Privacy Policy

PakkaLead is operated by PRPS Agencies Private Limited, a private limited company incorporated in India on 31 August 2021. We are the data fiduciary for the personal data described in this policy.

• Registered office: Plot No 257, Sy No 14, Sai Baba Nagar, Kismathpur, Gandipet Mandal, Ranga Reddy, Telangana 500086, India
• Principal place of business: 5th Floor, Shanta Sriram Building, Sy No 126, Gachibowli, beside DLF Building (PSR Towers), Hyderabad, Telangana 500032, India
• CIN: U70106TG2021PTC154471
• GSTIN: 36AAMCP2487R1ZE
• Telangana RERA agent registration: A02400001973 (valid to 5 January 2027)
• Contact: support@pakkalead.in

PakkaLead is a real estate CRM for brokers and agencies, available as an Android application and a web application. This policy explains what we collect, why, who we share it with, and the choices you have. It applies to both the app and this website.

Account details. Your mobile number is required to create an account and is verified by a one-time password. You may also add your name, email address, profile photo, company name, RERA registration number, years of experience, service areas, specialisations and a short bio.

Business records you enter. The CRM stores the working data you put into it: your leads and their contact details, budgets and preferred locations, notes, follow-ups, site visits, deals, commissions, marketplace posts, project and inventory listings, and your team and partner-network connections. This data is yours. We process it only to provide the service to you.

Third-party data you bring in.When you enter or import a client’s details, or connect a lead source such as Meta Lead Ads, Google Ads or a website form, you are giving us personal data about other people. You confirm you are entitled to share it and to contact those people, including under India’s Do-Not-Disturb rules. For that data you are the controller and we process it on your instructions.

Payment details. Subscription payments are collected by Razorpay. We receive and store only the payment reference, order reference, plan and amount. Card numbers, UPI PINs, CVV and bank credentials never reach our servers.

Every permission below is optional, is requested only when you first use the feature that needs it, and can be withdrawn at any time in your device settings. The app keeps working without them; only the related feature stops.

• Phone and call log (READ_CALL_LOG, WRITE_CALL_LOG, READ_PHONE_STATE, CALL_PHONE) — the core purpose of the CRM is keeping an accurate record of client calls. With this permission the app reads the date, time, direction and duration of calls involving numbers already saved in your CRM, logs them against the matching lead, and shows an after-call prompt so you can add a note. Calls with numbers that are not in your CRM are used only to offer to save the number, and are not stored on our servers. We never record, listen to or transcribe call audio.
• Caller ID / call screening role. If you choose to make PakkaLead your caller-ID app, Android hands it the incoming number so the after-call note prompt can appear. Numbers are matched against your own CRM on your device; they are not sent to any spam or caller-ID database.
• Contacts (READ_CONTACTS, WRITE_CONTACTS) — to show a name instead of a bare number for a call, to let you pick a number from your phonebook when adding a lead, and to save a lead back to your phone contacts when you ask. Your phonebook is read on the device for matching. We do not upload, index or keep a copy of your contact list.
• Camera — to scan the QR code that links the web app to your account, and to take photos for listings and your profile.
• Photos and media — to attach images you choose to listings, marketplace posts and your profile.
• Microphone— used only while you are dictating a note, and for the voice assistant. Speech is converted to text by your device’s own speech recogniser; we receive only the resulting text.
• Calendar (READ_CALENDAR, WRITE_CALENDAR) — if you turn calendar sync on, the app writes your follow-ups, site visits and meetings into a calendar you pick, and removes the events it created when you turn sync off. Sync is one-way and we do not read your other events.
• Notifications — to deliver follow-up reminders, lead alerts, chat messages and payment confirmations.
• Display over other apps — to show the small after-call note popup on top of the dialler. It appears only just after a call.
• Foreground service and battery-optimisation exemption — to keep call logging reliable on devices that would otherwise stop the app in the background.

What we do not collect. The app does not request or use SMS or call-content permissions, and does not collect your location. We do not use advertising identifiers, we run no third-party advertising or analytics SDKs, and we do not build profiles for advertising.

Push notification token. A Firebase token identifying your installation, used to send you reminders and alerts.

Device and diagnostic data. App version, operating system version, device model and crash reports, used to fix crashes.

Technical logs. Standard server logs including IP address, request time and error diagnostics, retained for security and debugging.

• to create and run your account, and to authenticate you;
• to provide the CRM features you use — leads, follow-ups, call history, site visits, deals, commissions, projects, inventory, marketplace, partner network and team management;
• to send you transactional messages: follow-up reminders, lead alerts, chat notifications and payment confirmations;
• to take payment for a subscription and to issue invoices;
• to answer your support requests;
• to keep the service secure, prevent abuse and diagnose faults;
• to meet our legal, tax and accounting obligations.

We do not use your business records to train AI models, and we do not sell or rent personal data to anyone.

Some features share data by design, and only when you choose to use them: publishing a marketplace post or inventory listing, sending or accepting a partner connection, sharing a lead or referral with another user, chatting with another user, and adding someone to your organisation. Where you invite a colleague into your organisation, the leads assigned to them and the team performance reports become visible to them and to the organisation owner.

We use a small number of processors, each for a specific purpose:

• Google Cloud Platform — application hosting and the primary database, in the Mumbai (asia-south1) region.
• Google Firebase — sign-in tokens, push notifications, in-app chat and crash reporting.
• MSG91 / Twilio — delivery of one-time password SMS.
• Razorpay — subscription payments, refunds and invoicing.
• Cloudinary — storage and delivery of images and documents you upload.
• Google Gemini — powers the optional AI assistant and spreadsheet-import column matching. Only the text of your request, or the column headers of the file, and the records needed to answer are sent. It is not used to train Google’s models.
• Meta — only if you connect a Meta Lead Ads account, to fetch the leads from your own forms.
• Your own email provider — if you connect a mailbox (Google or Microsoft), the app sends mail as you, through your account. We hold the access token and the messages we send on your behalf.

Where you send a client a WhatsApp message from the app, the app simply opens WhatsApp on your phone with the text prefilled. The message is sent from your own WhatsApp account and does not pass through our servers.

We disclose data to law enforcement or a regulator only where we are required to by Indian law, and we do not share it for advertising.

Your CRM data is stored in India, in Google Cloud’s Mumbai region. Some of the processors listed above operate globally and may process limited data outside India under their own contractual safeguards.

Account and CRM data is retained while your account is open. You can delete your account from Profile → Delete Account in the app, or by emailing us. On deletion we erase your account, profile, business records and chat messages within 30 days, except records we must keep for tax and accounting purposes (invoices and payment references, retained as required by law). Server logs are kept for up to 90 days.

Traffic is encrypted in transit with TLS. Authentication uses signed tokens, session tokens are held in the device keystore, access to production data is restricted to authorised personnel, and payment authorisation is verified cryptographically. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data.

You can access and correct your details in the app, export your leads and contacts, withdraw any device permission in your device settings, and delete your account at any time. To ask what personal data we hold about you, to have it corrected or erased, or to withdraw consent, email support@pakkalead.in from your registered address. We respond within 30 days.

For any complaint about how your personal data is handled, write to support@pakkalead.inwith “Grievance” in the subject line, addressed to the Grievance Officer, PRPS Agencies Private Limited, 5th Floor, Shanta Sriram Building, Sy No 126, Gachibowli, beside DLF Building (PSR Towers), Hyderabad, Telangana 500032, India. We acknowledge complaints within 48 hours and resolve them within 15 days, as required under Indian law.

The service is intended for real estate professionals and is not directed at anyone under 18. We do not knowingly collect data from children.

If we change this policy we will update the date above and, for material changes, notify you in the app or by email. Questions and requests go to support@pakkalead.in, or PRPS Agencies Private Limited, 5th Floor, Shanta Sriram Building, Sy No 126, Gachibowli, beside DLF Building (PSR Towers), Hyderabad, Telangana 500032, India.