Privacy Policy

This policy covers the businesses and team members who use LeadRevive, and the people who message, comment on, or order from a connected business ("customers"). Our role is different for each group:

• Customer data: the business that connects a channel decides why and how its customers' data is used. For that data we act as the business's processor (service provider): we handle it on the business's behalf and on its instructions, and use it only to provide the service as described in this policy, apart from the aggregated business-level figures described under Peer comparison and Sales forecasting. The business is responsible for having a lawful basis to handle its customers' data and for answering its customers about it.
• Our own data about businesses: for a business's account details, team logins, billing, support requests, product usage, security records, and the aggregated figures mentioned above, we decide why and how the data is used and act as the controller (the Bangladeshi Act calls this a data fiduciary).

• Business and account information: business name, owner and team member names and contact details, address, category, currency, time zone, business hours, the delivery, payment, return, and greeting rules the business sets, and the instructions it gives our AI. Passwords are stored only as secure hashes.
• Application details: what a business submits when it applies for an account, such as contact details, page links, and how it sells.
• Connection credentials: for each connected Facebook Page, Instagram account, WhatsApp Business account, courier account, or Google Calendar, the credentials needed to act on the business's behalf, stored encrypted.
• Customer conversations: messages and attachments (text, images, video, audio, voice notes), timestamps, delivery and read status, and the identifiers and profile details Meta provides for the customer, such as a scoped ID or WhatsApp number, a name, and, where Meta provides it, gender, which we use only to choose a respectful form of address.
• Comments and posts: comments on the posts of a connected Facebook Page or Instagram account (commenter ID, name, and text), the posts themselves, and the replies sent through LeadRevive, with labels we add to help the business handle them. We do not build profiles of commenters.
• Orders, appointments, and delivery: products, quantities, prices, the recipient's name, phone, and address, payment method and status, and shipment and tracking records.
• AI-generated information: lead scores, intent, summaries, flags for human review, transcripts of voice notes, descriptions of photos, and a risk indicator for a customer phone number based only on that business's own order history. These support the AI features and the business's own decisions.
• The business's operating data: catalog, stock, services, knowledge-base documents, sales summaries and forecasts, Team Chat messages and tasks, and support tickets.
• Billing information: plan, payments, invoices, and the billing contact's name, e-mail, and phone. We do not store full card numbers; payments are handled by payment gateways.
• Technical and usage data: service logs, AI usage records (never message content), and error reports. Our application does not store IP addresses, though our hosting providers may log them.
• Requests: the name, e-mail, and message of anyone who contacts us for support or sends a deletion or rights request.

Businesses must not upload national ID, passport, biometric, genetic, or criminal-record data, or payment card numbers, into LeadRevive (see our Terms of Service).

When a business connects a channel, we request only the Meta permissions our features use. Meta shows the exact list on its own consent screen. In summary:

• Facebook Login for Messenger and Pages: lets the business choose which Page to connect, receive and send Messenger messages, subscribe the Page to our notifications, and read and reply to comments on its posts.
• Instagram Business Login: reads the account's basic profile, and reads and sends direct messages and comment replies.
• WhatsApp Business: there is no Meta login: the business provides credentials from Meta's own dashboard, which we use to receive and send WhatsApp messages and download the media in them.

We also add labels to a business's conversations in its Page inbox (for example "Needs Human Attention") so its team can see where a conversation stands. Data we receive through Meta's platforms is used only to provide LeadRevive's features to the business that connected the channel. We do not sell this data, use it for advertising or surveillance, use it to make decisions about anyone's eligibility for credit, employment, housing, insurance, or education, or use it to train or fine-tune AI models. The only uses that combine figures from more than one business are the aggregated, anonymised figures described under Peer comparison and Sales forecasting, and our own platform-wide counts for billing and operations, which hold no message content. Where this policy and Meta's terms differ about data received through Meta's platforms, Meta's terms apply.

• To show customer conversations in one inbox, let the business reply, and send messages on its behalf through each channel.
• To run the AI features the business uses (see AI processing).
• To book couriers, add scheduled orders to a connected calendar, and send alerts and updates, when the business asks us to.
• To forecast sales and, where available, show the business how it compares with similar businesses.
• To set up accounts, sign users in, keep each business's data separate, bill for subscriptions, provide support, and send service e-mails.
• To keep the service secure, reliable, and free of abuse, to find and fix errors, and to meet legal obligations and platform requirements.

We do not sell personal data. We do not build a profile of any person from sources other than a business's own conversations and orders, and we do not combine one person's data across different businesses.

LeadRevive uses AI models to read and write text, describe images, and transcribe voice notes.

• Automatic replies: are off until a business switches them on, and are available only on plans that include them. When on, incoming customer messages are analysed and the AI replies automatically, with no human review before a reply is sent. It can also create and confirm orders from chat and send receipts, reminders, and follow-ups. Plans can limit the number of AI replies; when the limit is reached the AI stops replying and messages wait for a person.
• Other AI features: may run whether or not automatic replies are on, depending on the plan and settings: describing photos and transcribing voice notes customers send, replying to comments where that feature is enabled, finance analysis and daily summaries, and Team Chat, a separate paid add-on.
• What the AI receives: depends on the feature: the conversation history, voice transcripts and photo descriptions, the business's catalog, prices, stock, rules, and instructions, relevant knowledge-base content, and order records; for comment replies, the comment and its context; for Team Chat, the team member's question and records selected for that business, with e-mail addresses and long numbers masked.
• AI providers: are third-party AI model providers. Which provider handles which feature depends on the plan and our configuration, and some are based outside Bangladesh (see International transfers).
• No training: we do not train or fine-tune any AI model on customer messages, and we do not authorise AI providers to use this data to train their models. A provider may keep requests for a limited period under its own terms.
• Telling customers: replies go out under the business's own Page, number, or account, and LeadRevive does not add a note that a reply was written by AI. The business is responsible for telling its customers when the law or a platform's rules require it.
• Human control: the AI flags conversations it should not handle (for example complaints and refund requests), and a team member can take over any conversation, which stops automatic replies there. Scores, summaries, and risk indicators help a business prioritise; they are not meant for, and a business must not use them for, decisions with legal or similarly serious effects on a person. Anyone can ask for a person to review how an AI feature handled them (see Your rights and how to use them).

Where peer comparison is available, it lets an eligible business see how its own figures compare with similar businesses on LeadRevive. It is not advertising and the figures are not sold.

• What it uses: a small set of business-level figures worked out from the business's own orders (for example average order value and the share of orders cancelled). No customer names, phone numbers, addresses, or message content are used in it, stored in it, or shown through it, and no AI model is used.
• What others see: only a group-level median that includes other businesses' figures, and only when enough similar businesses are in the group. No business's own figures, name, or ID are shown to another business.
• On by default, with an opt-out: eligible businesses take part unless the account admin opts out in the business profile. Opting out removes the business's stored figures and ends its comparisons, without affecting any other feature.
• Retention: these figures are kept for a limited period and then deleted. Copies in provider backups, if any, expire on the provider's normal cycle.

We may change how groups are formed or the figures offered, or stop the feature, and we will update this policy when we do. Comparisons may not be available for small groups or for businesses without enough orders.

We forecast each business's sales from its own sales history together with public calendar events and weather information for its area. This does not use an AI model. To give a useful forecast to a business with little history, we also use general demand patterns learned from many businesses; these are aggregated and anonymised, hold no business name or ID, and are never shown as any business's figures. To find weather for a business we send general location information derived from its address or city (never the business name, ID, or phone) to public mapping and weather data services, which see our server's address and not the business's or its customers'.

We do not sell personal data. We share it only for the purposes below. Some recipients handle data on our behalf (hosting, database, file storage, AI, live updates, background jobs, e-mail, and monitoring providers). Others (Meta, payment gateways, courier companies, Google, and the data services we use for weather) receive it under their own terms and policies.

• Meta Platforms (Messenger, Instagram, WhatsApp): we send replies, labels, and connection requests and read conversations, comments, profile details, and media as described above. Meta also handles this data under its own terms and privacy policy.
• AI model providers: for the AI processing described above.
• Cloud infrastructure providers: for hosting, our database, file storage, live updates, background jobs, and error monitoring. Files that a business or its team shares through the product are stored with our storage provider and can be opened by anyone who has the file's link.
• E-mail delivery provider: to send our e-mails (see E-mail we send), which can include customer names and, for WhatsApp, a customer's phone number in alerts to the business's team.
• Payment gateways: for LeadRevive subscriptions only. They receive the transaction details and the billing contact's name, e-mail, and phone. We do not use them to collect payments from a business's customers.
• Courier companies: only when a business books a shipment: they receive the order number, recipient name, phone, address, and cash-on-delivery amount.
• Google: only if the business connects its Google Calendar: we add events for scheduled orders.
• Mapping and weather data services: for the forecasting described above.
• Authorities and others where the law requires: we may preserve or disclose data where a law, court order, or competent authority requires it, including under Bangladeshi cyber-security law.

We are based in Bangladesh, but your data is not kept only in Bangladesh. The AI model providers and most of our technical providers are companies based outside Bangladesh, and data sent to them may be processed in the countries where they operate. We have not confined processing to any one country, and we do not claim that your data stays in Bangladesh. We send data abroad only where it is needed to provide the service the business asked for, or with consent, and we rely on each provider's written terms for how it may use the data. Bangladeshi rules on transfers abroad are still being developed; we will update this policy if they change what we must do.

We keep data for as long as needed to provide the service and for the purposes in this policy, and longer where a law requires us to (for example tax and accounting records, or a lawful preservation request). We do not currently delete most data automatically when a subscription ends or a channel is disconnected; deletion follows the process below. In summary:

• Conversations and linked records: customer conversations, AI insights, and the orders, appointments, and quotes linked to them are kept until the business's data is deleted. If a message or thread is deleted on Meta's platform, we hide our copy rather than delete it.
• Comments and posts: the text of a comment and the commenter's name and ID are removed from our copy after a limited period (currently up to 180 days), or at once if the comment is deleted on Facebook or Instagram; only an anonymous count and label remain. Comments and posts are deleted when the channel is disconnected.
• Account and business data: kept while the business has an account, and until deleted on request.
• Uploaded files and delivery records: kept until deleted on request; the routine deletion below does not remove them.
• Billing and tax records: kept as long as accounting, tax, and other laws require.
• Logs and technical records: kept for limited periods that vary by type.
• Applications that were not approved: deleted after a limited period.
• Aggregated comparison figures: kept for a limited period, and deleted on opt-out (see Peer comparison).

Deleting data from Meta's platforms. The account admin can ask us to delete the data we obtained through Meta's platforms (Messenger, Instagram, and WhatsApp), from inside the app or by e-mail. There is a short waiting period that the admin can cancel; after it, the connections, conversations and everything stored with them, comments, and posts are deleted. This routine does not close the account or delete the other data above. You can ask us in writing to delete the rest, and we will delete or anonymise what we have no legal or contractual need to keep. These requests are handled by our team. The Data Deletion Instructions explain each step, what is and is not removed, and how long it takes. We also delete data obtained through Meta's platforms where Meta's terms or the law require it.

We use technical and organisational measures that we believe are appropriate to the data we hold, including:

• Encryption in transit (HTTPS) for traffic to and from LeadRevive.
• Passwords stored only as salted hashes, and connection credentials stored encrypted.
• Verifying requests and notifications from connected platforms before accepting them.
• Keeping each business's data separate, with access tied to the verified signed-in business.
• Access controls that limit which staff can reach our systems.

No system is completely secure, and we cannot guarantee that data will never be accessed without permission.

Access is limited to authorised staff who need it to run, support, and secure the service. Our admin tools show a business's profile, team contact details, plan and usage, billing records, support tickets, and deletion requests; they do not display customers' messages, comments, or order details. Staff who maintain our systems may technically be able to reach stored data, and we restrict that access to those who need it. Support staff can use a test chat inside a business's account, in which case the test conversation appears in that business's inbox.

LeadRevive's own website and apps do not set cookies and do not use advertising or analytics trackers. When you sign in, your session details and a few preferences are kept in your browser's local storage; clearing it signs you out. Some third-party services we use (for live updates and error monitoring) connect to your browser and see your IP address, as any website you visit would. When you connect a channel or Google Calendar you are sent to Facebook, Instagram, or Google sign-in pages, which set their own cookies. The only tracking we use is in the daily summary e-mail, described next.

• Service e-mails: application confirmations, invites, password resets, sign-in details, invoices, renewal reminders, payment links, and alerts when a conversation needs a person. Alerts go to the account admin and team members and can include the customer's display name, a link to the conversation, and, for WhatsApp chats, the customer's phone number. These are part of running the account and are not marketing.
• Daily summary e-mail: a daily e-mail to the account owner (on plans that include it) with the business's own analytics. It can include a clearly marked sponsor placement that is not chosen by anything about you or your customers. It uses a tiny image to tell us whether and when it was opened and which links were clicked, and we keep that with the recipient's e-mail address. It is on by default and can be turned off in the app.
• We do not send our newsletters to a business's customers.

LeadRevive is a business tool for adults. The person who accepts our terms must be at least 18, and the service is not directed at children. People under 18 may sometimes message a connected business. The business is responsible for having any parent or guardian consent Bangladeshi law requires before it handles a child's data, and we handle that data as its processor. If we learn that we hold a child's data without the consent that is required, we will review it and delete it where appropriate.

Subject to the exceptions in the law, you can ask us to tell you what data we hold about you and give you a copy, correct it, delete it, stop or limit a use of it, or withdraw a consent you gave. You can also object to automated processing and ask for a person to look at it. These rights cannot be waived through a contract or a notice, and nothing in our Terms of Service takes them away.

• How to ask: write to support@leadrevivebd.com with enough detail for us to find your data (for a customer of a business, the business's name and the Page, Instagram account, or WhatsApp number you messaged). We may ask you to prove who you are. We will acknowledge your request and respond within the period set by law or, where none is set, within 30 days.
• If you are a customer of a business: the business decides what happens to its own customers' data, so you can also ask the business directly. If you write to us, we will pass your request to the business promptly and help it respond, and where the law or Meta's terms require us to act ourselves, we will. These requests are handled by hand.
• If you are a business: you can switch AI features off, take over any conversation, disconnect channels, opt out of peer comparison, and request deletion, as described above and in the Data Deletion Instructions.
• Complaints: you can complain to us at the address below, and to the competent authority once its complaint process is operating.

If a breach affects personal data we hold, we will tell the affected businesses, and individuals where required, without undue delay. Where we hold the data as a business's processor, we will tell the business so it can meet its own duties. We will notify the competent authority and Meta where the law or Meta's terms require.

We will update the date at the top of this page whenever this policy changes. For a material change, including a new use of data, we will also e-mail account admins at least 14 days before the change takes effect, unless it has to take effect sooner to meet a legal or platform requirement.