Privacy policy

Last updated 17 October 2026.

This explains what FoxLead collects, why, who else sees it, and how to ask us about it. FoxLead is operated by Sharp Enterprises, a proprietorship registered in Maharashtra, India.

1. Two kinds of people in this policy

The distinction runs through everything below, so it comes first.

• Brokers — the businesses that sign up for FoxLead and their staff. We hold their account and their business records because they asked us to.
• Customers — the people who enquire with a broker about a property. We hold their details on behalf of that broker. The broker decides what to collect and how long to keep it; we store and process it for them.

If you are a customer and want your details changed or removed, the broker you spoke to is the right first contact, because it is their record. You may also contact us at the address at the end of this page and we will help.

2. What we collect

From brokers

• Name, email address, mobile number, and the business name and address.
• A password, stored only as a salted one-way hash. We cannot read it, and nobody at Sharp Enterprises can tell you what it is.
• If two-factor authentication is switched on, the secret that generates the codes, encrypted at rest.
• Subscription and payment records, described in section 4.
• Sign-in times and the IP address a sign-in came from, to detect misuse.

From customers, on a broker's behalf

• Name, phone number, and email address where given.
• What they are looking for — budget, area, size, and any notes the broker records.
• WhatsApp messages between the customer and the broker's business number, including replies sent automatically on the broker's behalf.
• Site visits booked, and what came of them.
• The language they prefer, so replies are in it.

What we do not collect

• Card or bank details. Payments are handled entirely by Razorpay. Card numbers never reach FoxLead's servers.
• Anything from a customer's phone. We see WhatsApp messages sent to the broker's business number and nothing else — not contacts, not location, not other chats.
• Children's data, knowingly. FoxLead is a tool for businesses and is not directed at children.

3. Why we hold it

• To provide the service a broker has subscribed to.
• To reply to customers on WhatsApp on a broker's behalf, and to remind them about viewings they agreed to.
• To take payment for subscriptions, and to meet tax and accounting obligations.
• To keep accounts secure, and to investigate misuse.

We do not sell personal data. We do not share it with advertisers. We do not use one broker's data to serve another broker.

4. Who else processes it

FoxLead cannot work without a few other companies. Each sees only what its job requires.

We may also share data where the law requires it, or to establish or defend a legal claim.

5. Where it is stored, and how it is protected

• Data is encrypted in transit. The whole service is served over HTTPS.
• Credentials we hold for a broker's WhatsApp account are encrypted at rest with authenticated encryption, and decrypted only for the moment a message is sent.
• Passwords are stored as salted one-way hashes using PBKDF2-HMAC-SHA512, at an iteration count meeting current OWASP guidance.
• Each broker's workspace is isolated. The isolation is enforced in several independent layers, and is tested continuously rather than assumed.
• Diagnostic logs are redacted: they record that a message to a number ending 4321 failed, not what the message said.

No service can promise that a breach is impossible. If one happens and affects personal data, we will tell the people affected and the authorities as the law requires.

6. How long we keep it

• While a broker's account is open, their records and their customers' records are kept, because that is the service.
• After an account closes, we delete or irreversibly anonymise the data within 90 days, except where we must keep it longer.
• Invoices and payment records are kept for as long as Indian tax law requires.
• A customer's records belong to the broker. If a customer asks a broker to delete their details, the broker can do so, and we act on instructions from the broker.

7. Your rights

Subject to Indian law, including the Digital Personal Data Protection Act, 2023, you may ask us to:

• tell you what personal data we hold about you and who it has been shared with;
• correct anything inaccurate or incomplete;
• erase data where we no longer have a reason to keep it;
• nominate someone to exercise these rights if you cannot; and
• complain, to us first and to the Data Protection Board if we do not resolve it.

We will respond within 30 days. If you are a customer rather than a broker, we may need to pass the request to the broker whose record it is, and we will tell you when we do.

8. Consent on WhatsApp

A customer who messages a broker's business number is starting the conversation, and we record that as the basis for replying. WhatsApp separately restricts when a business may message someone who has not written first: outside a 24-hour window, only a message template that Meta has reviewed may be sent. We honour that restriction rather than working around it.

A customer can stop the messages at any time by saying so in the conversation, or by blocking the number in WhatsApp.

9. Grievance officer

10. Changes

If this policy changes materially, we will say so on this page and date it, and tell brokers by email before the change takes effect.