Privacy policy
How proprev handles personal data: on this website, for the people who use proprev, and for the buyers whose details our customers manage in it.
Who we are and what this covers
proprev is a sales CRM for real-estate developers, builders and their channel partners. In this policy, "proprev", "we" and "us" refer to the company that provides it.
This policy explains how we process personal data when you visit our website, ask for a demo, sign in to proprev or otherwise deal with us. It is written for the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act"), and the Information Technology Act, 2000.
Our two roles under the DPDP Act
We handle personal data in two different capacities, and your rights work differently in each.
- As a Data Fiduciary, for data we decide to collect ourselves: website visitors, people who request a demo, and the account details of people who sign in to proprev. This policy governs that data.
- As a Data Processor, for data our customers put into proprev about their own leads, buyers, channel partners and staff. Each customer (the developer or builder) is the Data Fiduciary for that data and decides why and how it is used. We process it only on the customer's instructions, under our agreement with them.
If you are a home buyer or an enquirer and a developer contacted you through proprev, the developer is responsible for your data. Please contact them first. We will help them respond to you (see Data our customers put into proprev).
What we collect
When you visit the website or ask for a demo
- What you type into our forms: your name, work email, phone number, company, your role and roughly how many enquiries you receive.
- The content of messages you send us.
- Basic technical data our hosting provider records when serving pages, such as IP address, browser type and the time of the request.
When you use proprev
- Account details: name, work email, phone number, role and the workspace and projects you have access to.
- Sign-in and security data: authentication records, session identifiers, IP addresses, device and browser details, failed sign-in attempts and security events. We use these to keep accounts safe, for example to lock an account after repeated failed attempts, revoke sessions or enforce an IP allow-list your administrator sets.
- Activity records: an audit log of significant actions taken in the workspace, kept so the customer can see who did what and when.
- Support communications you send us.
How we use it
We use the personal data we control for these purposes, on the basis of your consent or a legitimate use permitted by the DPDP Act:
| Purpose | Data | Basis |
|---|---|---|
| Respond to a demo request or enquiry, and follow up about proprev | Form and message details | Consent, given when you submit the form |
| Create and run your account and give you access to your workspace | Account details | Provision of a service you or your employer requested |
| Keep proprev secure and prevent fraud or misuse | Sign-in, security and technical data | Legitimate use |
| Provide support and service notices | Account details, support messages | Provision of the service |
| Meet legal obligations, and establish or defend legal claims | As needed | Compliance with law |
We do not sell personal data. You can withdraw consent at any time by writing to privacy@proprev.ai. Withdrawal does not affect processing already done.
Data our customers put into proprev
Our customers use proprev to manage their sales. That can include personal data about their leads and buyers (names, phone numbers, email addresses, the project and budget they enquired about, messages, call records, site visits, bookings, payments and documents), their channel partners and their own staff.
- We process this data only to provide proprev to that customer, as instructed by them.
- Each customer's data is kept in its own workspace, separated from every other customer's by controls enforced in the database itself.
- proprev records consent per channel (WhatsApp, SMS, email, calls) and checks it before any message is sent. A send that fails the check is refused and recorded. The customer remains responsible for obtaining valid consent.
- proprev includes tools that let customers handle data requests from their buyers: access, correction and erasure, with legally required records kept on hold where the law requires.
If we receive a request about data a customer controls, we will pass it to that customer and help them respond.
AI features
proprev includes optional AI features, for example drafting a reply, summarising a call or answering a question about the customer's own data. Every AI feature is switched off by default. A customer's administrator chooses which to turn on.
When a feature is on, the data needed for that task is sent to the AI model provider that powers it, solely to produce the result, and the use is logged. Outreach runs in Copilot mode by default, where a person approves messages. A customer can switch a campaign to Auto mode, in which case replies inside the messaging window may be sent without individual approval.
If you connect Facebook or Google ads
A customer's administrator can connect the customer's Meta (Facebook and Instagram) or Google Ads account to proprev. Nothing is connected unless they choose to, and they choose exactly which ad accounts, Facebook Pages and pixels proprev may use. For this data the customer is the Data Fiduciary and we act as their Data Processor.
What proprev reads and does in a connected account
| What | Why |
|---|---|
| The names and ids of the ad accounts, Pages and pixels the administrator chose | To show them in proprev and use the ones selected |
| Leads submitted through the customer's lead forms (the answers the person gave, such as name, phone number and email) | To put each enquiry into the customer's proprev workspace, linked to the campaign it came from |
| Campaigns, ads, spend and results in the chosen ad accounts | To show cost per lead and return on spend, and to create, start, pause or end campaigns when a user in the customer's workspace asks proprev to |
| Lead forms on the chosen Pages | To create the lead form for a campaign the customer builds in proprev, and to recover leads if a delivery was missed |
| Outcomes such as "qualified lead", "site visit" or "booking", sent back to the customer's own pixel | So the platform can show the customer's ads to people more likely to buy. We send the platform's own lead or click id, and the person's email and phone number only in hashed form and only where the person agreed to it |
What proprev does not do
- It does not read personal Facebook profiles, posts, friends or messages.
- It does not use one customer's data for another customer, and it does not sell or share this data with anyone else.
- It does not keep a copy of anyone's Facebook or Google password. Access is a token issued by the platform, stored encrypted, and limited to what the administrator approved.
How long we keep it, and how to remove it
Leads, campaigns and results brought into proprev become part of the customer's data and are kept as described in How long we keep data. The access token is deleted as soon as the customer disconnects. An administrator can remove proprev's access at any time in their Meta Business settings (Integrations) or Google account, or by writing to us. To ask for data to be deleted, see our data deletion instructions.
Processing outside India
Some of our service providers, including our authentication provider, may process personal data outside India. We transfer data only to countries the Government of India has not restricted under Section 16 of the DPDP Act, and we require providers to protect it to the standard this policy describes.
How long we keep data
- Demo and enquiry data: up to 24 months after our last contact, unless you become a customer or ask us to delete it sooner.
- Account data: for as long as the account is active, then for up to 90 days, except what we must keep for legal, tax or security reasons.
- Customer data: for the duration of the customer's agreement. After it ends, the customer can export their data for 30 days, after which we delete it from active systems, with backups expiring on their normal cycle.
- Security and audit records: for as long as needed to protect the service and meet legal obligations.
How we protect data
We use reasonable security safeguards appropriate to the data, including:
- Workspace isolation enforced by the database, so one customer's data cannot be read by another.
- Role- and project-scoped access, so each user sees only what their role allows.
- Session controls, lockout after repeated failed sign-ins, re-entry of the password before sensitive actions, and optional IP allow-lists.
- An audit log of significant actions, and records such as receipts and ledger entries that cannot be edited after they are issued.
- Encryption of data in transit.
No system is perfectly secure. If a personal data breach occurs, we will notify affected customers, the Data Protection Board of India and affected individuals as the DPDP Act requires.
Your rights
For personal data we control, you have the right to:
- Get a summary of the personal data we hold about you and how we process it.
- Have inaccurate or incomplete data corrected or updated.
- Have your data erased when it is no longer needed, unless the law requires us to keep it.
- Withdraw consent you have given.
- Nominate another person to exercise your rights in the event of your death or incapacity.
- Have grievances addressed by us, and then, if you are not satisfied, by the Data Protection Board of India.
To use any of these rights, write to privacy@proprev.ai. We may need to verify your identity, and will respond within the time the law allows.
Children
proprev is a business service and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as proprev or the law changes. We will post the new version here with a new "last updated" date, and tell customers by email or in the product about any significant change.
Grievance officer and contact
For questions, requests or complaints about personal data, contact our Grievance Officer:
We will acknowledge your grievance and respond within the period the DPDP Act prescribes.