How Winnow handles data.

Winnow is a Chrome side-panel tool for IndiaMART sellers, plus this website and a dashboard where licence holders manage their rules and see their results. “We” and “us” below mean the people who run Winnow.

The way to reach us about anything on this page is WhatsApp +44 7448 142992.

For counsel: Add the legal entity name, registered address and a support email here, and confirm who the data controller is for each kind of data described below.

• This website uses no analytics, advertising or tracking scripts or cookies. It sets one cookie, and only when you sign in.
• Your account is your email address (and, if you use Google, your name and photo). Google handles the sign-in.
• Deciding whether a lead fits happens in your own browser. Our server receives usage counters, short summaries of leads your rules match, and your rules.
• If you switch auto-pick on, the full details of each lead Winnow picks for you, including the buyer’s contact details, are stored on our server, encrypted, so you can see them in your dashboard. That is personal data about someone else, so it has its own section below.
• We never receive your IndiaMART password or session cookies.

Visiting. The site is hosted by Vercel. Like any web host, its servers record each request (your IP address, the page, your browser and the time) so the site can be served and kept secure. We don’t add analytics, advertising or tracking scripts, and the fonts are served from this site rather than a third party.

The request-access form. The form does not send anything to our servers. When you submit it, it opens WhatsApp with your answers already typed into a message to us. We receive it only if you press Send there, and WhatsApp’s own privacy policy covers that message. We use what you send to reply and to set up your licence.

You sign in with Google or with a one-time link sent to your email; there is no password. Sign-in is handled by Google’s Firebase Authentication. We receive and keep your email address, a unique account id, and (if you use Google) your name and profile photo. We use them to sign you in, to show your name and photo in the dashboard, and to link your account to your licence.

What is stored in your browser:

• A session cookie (__session) that keeps you signed in. It is strictly necessary, is not readable by scripts on the page, lasts up to 5 days, and is removed when you sign out.
• Firebase’s sign-in state, kept by Google’s sign-in library in your browser storage.
• The email you typed when asking for a sign-in link, kept on your device until you finish signing in, so the link can be completed.
• Draft rules in the preview dashboard. Before a licence is linked, the dashboard shows example data. Anything you type into the preview rules editor stays in your browser and is not sent to us.

Signing out ends your session on every device you are signed in on, not just the one you clicked on.

The extension needs an active licence to work at all. It runs in your own logged-in IndiaMART tab and talks only to seller.indiamart.com and to our licence server. It contains no analytics or advertising code. Deciding whether a lead matches your rules happens entirely in your browser.

Our server receives:

• Roughly every 15 minutes: your licence key, a random device id, the extension version, its run status and counters (scanned, picked, rejected and similar), a count of your rules (not the words), up to 30 recent rejection reasons each with a lead title cut to 60 characters, and up to 10 recent error messages. It also receives a session token it issued earlier, and a short salted hash of the network address of the last contact (not the address itself), used only to notice one installation being copied to a second machine. From the scanned counter it keeps a day-by-day count of leads scanned (one number per day, no lead content) for your Analytics page.
• When you connect your browser to your dashboard, or start a free trial: the device id and a label such as “Chrome on Windows”, so you can recognise your own browser. For a free trial the server also keeps a keyed hash of the network address the request came from (not the address itself), only to limit how many trials one network can start; the hash is cleared after 30 days.
• For each lead your rules match, or Winnow picks: a short summary: an opaque lead identifier, a title cut to 60 characters, the matched keyword, country, state, form, quantity, lead age, whether the buyer is GST-verified, and the outcome. This does not include the buyer’s name, phone number or email.
• For each lead Winnow picks and confirms: the full lead and the buyer’s contact details as IndiaMART reveals them (see the next section).
• Your rules and run schedules, when you save them in the dashboard, stored against your licence and linked to your dashboard account.

Leads your rules reject are not sent, apart from the counters and the short rejection excerpts above. Leads you contact by hand are not sent. Your IndiaMART password and cookies are never accessed. The table on the Safety, data & licence page sets this out in full.

When Winnow picks a lead for you and the pick is confirmed, the buyer’s contact details (phone number, email address, and name and company where the page shows them) reach our server so that you can see them in your dashboard. That is personal data about a third party.

• It is encrypted on our server field by field (AES-256-GCM) with a key that is not stored in the database. If the server has no key configured, it stores nothing.
• Only your licence can read it back through the service. Our admin tools show only metadata (when, which lead, whether a contact was captured), never the details.
• This is a safeguard against leaks and casual access, not a guarantee that we cannot read it: we run the database and hold the key.
• It is deleted after 180 days, or sooner if you ask. We don’t use it for anything other than showing it to you.
• It is only captured for picks the extension makes, never for leads you contact by hand.

You decide to contact the buyer and to hold their details, so you are responsible for having a lawful basis to do so, and for how you use them.

For counsel: Controller and processor roles, whether a data-processing agreement is needed, cross-border transfers, and how buyers can exercise their rights are not settled here. How IndiaMART presents the revealed contact has not been verified against the live page, so what is actually captured may differ from the above.

• Vercel hosts this website and our licence server.
• A managed Postgres database (Neon) stores licence, device, rules and event records.
• Google (Firebase Authentication) handles sign-in, and Google sign-in is governed by Google’s own privacy policy.
• Stripe handles card payments. Your card details go to Stripe, never to us; we keep your Stripe customer and subscription ids and show you your invoices from Stripe.
• WhatsApp (Meta) carries the message if you contact us that way.

The extension itself talks to no one but IndiaMART, in your own session, and our licence server.

For counsel: Confirm the full list of processors and the regions they store data in, and add any transfer mechanisms that are needed.

• Check-ins (counters, rejection excerpts): the latest 500 per licence; older ones are deleted automatically.
• Copy-detection events: 7 days.
• The day-by-day count of leads scanned: 400 days.
• The network-address hash that limits free trials: 30 days.
• Summaries of matched and picked leads: 400 days.
• Picked-lead details, including buyer contact details: 180 days.
• Your licence record, device records, saved rules and schedules, and the link to your dashboard account: while your licence exists, and until you ask us to erase them.
• Your sign-in account: until you ask us to delete it.
• Website hosting logs: kept by Vercel for a limited period under its own policy.

You can ask us, at WhatsApp +44 7448 142992, to tell you what we hold about you, to correct it, to give you a copy, or to delete it. To erase a customer we revoke the licence and delete the records tied to it. Depending on where you live, you may have further rights under your local law.

• Stop the extension contacting our server: use Deactivate in the extension’s Settings tab. It makes one final call to release the device, clears the licence from that browser and stops all further contact. Uninstalling removes what the extension stored locally.
• Buyers: if your details were captured by a seller using Winnow and you want them removed, message us and we will help.

The site and licence server are served over HTTPS, the session cookie cannot be read by scripts on the page, buyer contact details are encrypted at rest, and sign-in has no password to leak. No system is perfectly secure, and we can’t promise this one is.

We will update this page when how Winnow handles data changes, and change the date at the top.