Privacy policy
LeadsFlowPro is run by Subhan Balbale. This page says plainly what is collected, why, and what is not. There is no analytics, no advertising and no third-party tracking anywhere in this product.
What we hold about you
Only what is needed to give you an account and keep it working:
- Your email address — it is your login, and how we reach you about your subscription.
- A hashed password. Passwords are stored as a scrypt hash with a random salt. We cannot read your password, and neither can anyone who obtains the file.
- Account admin — when your access started and expires, your daily search limit, how many leads you used today, when you last signed in, and any note the administrator wrote about your account.
- Failed sign-in attempts — the address tried and a count, so repeated wrong passwords can be locked out. Cleared once you sign in.
We do not collect your name, phone number, location, payment details or device information. Payment is arranged directly with the administrator and is not handled by this software.
Cookies
One cookie, and it is strictly necessary. lfp_session keeps you signed in for 14 days. It is signed, HTTP-only — meaning no script on the page can read it — and marked SameSite=Lax. It holds your email address and nothing else.
There are no analytics, advertising or tracking cookies, so there is nothing here to consent to and no consent banner to click through. Signing out deletes the cookie. Your theme preference and your saved leads are kept in your browser’s local storage on your own device, not on our servers.
The business information in your results
Search results come from the Google Places API and describe businesses — their trading name, public phone number, address, rating and website. This is information those businesses have published so customers can contact them.
Some of it can still relate to an identifiable person, for instance where a sole proprietor lists a personal mobile. If you are a business owner and want your details removed from a LeadsFlowPro account, write to subhanilyasbalbale@gmail.com and we will remove them. Correcting the underlying listing is done through Google, not through us.
If you use this product to contact businesses, the responsibility for those calls and messages is yours. Indian telemarketing rules — including the TRAI regulations and the national Do Not Call registry — apply to you as the caller.
Where the data lives and who can see it
- Account records are stored on our server and reachable only by the administrator.
- The leads you collect are saved in your own browser, keyed to your account, so another person signing in on the same computer cannot see your list.
- Searches are sent to the Google Places API to get results. Nothing else leaves the server.
- We do not sell, rent or share your data with anyone. There is no third party to share it with.
How long it is kept
Account records last as long as your account does. Ask for it to be closed and the record is deleted. Leads stored in your browser are yours to clear at any time by deleting them in the app or clearing your browser data.
Your rights
Under India’s Digital Personal Data Protection Act 2023 — and equivalently under the GDPR if you are in the EU — you can ask for a copy of what we hold, ask for it to be corrected, ask for it to be deleted, and complain to a regulator. Write to subhanilyasbalbale@gmail.com and we will reply within 30 days.
Security
Passwords are hashed and salted. Sessions are signed and expire. Sign-in is rate limited and locks after repeated failures. Changing a password immediately ends every existing session for that account. Traffic is served over HTTPS.
No system is perfect. If you find a security problem, please report it to subhanilyasbalbale@gmail.com before disclosing it publicly.
Changes
If this policy changes in a way that affects you, the date at the top changes and you will be told before it takes effect.
Contact
Subhan Balbale — subhanilyasbalbale@gmail.com