Privacy Policy

1.1 Account Information

When you register, we collect your name, email address, and authentication credentials. If you sign up via a third-party provider (Google), we receive the data that provider makes available.

1.2 Instagram & Meta Platform Data

When you connect your Instagram Business account, we receive data via the Meta Graph API under permissions you explicitly grant, including:

• instagram_business_basic — your Instagram Business account ID, username, name, and profile metadata.
• instagram_business_manage_comments — to read comments on your posts and post replies on your behalf.
• instagram_business_manage_messages — to send direct messages to commenters on your behalf when the auto-DM feature is enabled.
• instagram_manage_comments — read and manage comments (included as part of Meta's Instagram onboarding template).
• public_profile — your basic public profile information.
• email — your email address for account setup and notifications.

We also read publicly available profile information (name, bio, follower count, profile picture, website URL) of users who comment on your posts, using your connected account's access token, for the purpose of lead enrichment.

1.3 Lead & Comment Data

We collect and store comment text, timestamps, commenter usernames, commenter IDs, AI classification results, intent labels, suggested replies, and any contact information (email or phone number) extracted from public bios or comment text.

1.4 Communications Data

If you enable WhatsApp alerts, we store the phone number you provide. We use this number solely to deliver hot lead notifications on your behalf.

1.5 Usage & Technical Data

We automatically collect log data including IP address, browser type, pages visited within the dashboard, feature interactions, and error reports, solely for the purpose of operating, securing, and improving the Service.

1.6 Website Analytics Data (Optional)

If you install the LeadFrog tracking script on your website, we collect page paths, referrer URLs, session duration, and click events from your website visitors. Visitors arriving via a personalised tracking link may be identified by their Instagram user ID to connect their website visit to their lead record in your dashboard.

• To provide, operate, and maintain the LeadFrog Service.
• To classify Instagram comments using AI and surface lead intelligence in your dashboard.
• To send auto-replies and direct messages on your Instagram account when you enable those features.
• To send you hot lead alert notifications via email or WhatsApp.
• To manage your account, subscription, and billing.
• To send you transactional and product-related communications (you may opt out of non-essential communications at any time).
• To improve, train, and enhance the accuracy of our AI classification models using anonymised and aggregated comment data. Personally identifiable information is stripped before any such use.
• To generate aggregated, de-identified analytics and industry benchmarks that do not identify any individual user or their followers.
• To detect fraud, abuse, or violations of our Terms of Service.
• To comply with applicable legal obligations.

Where applicable, we process your personal data under the following lawful bases:

• Contract performance — to deliver the Service you have subscribed to.
• Legitimate interests — to improve our Service, prevent fraud, and conduct business analytics, provided such interests are not overridden by your rights.
• Legal obligation — where processing is required by applicable law.
• Consent — for optional features such as WhatsApp alerts and website analytics, where you have provided explicit consent.

We do not sell your personal data or your followers' personal data to any third party. We share information only in the following circumstances:

• Service Providers: We engage trusted sub-processors — including Supabase (database), Vercel (hosting), Groq (AI inference), and Meta Platforms (Graph API) — who process data on our behalf under appropriate data protection agreements. Comment text submitted for AI classification is transmitted to Groq; no other personally identifiable information is included in that transmission.
• Aggregated & De-identified Data: We may share anonymised, aggregated insights derived from usage patterns and comment data with business partners, investors, or in public reports. Such data cannot reasonably be used to identify any individual.
• Business Transfers: In connection with a merger, acquisition, financing due diligence, reorganisation, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice of any such change and any choices you may have.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Ziwiz, our users, or others.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account and profile data is retained for the duration of your account.
• Lead, comment, and pipeline data is retained indefinitely while your account exists, and deleted within 30 days of an account deletion request.
• Access tokens are deleted when you disconnect an account or delete your LeadFrog account.
• Website analytics session data is retained for 90 days.
• Anonymised, aggregated data — from which no individual can be identified — may be retained indefinitely for research, benchmarking, and model improvement purposes, even after your account is deleted.

The LeadFrog dashboard uses a secure, HTTP-only session cookie to maintain your authenticated session. No advertising, behavioural, or cross-site tracking cookies are used on the LeadFrog platform.

The optional LeadFrog website analytics script places a first-party cookie on your website (not on LeadFrog.in) to measure session duration and returning visitors. This cookie is scoped to your domain and is not used for advertising.

All data is transmitted over TLS/HTTPS. Access tokens and sensitive credentials are stored encrypted at rest. We use Supabase Row Level Security (RLS) to enforce strict per-user data isolation. No user can access another user's data. We conduct periodic security reviews and promptly address reported vulnerabilities.

Despite these measures, no system is completely secure. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data — see our Data Deletion page.
• Portability: Export your leads as CSV from the Leads dashboard at any time.
• Objection: Object to processing based on legitimate interests.
• Opt-out of communications: Unsubscribe from marketing emails via the link in any email, or by contacting us.
• Disconnect Instagram: Disconnect your Instagram account at any time from the Settings page, which revokes our access to future data.

To exercise any of these rights, email us at privacy@leadfrog.in. We will respond within 30 days.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes by email or via an in-app notice at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes your acceptance of the updated policy.

The data controller for the purposes of this Privacy Policy is: