Privacy policy

Who we are

Streakstone ("we") is a service for businesses that run lead ads. It checks each enquiry a business receives, follows up on WhatsApp and by phone in the business's name, and hands the real ones to the business's team.

Two kinds of people, two roles

Businesses and their teams who sign up to Streakstone. For their account data we decide why and how it is used, so we are the data fiduciary (the controller).

People who send an enquiry to one of those businesses, through an ad form, a website form, a property or college portal, or a WhatsApp ad ("leads"). The business decides why it collects this data and what happens to it. We handle it only on the business's behalf and on its instructions, so for lead data the business is the data fiduciary and we are its data processor. Our data processing agreement sets out what we may and may not do with it. If you enquired with a business, that business is the first place to ask about your data; we help it answer you.

What we handle

Account data

• Name, work email, WhatsApp number and role of each team member, and a password stored only as a salted scrypt hash.
• The business's settings, connected accounts and the access tokens they issue, which we store encrypted (AES-256-GCM).
• Billing details: plan, invoices and payment status. Card and bank details are entered with Razorpay or Paddle, never with us.
• A record of sign-ins and of changes made in the workspace, kept for security and support.

Lead data

• What the person gave the business: name, mobile number, email, city or postcode, and their answers on the form.
• Where the enquiry came from: the ad, campaign, portal or web page, and click identifiers such as gclid, fbclid and the Meta browser IDs the business's website form passes on.
• The follow-up: WhatsApp messages in both directions, transcripts of AI phone calls, the answers read from them, the score and why, appointments, and check-ins at the business's front desk.
• What happened next, when the business records it: called, booked, came in, bought, and the sale amount.

Visitors to this website

We use one cookie, to keep you signed in. We do not use advertising or tracking cookies on the Streakstone website.

Why we use it

• To run the service the business signed up for: test each lead (a valid mobile, not a duplicate, inside the service area, real text, not a test lead, filled at human speed), contact the lead on WhatsApp and by phone, read the replies, score the lead, book appointments and send the lead to the business's CRM or sales team.
• To tell the business's own Meta and Google ad accounts which leads turned out real, when the business connects them. Meta receives the Meta lead ID and the stage. Google receives the click ID or a one-way hash of the phone number, the stage and any sale value.
• To bill, support and secure the service, to stop misuse, and to meet legal duties.

We do not sell personal data, we do not use lead data for our own marketing, and one business's lead data is never shown to another. Comparisons with similar businesses use only middle values across at least five businesses.

On what basis

For account data, the contract with the business and the consent of the people who sign up. For lead data, the consent the business collects on its form or ad, which is the business's responsibility. We give every business a consent line to place under its forms, saying it may contact the person on WhatsApp and by phone about their enquiry.

Stopping messages and calls

Reply STOP to any WhatsApp message sent through Streakstone. That business will not message or call your number through Streakstone again. You can also write to the business, or to us at the contact details below.

Who else sees it

We use these service providers to run Streakstone. Each gets only what its part needs:

Lead data also goes wherever the business tells us to send it: its own CRM, Google Sheet, webhook, sales team's WhatsApp, and its own Meta and Google ad accounts. Some providers process data outside India. We use only providers bound to protect it, and we do not transfer data to any country the Government of India restricts.

How long we keep it

• Lead data: while the business's workspace is open. A business can ask us to delete one lead or all of its data at any time. When a workspace closes, we delete its lead data within 30 days.
• Account data: while the account is open, and deleted within 30 days after it closes, except invoices and tax records, which we keep as long as Indian tax law requires.
• Security logs: at least one year, then deleted.
• The list of numbers that replied STOP: as long as needed to keep honouring it.

How we protect it

Encrypted connections everywhere, encrypted storage of keys and tokens, hashed passwords, access by role inside each workspace (an owner, a manager, a sales rep and the front desk each see only what their job needs), signed webhooks from Meta and payment providers, and a log of who changed what. If a breach affects your data, we will tell the affected businesses and people, and the Data Protection Board of India, as the law requires.

Children

Streakstone is for businesses and is not meant for children. Businesses that receive enquiries from people under 18, such as schools and coaching institutes, must get verifiable consent from a parent or guardian before using Streakstone for those enquiries.

Your rights

You can ask for a summary of the personal data we hold about you and who it was shared with, ask us to correct, complete, update or delete it, withdraw consent, and nominate someone to act for you if you cannot. If your data reached us as a lead, we pass your request to the business and help it answer you. Write to the contact details below. We reply within 2 working days and resolve requests within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Changes

When this policy changes we update the date at the top, and tell businesses by email or in the app before a change that affects them takes effect.

Contact

• Streakstone