Data Processing Terms

Part of the Terms of Service. Last updated: 18 October 2026

These terms cover the personal data the customer keeps in LeadRad: leads, contacts, messages, call recordings, files and notes ("Customer Data").

1. Roles

For Customer Data, the customer is the Data Fiduciary: it decides why and how the data is used. SRMG Consulting LLP is its Data Processor and handles Customer Data only on the customer's behalf.

2. Instructions

1. We process Customer Data only to provide LeadRad and as the customer directs: through its use of the app and its settings, through access it grants us, or in writing.

2. We tell the customer if we believe an instruction breaks the law.

3. People and confidentiality

Only people who need it to run LeadRad can reach Customer Data, and they are bound to keep it confidential.

4. Security

A private copy of LeadRad for each customer, with its own database and encryption key.
Encryption in transit; daily encrypted backups at a separate location in India; regular restore tests.
Two-step sign-in for the customer's users and for our own access.
Every access by us to a customer's app recorded in a log the customer can see. System logs kept in India, and cyber security incidents reported to CERT-In within 6 hours, as Indian law requires.

5. Our access to the customer's app

1. We do not open a customer's app or read Customer Data unless the customer grants access in the app (view only; view and fix settings; or "act for me" in an emergency, for up to 24 hours), or the account owner gives written permission from the account's registered email address or WhatsApp number when the app cannot be reached. We may also access the customer's app without a grant where the law requires it, or to investigate and contain a security incident; such access is logged and, where the law allows, told to the customer.

2. Access is time-limited, shown on the customer's screen while it lasts, can be ended by the customer at any time, and every screen opened and change made is logged.

3. Our support resources never read Customer Data beyond a technical health summary, except within a grant the customer makes, and never send messages to the customer's leads.

4. As host, we control the servers and keys, so these limits are our promise and are made visible by the log; they are not a technical lock.

6. Sub-processors

1. We use the kinds of providers listed in the Privacy Policy, section 5, under written terms that protect Customer Data at least as well as these terms. The customer can ask us for the current named list.

2. We give 30 days' notice before adding or replacing a provider that handles Customer Data. If the customer objects for a good reason and we cannot resolve it, the customer may cancel and get a refund of any subscription paid for after the change, within 15 days.

7. AI processing

1. An AI task receives only the Customer Data it needs, such as the message being sorted or the lead a draft is for.

2. Our AI model providers may not use Customer Data to train their models.

3. AI models are tested on our own test data. At the customer's request, we may test AI models on a sample of its Customer Data to recommend or build a more customised AI setup for it; the sample goes only to the AI model providers the customer approves and is deleted after the test.

4. A customer that uses its own AI key sends that data to its own provider, under its own terms.

8. Transfers outside India

Customer Data, including backups, is stored in India. Some providers, such as AI model, email and speech-to-text providers, may process it outside India; the list of named providers shows which. We will follow any restriction the Government of India places on transfers to a country.

9. Personal data breach

If we become aware of a breach affecting Customer Data, we tell the customer without delay, and in any case within 24 hours, with what we know and what we are doing. We help the customer meet its own duty to inform the Data Protection Board of India and the people affected.

10. Requests from the people in the data

LeadRad lets the customer find, correct, export and delete a person's data. If a person writes to us about Customer Data, we pass the request to the customer within 48 working hours and help it respond.

11. End of service

The customer can export its data at any time. After the account closes, it has 30 days to download its data. We then delete the customer's copy of LeadRad and its data, including backups, except records the law requires us to keep (Privacy Policy, section 7). On request we confirm the deletion in writing.

12. The customer's duties

The customer must give the people in its data any notice the law requires, have a lawful basis (such as consent) to collect and contact them, and avoid storing more personal data than it needs.

13. Information and audits

We answer the customer's reasonable written questions about how we protect Customer Data, up to once a year, and share relevant reports or certificates we hold.