website. We record where each item was found. We do not collect sensitive data, personal social media content, or data from behind logins.

We rely on the DPDP Act’s treatment of personal data that the Data Principal has made publicly available, and on legitimate uses. We minimise what we keep: detailed website-derived data (provenance, people, checks) is automatically cleared after 365 days, and anyone can opt out at any time.

4. Your rights

Under the DPDP Act you can: get a summary of the data we process about you; ask us to correct, complete or update it; ask us to erase it; withdraw consent; nominate another person to exercise your rights; and raise a grievance. Customers can export their data (Account → Export my data) and delete their account (Account → Delete account). Business contacts can use the opt-out & removal form; once processed, the email address or domain is placed on a suppression list so it is not collected, shown or exported again, and is removed from data our customers already saved.

We aim to respond within 7 days and in any case within the time the law requires (currently up to 90 days for grievances under the DPDP Rules).

5. Grievance Officer

• Name: [Grievance Officer – set GRIEVANCE_OFFICER_NAME]
• Email: grievance@example.com
• Address: [Registered address – set COMPANY_ADDRESS]

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational.

6. Sharing

We share data only with processors that help us run the Service, under contract: hosting and database providers, Dodo Payments (payments and tax invoicing, as merchant of record), our email delivery provider, Google (place discovery; search terms only), and optional contact-data/verification providers when you use those features. We may disclose data when required by law or to protect our rights.

7. International transfers

Some providers may process data outside India. We transfer data only to countries not restricted by the Government of India under the DPDP Act and with appropriate safeguards.

8. Retention

• Deleted accounts are deactivated immediately and permanently erased after 7 days.
• Tax invoices and payment records are kept for 8 years as required by GST and accounting law.
• Website-derived lead details are cleared after 365 days. Exports are deleted after 24 hours (CSV) or 7 days (data export).
• Security logs are kept for up to 1 year (CERT-In directions require 180 days of logs).

9. Security

HTTPS everywhere, hashed passwords and tokens, role-based admin access with an audit log, rate limiting, and least-privilege access to production. In case of a personal data breach we will notify the Data Protection Board and affected people as the DPDP Rules require, and CERT-In within 6 hours where applicable.

10. Cookies

We use only essential cookies: a signed session cookie and short-lived security cookies (for example during Google sign-in). We don’t use advertising cookies.

11. Children

The Service is for businesses and people over 18. We do not knowingly process children’s data.

12. Changes and contact

We will post updates here and email customers about material changes.

• Business: Vandiya
• Address: [Registered address – set COMPANY_ADDRESS]
• Email: support@example.com