LeadStream Privacy Policy
LeadStream is a website chat assistant and lead-capture service made by Manthrix Industries Private Limited ("Manthrix", "we", "us"), CIN U62011UW2026PTC254001, registered office: Innov8 Graphix Tower 2, A-13, Sector 62, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India.
This policy explains what personal data we handle, why, for how long, who helps us, and your rights. We follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP law") as their provisions come into force.
1. Two different roles
| You are | Whose data | Our role |
|---|---|---|
| A client (a business that signs up for LeadStream) | your account data | We decide why and how it is used. We are the Data Fiduciary. |
| A visitor who chats on a client's website or fills in its contact form | your name, email, phone number, chat messages | The client decides why and how. The client is the Data Fiduciary and we process the data only on its instructions, as its Data Processor, under our Data Processing Agreement. Please contact the business whose website you visited; we help it answer you. |
We do not sell personal data. We do not use chat messages, Knowledge Base text or leads to train AI models, and we do not use visitor data for our own purposes.
2. Client data we collect, and why
| Data | Why | Basis |
|---|---|---|
| Your name, login email, password (stored only as a salted one-way hash), business name | create and run your account, sign you in, show your business name to your visitors | your consent at sign-up, for this purpose |
| GSTIN and legal name for invoices (optional) | tax invoices | your consent; keeping invoices is required by tax law |
| WhatsApp number for lead alerts (optional, Pro and above) | send you instant lead alerts once WhatsApp alerts are available | your consent; you can remove it at any time |
| Your websites, assistant settings, Knowledge Base text, privacy-policy link | run the assistant on your website | your consent, for this purpose |
| Plan, payment method type (card or UPI, never the number), subscription references, billing history | billing, renewals, plan changes, refunds | your consent; keeping billing records is required by tax and company law |
| Usage counts (credits, conversations) | plan limits, usage emails | your consent, for this purpose |
| Security log: sign-ins, failed sign-ins, exports, deletions, with a scrambled (hashed) network address and never your email | protect your account and investigate incidents | required by law (reasonable security safeguards) |
| Your acceptance of these terms (version and time) | proof of the agreement | your consent; kept as proof |
We do not use client data for advertising. LeadStream's pages have no analytics or advertising trackers.
3. Visitor data we process for our clients
- Contact form: name, email, phone number, the time the box was ticked, which consent text was shown (its version), the page address (without any query), and the business's privacy-policy link shown.
- Chat: messages and the assistant's replies. Chat text is deleted 48 hours after the last message, unless a law requires it to be kept longer; in that case it is locked away, used only for that legal purpose, and deleted when that period ends.
- A random browser ID (stored in the visitor's browser) and a scrambled network address, used only to limit abuse and the number of chats per day.
- The client sees contact details in its dashboard and may receive them by email (and, once available, WhatsApp).
4. Who helps us
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Cloudflare, Inc. | runs the LeadStream service, its database and its web pages | all data above | Cloudflare's global network, which may be outside India |
| Groq, Inc. | the AI that writes chat replies | chat messages, the client's Knowledge Base, the visitor's first name when given (never email or phone) | USA |
| Resend (Plus Five Five, Inc.) | sends emails (lead alerts, daily summaries, account and billing emails) | recipient email and email content, which may include a visitor's name, email and phone | USA |
| Razorpay Software Private Limited | payments and subscriptions | client name, login email, payment details you enter on Razorpay's page | India |
| Hostinger | our domain name records and our company mailboxes (for example privacy@manthrix.com) | emails you send us | may be outside India |
| Meta Platforms (WhatsApp), only once WhatsApp alerts are switched on | instant WhatsApp lead alerts | the client's WhatsApp number, the lead's name, email and phone | may be outside India |
Some providers process data outside India. Indian law allows this except to a country the Government of India restricts; if a restriction applies to any provider, we will stop that transfer or move it. Each provider is bound to protect the data at least as well as this policy. We tell clients at least 15 days before adding or replacing a provider that receives visitor data (Data Processing Agreement, clause 5).
5. How long we keep data
| Data | Kept |
|---|---|
| Chat text (and the visitor name on the chat) | 48 hours after the last message, unless a law requires longer (section 3) |
| Chat records without a lead (dates, counts, page) | 12 months |
| Leads (contact details and consent record) | as the client chooses: 6, 12, 24 (default) or 36 months, or until the client deletes them |
| A client account after it ends (trial or plan ended) | 90 days, then deleted with all its data; we email you 14 days before |
| Billing records (plan and payment history, invoice details, payment-provider notices) | 8 years, as tax and company law require |
| Security log | 1 year |
| Log of data requests (what was exported or deleted, counts, a scrambled ID; never the data itself) | 3 years |
| Payment-provider notices | stored without the payer's email, phone or UPI ID |
| Backups | deleted data can remain in encrypted backups for up to 30 days before it is overwritten |
6. Your rights and how to use them
Clients (in the dashboard, or by email to the Grievance Officer in section 9):
- Access and copy: Account → "Download my data" gives one file with your account, websites, Knowledge Base, settings, billing history, usage, all leads with their consent records, and recent chats. Leads → "Download all" gives every lead as a spreadsheet file.
- Correction: edit your name, business name, privacy link and WhatsApp number in the dashboard. To change your login email or invoice details, email us.
- Erasure: Account → "Delete account" (with your password) deletes your account at once when no paid plan is running; cancel a running plan first. Billing records that the law requires us to keep are kept (section 5).
- Withdraw consent for optional data (such as your WhatsApp number) at any time in the dashboard. Withdrawing consent for the account itself means deleting the account.
- Nominate a person to use your rights if you die or cannot act: email us from your login email with the nominee's name and email. We act on the nomination after reasonable proof (for example a death certificate).
- Complain: section 9.
Visitors: contact the business whose website you used. It can find, correct, give you a copy of, or delete your details in its LeadStream dashboard, and stop using them if you withdraw consent. If you write to us instead, we pass your request to that business within 2 working days and help it answer.
We will provide this policy in Hindi on request.
7. Security
Encrypted connections (HTTPS); passwords stored only as salted one-way hashes; each client's data kept separate in every database query; access to production data limited to Manthrix's authorised staff; card and UPI details handled by Razorpay and never stored by us; backups; a security log kept for 1 year; and a written incident plan. These are our reasonable security practices under the IT Act and the DPDP law.
8. If something goes wrong
If a personal data breach affects your data, we will tell you and the Data Protection Board of India without delay, as the DPDP law requires, and report to CERT-In within its time limits where its rules apply. For visitor data, we tell the client within 24 hours of becoming aware, so it can tell its visitors.
9. Grievance Officer and contact
Grievance Officer: Aman Anuragi, Director, Manthrix Industries Private Limited
Email: privacy@manthrix.com
Post: Innov8 Graphix Tower 2, A-13, Sector 62, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India
We acknowledge every complaint within 24 hours and resolve it within 15 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
10. Children
LeadStream is for businesses; clients must be 18 or older. The visitor contact form asks visitors to confirm they are 18 or older, and clients may not use LeadStream on websites or services directed at children.
11. Changes
We show the date at the top. We email clients at least 15 days before a material change takes effect.