Effective 24 October 2026
Privacy Policy
How Flare Reply handles the data of businesses that use it, the leads they receive and the information we get from Meta.
1. Who we are and what this covers
Flare Reply (the “Service”) is a customer relationship management tool operated by Flare Reply (“we”, “us”). Businesses and agencies (“Customers”) use it to receive leads from Facebook and Instagram Lead Ads, follow up by WhatsApp, track each lead through a sales pipeline and report lead quality back to Meta.
This policy explains what personal data we handle, why, for how long and what choices you have. It applies to two groups of people:
- Customers and their team members who sign in to the Service. For their account data we decide how it is used (we are the data controller, or “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023).
- People who submit a Lead Ad form or message a Customer on WhatsApp (“Leads”). Their data belongs to the Customer that ran the ad. We process it only on that Customer’s instructions (we are a data processor). The Customer is responsible for telling Leads how it uses their data, and its own privacy policy applies too.
In short: we use data only to run the Service for the business you dealt with. We never sell personal data, never use it to advertise to you and never use Meta data for anything other than the features described here.
2. Data we collect
Account data. Name, email address, password (stored as a one-way hash by our authentication provider), workspace and agency names, team roles and invitations, and the settings you choose. If you sign in with Google, Google shares your name, email address and profile photo with us; we never see your Google password.
Lead data a Customer receives or enters. Name, phone number, email address, answers to Lead Ad form questions, the campaign, ad set, ad and form the lead came from, notes, pipeline stage and stage history, AI score, assignments and WhatsApp conversation history.
Data from Meta. When a Customer connects Facebook, we receive only what the permissions they approve allow:
| Permission | What we receive | Why |
|---|---|---|
| pages_show_list | The list of Pages the person manages (IDs and names) | So they can choose which Pages feed which workspace |
| pages_manage_metadata | Ability to subscribe a Page to lead notifications | So new leads reach the CRM within seconds |
| pages_read_engagement | Basic Page details | Required by Meta to read leads for the Page |
| leads_retrieval | Lead Ad submissions: form answers, lead ID, form, ad and campaign IDs, submission time | To create and update the lead in the CRM |
| pages_manage_ads | The Page’s lead forms | To list forms and recover leads a notification missed |
| ads_read | Campaign, ad set and ad names and daily spend for the chosen ad account | To show cost per lead and cost per quality lead |
| business_management | Datasets (pixels) in the business | So the Customer can pick where quality events are sent |
Meta access tokens are stored encrypted (AES-256-GCM) and are never shown again in the app. If a Customer connects WhatsApp, we receive messages Leads send to the Customer’s WhatsApp Business number and the delivery status of messages the Customer sends.
Google Sheets. If a Customer turns on sync, we read and write lead rows in the spreadsheet they share with our service account. We get no access to anything else in their Google account.
Billing data. Our payment provider Razorpay collects card, UPI or bank details. We receive only the subscription status, plan and billing period, never full card numbers.
Technical data. IP address, browser type and request logs kept by our hosting provider for security and troubleshooting, and the essential cookies described in our Cookie Policy.
Deletion requests. When you use our data deletion page we keep the email address or phone number you give and the request’s status, so we can confirm it and show you the outcome.
3. How we use data
- To provide the Service: capture leads, remove duplicates, show them in the pipeline, send WhatsApp replies the Customer configured, sync the Customer’s Google Sheet and run the Customer’s automations.
- To report lead quality to Meta when the Customer moves a lead to a stage they chose to share (for example “Qualified”), so Meta can show the Customer’s ads to people more likely to become customers. See section 4.
- To score leads hot, warm or cold with AI, so the Customer can reply to the best ones first. See section 5.
- To send the alerts and emails a Customer asks for (new lead, failed event, sign-in links, invitations).
- To keep the Service secure, prevent abuse, fix problems and keep an audit log of changes to settings and access.
- To bill Customers and meet legal, tax and accounting obligations.
Legal basis. For Customer accounts: performing our contract with the Customer, our legitimate interest in running a secure service, and legal obligations. For Leads: the Customer’s instructions, relying on the lawful basis the Customer has (usually the consent the Lead gave on the Customer’s Lead Ad form).
We do not sell or rent personal data, we do not use it for our own advertising, and we do not build profiles of Leads across Customers. A Lead’s data is visible only inside the workspace of the Customer that received it.
4. Data we receive from Meta and send to Meta
We use data received through Meta’s platforms only to provide the features a Customer turned on, and in line with Meta’s Platform Terms and Developer Policies. We do not sell it, use it to build advertising profiles, share it with data brokers or use it for anything unrelated to the Customer’s own leads.
Conversions API for CRM. When a lead from a Facebook or Instagram Lead Ad reaches a stage the Customer marked “send to Meta”, we send Meta an event containing: the stage name, the time of the change, the Meta lead ID, the name of this CRM, and the lead’s email address and phone number hashed with SHA-256 (Meta receives the hash, not the readable value). Meta uses it to measure and optimise that Customer’s ads. Leads entered by hand, from WhatsApp or from a sheet are never sent.
WhatsApp. Messages are sent through the WhatsApp Business Platform from the Customer’s own WhatsApp Business account, using templates the Customer had approved by Meta, and free-form replies only within 24 hours of the Lead’s last message, as WhatsApp requires.
When a Customer disconnects a Page or removes the app from their Facebook business settings, we stop receiving data for it and delete the stored access token. Leads already received stay in the Customer’s CRM until the Customer deletes them or their retention period ends.
5. AI lead scoring
If a Customer enables it, a lead’s form answers and the Customer’s business description are sent to Anthropic’s Claude API to produce a score and a one-line reason. Anthropic processes this data to return the result and, under its commercial terms, does not use it to train its models. No decision with legal or similarly significant effect is made automatically: the score only helps the Customer’s team prioritise, and they can change it at any time.
7. Where data is processed
We host the application in India and use providers that may process data in other countries (see Subprocessors). Where data leaves India or the European Economic Area, we rely on our providers’ contractual safeguards, such as the European Commission’s Standard Contractual Clauses, and we transfer data only to countries not restricted under applicable law.
8. How long we keep data
| Data | How long |
|---|---|
| Leads and their history | Until the Customer deletes them, or automatically once they are older than the retention period the Customer sets (30 days to 2 years) |
| Customer account and workspace data | While the account is active; deleted within 30 days after the account or workspace is deleted, except where we must keep billing records |
| Meta access tokens | Until the Page or connection is removed; temporary sign-in tokens expire after one hour |
| Conversions API events | Kept with the lead for delivery diagnostics, deleted with it |
| Audit log | While the account is active, so Customers can see who changed what |
| Billing records | As long as tax and accounting law requires (generally 8 years in India) |
| Server logs | Up to 30 days, on our hosting provider’s schedule |
| Deletion requests | The request and its outcome, so the confirmation code keeps working |
9. How we protect data
Data is encrypted in transit (HTTPS) and at rest by our database provider. Access tokens are additionally encrypted by us. Every workspace’s data is separated in the database itself, so one Customer can never read another’s. Webhooks from Meta and Razorpay are verified by signature, one-time codes are stored only as hashes, and we monitor event delivery and data separation daily. More detail is on our Security page.
No system is perfectly secure. If a breach affects your personal data, we will notify the affected Customer and, where the law requires, you and the relevant authority without undue delay.
10. Your rights
Depending on where you live (including under India’s DPDP Act, 2023, the EU and UK GDPR and US state privacy laws), you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate or incomplete data;
- have your data deleted (see the next section);
- withdraw consent where processing relies on it, without affecting earlier processing;
- object to or restrict certain processing;
- nominate someone to exercise your rights if you die or become unable to (India);
- complain to a data protection authority, such as the Data Protection Board of India.
If you are a Lead, the Customer that ran the ad controls your data, so it is usually fastest to contact them. You can also contact us at the email address shown in your account or use the data deletion page and we will pass on or carry out your request. We answer within 30 days and may need to verify your identity first.
11. How to have your data deleted
- If you submitted a Lead Ad or messaged a business on WhatsApp: go to our data deletion page, enter the email address or phone number you used and submit. For an email address we first send a confirmation link to prove it is yours. The business that received your details is notified and your data is deleted from the CRM within 30 days. You get a confirmation code to check the status at any time.
- If you signed in with Facebook to connect a Page: remove the app in Facebook under Settings & privacy → Settings → Business integrations (or Apps and websites). Meta notifies us automatically and we delete the data tied to your Facebook account (the access tokens your login created), then give Meta a confirmation code and a status link. The businesses whose Pages you connected are asked to reconnect; the leads they already received stay in their CRM.
- If you are a Customer: delete individual leads in the CRM, set a retention period, or delete a whole workspace under Settings → Privacy and data. To close your account entirely, email us.
- By email: write to the email address shown in your account from the address concerned, or include the phone number concerned.
12. Children
The Service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child’s data has reached us, contact us and we will delete it.
14. Changes to this policy
We will update this page when our practices change and change the effective date above. If a change is significant, we will tell Customers by email or in the app before it takes effect.
15. Contact and Grievance Officer
Questions, requests or complaints about privacy: the email address shown in your account.
Grievance Officer. We acknowledge grievances within 24 hours and resolve them within 15 days, as India’s IT Rules, 2021 require.