How WinLead handles data.

WinLead is a Chrome side-panel tool for IndiaMART sellers, plus this website and a dashboard where licence holders manage their rules and see their results. “We” and “us” below mean the people who run WinLead.

The way to reach us about anything on this page is WhatsApp +44 7448 142992.

For counsel: Add the legal entity name, registered address and a support email here, and confirm who the data controller is for each kind of data described below.

• This website uses no analytics, advertising or tracking scripts or cookies. It sets one cookie, and only when you sign in.
• Your account is your email address (and, if you use Google, your name and photo). Google handles the sign-in.
• Deciding whether a lead fits happens in your own browser. Our server receives usage counters, short summaries of leads your rules match, and your rules.
• If you switch auto-pick on, the full details of each lead WinLead picks for you, including the buyer’s contact details, are stored on our server, encrypted, so you can see them in your dashboard. That is personal data about someone else, so it has its own section below.
• We never receive your IndiaMART password or session cookies.

Visiting. The site is hosted by Vercel. Like any web host, its servers record each request (your IP address, the page, your browser and the time) so the site can be served and kept secure. We don’t add analytics, advertising or tracking scripts, and the fonts are served from this site rather than a third party.

Messaging us on WhatsApp. The WhatsApp links on the site open a chat with a message to us already typed in. Nothing is sent to our servers; we receive the message only if you press Send there, and WhatsApp’s own privacy policy covers it. We use what you send to reply and, if you ask, to set up your licence.

You sign in with Google or with a one-time link sent to your email; there is no password. Sign-in is handled by Google’s Firebase Authentication. We receive and keep your email address, a unique account id, and (if you use Google) your name and profile photo. We use them to sign you in, to show your name and photo in the dashboard, and to link your account to your licence.

Once your account is linked to a licence, your name and email are also kept with that licence on our licence server, and the extension shows them on its Settings tab on every computer that uses the licence, so whoever runs it there can see whose account it belongs to. If they change in your account, the copy is updated the next time you open the dashboard, and it is removed from the licence when you disconnect it.

What is stored in your browser:

• A session cookie (__session) that keeps you signed in. It is strictly necessary, is not readable by scripts on the page, lasts up to 5 days, and is removed when you sign out.
• Firebase’s sign-in state, kept by Google’s sign-in library in your browser storage.
• The email you typed when asking for a sign-in link, kept on your device until you finish signing in, so the link can be completed.
• Draft rules in the preview dashboard. Before a licence is linked, the dashboard shows example data. Anything you type into the preview rules editor stays in your browser and is not sent to us.

Signing out ends your session on every device you are signed in on, not just the one you clicked on.

The extension needs an active licence to work at all. It runs in your own logged-in IndiaMART tab and talks only to IndiaMART’s own pages (seller.indiamart.com and its other indiamart.com addresses) and to our licence server. It contains no analytics or advertising code. Deciding whether a lead matches your rules happens entirely in your browser.

Our server receives:

• Roughly every 15 minutes: your licence key, a random device id, the extension version, its run status and counters (scanned, picked, rejected and similar), a count of your rules (not the words), up to 30 recent rejection reasons each with a lead title cut to 60 characters, and up to 10 recent error messages. It also receives a session token it issued earlier, and a short salted hash of the network address of the last contact (not the address itself), used only to notice one installation being copied to a second machine. From the scanned counter it keeps a day-by-day count of leads scanned (one number per day, no lead content) for your Analytics page.
• When you connect your browser to your dashboard, or start a free trial: the device id and a label such as “Chrome on Windows”, so you can recognise your own browser. For a free trial the server also keeps a keyed hash of the network address the request came from (not the address itself), only to limit how many trials one network can start; the hash is cleared after 30 days.
• For each lead your rules match, or WinLead picks: a short summary: an opaque lead identifier, a title cut to 60 characters, the matched keyword, country, state, form, quantity, lead age, whether the buyer is GST-verified, and the outcome. This does not include the buyer’s name, phone number or email.
• For each lead WinLead picks and confirms: the full lead and the buyer’s contact details as IndiaMART reveals them (see the next section).
• Your rules and run schedules, when you save them in the dashboard, stored against your licence and linked to your dashboard account.

Leads your rules reject are not sent, apart from the counters and the short rejection excerpts above. Leads you contact by hand are not sent. Your IndiaMART password and cookies are never accessed. The table on the Safety, data & licence page sets this out in full.

When WinLead picks a lead for you and the pick is confirmed, the buyer’s contact details (phone number, email address, and name and company where the page shows them) reach our server so that you can see them in your dashboard. That is personal data about a third party.

• It is encrypted on our server field by field (AES-256-GCM) with a key that is not stored in the database. If the server has no key configured, it stores nothing.
• Only your licence can read it back through the service. Our admin tools show only metadata (when, which lead, whether a contact was captured), never the details.
• This is a safeguard against leaks and casual access, not a guarantee that we cannot read it: we run the database and hold the key.
• It is deleted after 180 days, or sooner if you ask. We don’t use it for anything other than showing it to you.
• It is only captured for picks the extension makes, never for leads you contact by hand.

Your IndiaMART Lead Manager contacts, if you sync them. The extension’s Settings can send the buyers in your Lead Manager (name, company, mobile number, location, last product and message, dates, lead type and tags) to our server so your dashboard can show them and let you download them. This happens only when you press Sync, and is handled the same way: encrypted field by field, readable only by your licence’s owner through the dashboard, deleted when not synced again for 365 days, and deletable by you at any time from the dashboard.

Telegram alerts, if you set them up. You create your own Telegram bot and give us its token, which we keep encrypted and never show again. Our server then uses your bot to message your own chat when a lead matches (its title, quantity, location and keyword) or is picked (also the buyer’s name, company, phone numbers and email). Telegram keeps those messages under its own terms, outside our retention above. You choose matches, picks or both, and can remove the bot any time from Settings, which deletes its token from our server.

WhatsApp alerts, if you set them up. You give us your WhatsApp number and confirm it with a code we send there. We keep the number to send you the same alerts as above from our WhatsApp Business number, through Meta. Meta keeps those messages under the WhatsApp Business terms. You can switch matches and picks separately, and remove your number any time from Settings.

You decide to contact the buyer and to hold their details, so you are responsible for having a lawful basis to do so, and for how you use them.

For counsel: Controller and processor roles, whether a data-processing agreement is needed, cross-border transfers, and how buyers can exercise their rights are not settled here. How IndiaMART presents the revealed contact has not been verified against the live page, so what is actually captured may differ from the above.

• Vercel hosts this website and our licence server.
• A managed Postgres database (Neon) stores licence, device, rules and event records.
• Google (Firebase Authentication) handles sign-in, and Google sign-in is governed by Google’s own privacy policy.
• Stripe handles card payments. Your card details go to Stripe, never to us; we keep your Stripe customer and subscription ids and show you your invoices from Stripe.
• WhatsApp (Meta) carries the message if you contact us that way.
• Telegram delivers lead alerts from your own bot to your chat, only if you set it up in Settings.
• Meta (WhatsApp Business) delivers lead alerts and the number-verification code to your WhatsApp, only if you set it up in Settings.

The extension itself talks to no one but IndiaMART, in your own session, and our licence server.

For counsel: Confirm the full list of processors and the regions they store data in, and add any transfer mechanisms that are needed.

WinLead’s use of information received through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. In particular:

• We use it only to run WinLead for you: checking leads against your rules, picking them, and showing your results in your dashboard.
• We don’t sell it, and we don’t use or share it for advertising, or to decide anyone’s creditworthiness or lending.
• Our people look at it only when you ask us for help with your rules or account, when it is needed for security or to investigate abuse, or when the law requires it.
• We share it only with the services listed above that run WinLead for us, or with others when you set it up, such as your Telegram bot.

• Check-ins (counters, rejection excerpts): the latest 500 per licence; older ones are deleted automatically.
• Copy-detection events: 7 days.
• The day-by-day count of leads scanned: 400 days.
• The network-address hash that limits free trials: 30 days.
• Summaries of matched and picked leads: 400 days.
• Picked-lead details, including buyer contact details: 180 days.
• Synced Lead Manager contacts: 365 days after they were last synced, or until you delete them.
• Your licence record, device records, saved rules and schedules, and the link to your dashboard account: while your licence exists, and until you ask us to erase them.
• Your sign-in account: until you ask us to delete it.
• Website hosting logs: kept by Vercel for a limited period under its own policy.

You can ask us, at WhatsApp +44 7448 142992, to tell you what we hold about you, to correct it, to give you a copy, or to delete it. To erase a customer we revoke the licence and delete the records tied to it. Depending on where you live, you may have further rights under your local law.

• Stop the extension contacting our server: use Deactivate in the extension’s Settings tab. It makes one final call to release the device, clears the licence from that browser and stops all further contact. Uninstalling removes what the extension stored locally.
• Buyers: if your details were captured by a seller using WinLead and you want them removed, message us and we will help.

The site and licence server are served over HTTPS, the session cookie cannot be read by scripts on the page, buyer contact details are encrypted at rest, and sign-in has no password to leak. No system is perfectly secure, and we can’t promise this one is.

We will update this page when how WinLead handles data changes, and change the date at the top.