Privacy Policy

1. Who operates BrokLeads (data controller)

BrokLeads is a product operated by Teknoesis, based in Lahore, Pakistan. Where we act as a controller (see below), Teknoesis is the entity responsible for your personal information.

• Operating entity: Teknoesis
• Location: Lahore, Pakistan
• Privacy contact: support@brokleads.com

2. Scope & our two roles

BrokLeads plays two different privacy roles depending on the data involved:

• As a controller — for information about our website visitors, the business staff who hold BrokLeads accounts, and people who contact us or request a demo. We decide how and why this data is used, and this Policy governs it.
• As a processor— for the lead, contact, message, listing and sales records that our customers (the businesses that subscribe to BrokLeads) capture and manage inside the Service (“Customer Data”). Here the business is the controller; we process that data on its instructions under our Terms of Service, including the data processing terms in section 8 of those Terms. If you are a lead or customer of a business that uses BrokLeads, please direct privacy requests to that business.

3. Information we collect

Information you provide

• Account & profile data — name, work email, phone, company name, role and password when an account is created for you.
• Demo & enquiry data— the details you submit through our “Book a demo” or contact forms (name, work email, company, team size, phone and message).
• Customer Data you enter — leads, clients, contacts, listings, notes, tasks, messages and sales records you add to the Service.
• Payment & billing data — billing contact, plan, seats, invoices and payment status. We do not take card payments online or store card numbers; if you pay by bank transfer or card, that payment is handled by your bank or payment provider.

Information collected automatically

• Usage & device data — IP address, browser and device type, pages viewed, referring URLs and timestamps.
• Cookies & similar technologies — see our Cookie Policy. We use a small number of strictly-necessary cookies to keep you signed in and remember your active branch. We do not use advertising cookies. We also use Google Analytics cookies to measure page visits. In the EEA, the UK and Switzerland they stay off unless you accept; elsewhere you can switch them off in the Cookie Policy.

Information from the BrokLeads mobile app

• Push notifications— if you allow notifications, the app registers a push token and your device type (iOS or Android) with us so we can alert you about new leads and messages. We send notifications through Expo’s push service, which passes them to Apple Push Notification service or Google Firebase Cloud Messaging. A notification can include the lead’s or contact’s name and a short preview of a new message. You can turn notifications off in your device settings.
• Photos and files you choose — the app only accesses a photo or document when you pick one to send in a chat. It is uploaded to deliver that message; we do not access the rest of your photo library or files.
• Face ID, Touch ID or fingerprint unlock — if you turn this on, your device checks your biometrics. We never receive or store biometric data.
• Sign-in token— kept in your device’s secure storage (iOS Keychain or Android Keystore) and removed when you sign out.

The app does not access your contacts, location, camera or microphone, and it contains no advertising or third-party analytics tools.

Information from connected services (Meta, WhatsApp & TikTok)

We access data through the Meta, WhatsApp Business and TikTok for Business APIs only on behalf of a business client who has authorised the connection, and only to deliver the Service. The one exception is Facebook Login, which you choose yourself. Specifically:

• Facebook Login (permissions public_profile and email) — if you choose “Continue with Facebook” on the web or mobile app, Meta shares the email address of your Facebook account with us. We use it only to find your existing BrokLeads account and sign you in. We do not create accounts from Facebook Login, post to Facebook, or keep your Facebook profile.
• Facebook Page data — the Pages a client authorises us to manage, and their basic identifiers, so leads can be linked to the correct Page and campaign.
• Ad account & campaign data (permission ads_read) — ad accounts, campaigns, ad sets and lead-form metadata retrieved through the Facebook Marketing API, used to attribute and organise incoming leads.
• Lead Ads form submissions (permission leads_retrieval) — the responses a person submits in a Facebook or Instagram lead form (such as name, phone, email and the questions the business configured), delivered to us in real time via the Meta leadgen webhook.
• WhatsApp Business messaging data— inbound and outbound messages, message status and the contact profile name for the client’s connected WhatsApp Business number.
• Messenger and Instagram messages(only when a business switches on the Messenger & Instagram inbox; permissions such as pages_messaging and instagram_manage_messages) — messages people send to the business’s Facebook Page or Instagram professional account, the sender’s Page-scoped or Instagram-scoped ID and profile name, links to any attachments, and the replies the business’s staff send. We use this only to show the conversation in the business’s inbox, create or update the related lead, and send the business’s replies within Meta’s messaging rules.
• TikTok Lead Generation data— when a business connects its TikTok for Business advertiser account, we receive the answers people submit in that business’s TikTok Instant Forms (such as name, phone, email and the questions the business set up), together with the advertiser, campaign, ad group, ad and form identifiers, through the TikTok API for Business. We also store the access token TikTok issues for the connection, encrypted. We use this data only to create and attribute leads in that business’s account.
• Website lead forms — when a business adds our form to its own website, we receive what the visitor submits, plus the page address, referring page and campaign tags (UTM parameters, gclid and fbclid), so the business can see where the lead came from.
• Other sources — leads a business adds by hand or labels as coming from sources such as LinkedIn, Google Ads, walk-ins or referrals. We do not connect to LinkedIn or Google Ads accounts.

We use Meta, WhatsApp and TikTok data solely to provide the Service to the authorising client, in accordance with the Meta Platform Terms, the Meta Developer Policies and TikTok’s terms for the TikTok API for Business. We do not sell this data, do not use it for advertising or profiling of our own, and do not share it beyond what is described in this Policy.

Conversion events we send to Meta (only if a business turns this on)

A business can choose to switch on the Meta Conversions API feature and connect its own Meta dataset. It is off unless the business turns it on. When it is on, and a lead in that business’s account reaches certain stages (qualified, working deal, deal closed, lost or unqualified) or a sale is approved, we send an event to the business’s Meta dataset on the business’s behalf.

Each event contains the event name and time, the Meta lead ID if the lead came from a Facebook or Instagram lead form, and, for approved sales, the sale value and currency. To help Meta match the event, we may also send the lead’s email address, phone number and first and last name, but only after hashing them with SHA-256 on our servers, so Meta receives a one-way code rather than the actual details. Leads with no Meta lead ID, email or phone are never sent. Meta uses these events to measure and improve the business’s ads under Meta’s Business Tools Terms. The business is responsible for telling its leads about this and for getting any consent the law requires. The business can turn it off at any time.

4. How we use information

• Provide, operate, secure and improve the Service.
• Route and distribute leads to the right team members, and power WhatsApp, Messenger and Instagram messaging, reporting and sale approvals.
• Send push notifications and emails about new leads, messages and tasks.
• Authenticate users and protect against fraud, abuse and unauthorised access.
• Respond to demo requests, enquiries and support tickets.
• Send service, security and (where permitted) product update communications.
• Meet legal, tax and accounting obligations.

5. Legal bases

Where data-protection law requires a legal basis, we rely on: performance of a contract (providing the Service and account); our legitimate interests (securing and improving the Service, responding to enquiries); consent (for non-essential marketing, which you may withdraw at any time); and compliance with legal obligations.

6. How we share information

We do not sell personal information. We share it only:

• With sub-processors — vendors who process data on our behalf under written confidentiality and data-protection obligations:
  • Laravel Cloud — application hosting, managed PostgreSQL database, file storage and backups, in Singapore.
  • Vercel — hosting for our website and web app, with its servers in Mumbai, India.
  • Laravel Nightwatch — error and performance monitoring.
  • Our transactional email provider — sending account, security and notification emails.
  • Expo, with Apple Push Notification service and Google Firebase Cloud Messaging — delivering mobile push notifications.
  • Cloudflare Turnstile — bot protection on the lead form businesses embed on their websites.
  • Anthropic — only for businesses that switch on the AI assistant. It receives the text of one conversation at a time to write a summary or a suggested reply that the business’s team reviews (or, for a business in the pilot that has automatic AI replies switched on, a first or after-hours reply), with phone numbers and email addresses removed first.
  • Meta Platforms (Facebook, Instagram, Messenger, WhatsApp Business Platform) and TikTok — only for the integrations a business connects.
  You can ask for more detail about any of them at support@brokleads.com.
• With connected platforms — Meta, the WhatsApp Business Platform and TikTok, only as needed to deliver the integrations a business has enabled, including conversion events sent to Meta when a business turns on the Conversions API (see section 3).
• Within your business — Customer Data is visible to authorised users of the same branch/business according to their role and permissions.
• Our support staff — authorised Teknoesis staff can view a business’s account, and sign in as one of its users, only to handle that business’s support request or to investigate a security or technical problem. Each such access uses a single-use, short-lived link and is logged.
• For legal reasons — to comply with law, enforce our terms, or protect the rights, safety and property of BrokLeads, our customers or others.
• In a business transfer — as part of a merger, acquisition or sale of assets, subject to this Policy.

7. International transfers

BrokLeads is run from Pakistan. Our application and database are hosted with Laravel Cloud in Singapore, and our website and web app are served by Vercel from Mumbai, India. Our other sub-processors (listed in section 6), including Meta, TikTok and Expo, process data in other countries, including the United States. This means personal data from Saudi Arabia, the United Arab Emirates, Pakistan and elsewhere may be transferred to and processed outside the country where it was collected.

We transfer only the data a provider needs to do its job, and only to providers bound by written terms that require them to protect it. For transfers from Saudi Arabia and the UAE we rely on the grounds and safeguards those laws allow, such as contractual data-protection terms and transfers needed to provide the Service you or your business asked for. We do not currently offer hosting inside Saudi Arabia, the UAE or Pakistan; if your business needs this, please contact us before you sign up.

8. Data retention

We keep personal information for the periods set out below. Customer Data is held on the business’s instructions and can be deleted earlier on request (see Data Deletion).

Where we are legally required to keep certain records longer (for example tax or fraud-prevention), we retain only what the law requires and delete the rest.

9. Security

We apply technical and organisational measures to protect personal information, including encryption in transit, access controls, per-branch data isolation and least-privilege permissions. See our Security page for more detail. No method of transmission or storage is 100% secure, but we work continuously to protect your data.

If a personal-data breach affects data we hold, we will investigate promptly and tell the affected businesses without undue delay. Where we are the controller, we will notify the relevant regulator and the people affected when the law requires it and within the time it sets.

10. Your rights & choices

To exercise a right over data for which we are the controller, email support@brokleads.com. We reply within 30 days, may ask you to confirm your identity first, and do not charge for requests unless they are clearly unfounded or excessive. If your data sits inside a business’s account (for example, you are one of its leads or clients), please contact that business; we will pass your request on and help them respond, as their processor. You can unsubscribe from marketing emails at any time via the link in the email.

If you are in Saudi Arabia

Under the Personal Data Protection Law you have the right to be told how your personal data is collected and used; to access it and get a copy in a clear, readable format; to have it corrected, completed or updated; and to have it destroyed when it is no longer needed. Where we rely on your consent, you can withdraw it at any time. If you are not satisfied with our reply, you can complain to the Saudi Data & AI Authority (SDAIA).

If you are in the United Arab Emirates

Under Federal Decree-Law No. 45 of 2021 you have the right to information about how your data is processed; to access it; to receive it in a structured, machine-readable format and have it sent to another controller where technically possible; to have it corrected or erased; to restrict or stop its processing; and to object to decisions based solely on automated processing that have legal or similarly significant effects on you. You can complain to the UAE Data Office. If you are in the DIFC or ADGM, the data-protection law of that free zone applies instead.

If you are in Pakistan

Pakistan does not yet have a general data-protection law in force. We apply the standards in this Policy to your data, give you the rights described above, and comply with the Prevention of Electronic Crimes Act, 2016.

Automated decisions

BrokLeads can assign new leads to team members automatically, using rules the business sets (for example, taking turns with daily limits). This only decides which team member contacts a lead. We do not make decisions with legal or similarly significant effects on anyone solely by automated means, and we do not use personal data for profiling.

11. Data deletion

You can request deletion of your personal data at any time, including data we obtained through the Meta, WhatsApp and TikTok integrations (Facebook Page, ad account/campaign, Lead Ads, Messenger, Instagram, WhatsApp messaging and TikTok lead data).

Self-service (fastest): visit brokleads.com/account/delete — no login required. Enter your account email and confirm via the link we send. Your account is deactivated and signed out of the web and mobile apps straight away, and your personal data is permanently deleted after a 7-day grace period. You can also start this from the BrokLeads web app under Settings → Profile → Delete account, or in the mobile app under Settings → Delete account; both send the same confirmation email.

Alternatively, email support@brokleads.com with the subject “Data Deletion Request”. Full step-by-step instructions and timelines are on our Data Deletionpage. We delete or irreversibly anonymise your data within 30 days unless we are legally required to retain it. Business records owned by your employer’s workspace may be retained by the workspace owner.

12. Children

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect their personal information.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a revised “Last updated” date and, where appropriate, additional notice.

14. Contact us

Questions about this Policy or your data can be sent to support@brokleads.com.

Teknoesis — Lahore, Pakistan