BroaddCast CRM

Privacy Policy

Last updated: 3 November 2026

BroaddCast CRM (“the CRM”, “we”, “us”) is a sales CRM for real-estate teams, operated by BROADDCAST BUSINESS SOLUTIONS LLP. This policy explains what personal data the CRM processes, why, and the choices you have. It applies to the people who use the CRM (company staff) and to the prospective customers (“leads”) whose enquiries are recorded in it.

1. Who is responsible

Each business that uses the CRM (“a company”) decides which leads it records and how it contacts them; for that lead data the company is the data controller and we process it on its behalf. For the accounts of CRM users and for running the platform, BROADDCAST BUSINESS SOLUTIONS LLP is responsible. Contact: leads@broaddcast.com, 4th floor, 6-3-905, Saboo Towers, Rajbhavan Road, Somajiguda, Hyderabad, Telangana, 500082.

2. Data we process

CRM users

  • Name, e-mail address, role, optional profile photo and the company you belong to.
  • Your password, stored only as a one-way hash (bcrypt); we cannot read it.
  • Sign-in records (time, IP address, browser) and an audit log of changes you make, kept for security.

Leads (prospective customers)

  • Contact details: name, phone number, e-mail address.
  • Enquiry details: property or unit type of interest, budget, source of the enquiry, messages, notes, follow-ups, site visits and bookings.
  • Campaign information that arrives with an enquiry, such as the ad, campaign, form or page it came from.
  • Where a company uses these features: WhatsApp conversations (through Chat360), call logs and call recordings, and uploaded documents.
  • Where a company connects its social media pages: comments and direct messages that people send to those pages (with their public name or username and profile picture), and reviews left on the company’s Google Business Profile.

Company social media and advertising accounts

  • The pages, profiles and ad accounts a company connects, the posts it publishes through the CRM, and their performance (reach, likes, clicks).
  • Advertising figures for the company’s own campaigns: spend, impressions, clicks and leads per campaign.
  • Website visit statistics from the company’s own Google Analytics property.

3. Where lead data comes from

  • Entered by company staff or imported from a file.
  • Website forms and webhooks that a company connects with its own API key.
  • Google Sheets that a company shares with the CRM. When a company uses “Connect with Google”, we receive an access token for Google Sheets only (scope spreadsheets), used solely to read and write the sheets that company links.
  • Facebook and Instagram Lead Ads (Meta). When a company admin connects a Facebook Page, we receive a Page access token and, for each lead form submission on that Page, the answers the person entered in the form plus the ad, campaign and form it came from. We use this only to create the lead in that company’s CRM. We do not use Facebook data for advertising, do not sell it, and do not combine it with data from other companies.
  • Facebook Pages and Instagram business accounts (Meta), when a company admin connects them: comments and messages sent to those accounts, so the company’s team can read and answer them in the CRM, and the insights of the company’s own posts.
  • Google Ads lead forms, Google Business Profile (reviews and profile insights) and Google Analytics (visit statistics), only for the accounts a company connects with “Connect with Google”.
  • LinkedIn and Pinterest company pages and ad accounts, and LinkedIn Lead Gen Form submissions, only when a company connects them.
  • WhatsApp (Chat360) and telephony providers that a company connects, for messages and calls with its leads.

4. Why we use the data

  • To provide the CRM: store and organise leads, assign them to team members, schedule follow-ups and show reports.
  • To sign you in and keep accounts secure (session management, sign-in throttling, audit log).
  • To send notifications a company has switched on, such as follow-up reminders and a daily digest e-mail.
  • Optional AI features (summaries, rewriting, transcription) send the relevant text or audio to Google’s Gemini API to produce the result. They run only when a company has enabled them and a user asks for them.
  • To publish and schedule posts that the company’s team writes to the pages and profiles it connected, and to show how those posts perform.
  • To show a company the spend and results of its own advertising, and, where it allows, to pause campaigns or change their budgets on its instruction.
  • Measuring the company’s own ads (only when the company turns this on). When a lead reaches a stage the company chooses (for example “site visit done” or “booked”), the CRM tells the company’s own Meta, Google Ads or Google Analytics account that the conversion happened. Contact details sent for this are first converted to a one-way hash (SHA-256), so the advertising platform can only match them with people it already knows; the plain phone number or e-mail address is not sent.

We do not sell personal data. We never use one company’s data for another company or for our own advertising, and we do not build profiles across companies.

Google user data

When a company connects its Google account (“Connect with Google” in Settings), the CRM asks only for the access below and uses it only for these purposes, for that company:

  • Google Ads (adwords): uploads the company’s own lead results (qualified, site visit, booking) to its own conversion actions, with phone and e-mail hashed; reads its campaign cost to show cost per lead and booking; pauses a campaign or changes its daily budget only when the company’s administrator clicks that button.
  • Google Business Profile (business.manage): reads the company’s reviews into its inbox, posts the replies its team writes, and publishes the posts its team writes.
  • Google Analytics (analytics.readonly, read only): shows the company’s website visitors, channels and landing pages next to its CRM enquiries.
  • Google Sheets (spreadsheets): reads and writes only the sheets the company links for lead import and export.

BroaddCast CRM’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, not sold, not used to train AI models, and not read by people except with the company’s permission, for security, or where the law requires. The company can disconnect at any time in Settings › Connected accounts or in its Google Account (Security › Third-party connections); its Google access token is then no longer used.

5. Who we share it with

Only with the service providers needed to run the CRM, each bound to protect the data:

  • Vercel (application hosting) and MongoDB Atlas on AWS in Mumbai, India (database and file storage).
  • Meta, Google, LinkedIn, Pinterest, Chat360 and telephony providers, only when a company connects them, to exchange the data described above.
  • Google (Gemini API), only when AI features are used.
  • An e-mail provider, to deliver notification e-mails.

We may also disclose data when required by law.

6. How we protect it

  • Each company’s data is kept in its own separate database.
  • All connections use HTTPS. API keys, access tokens for Facebook, Instagram, Google, LinkedIn and Pinterest, and other secrets are stored encrypted (AES-256-GCM).
  • Sessions use secure, http-only cookies that expire after 12 hours of inactivity.
  • Access inside a company is limited by role (for example, a relationship manager sees only their own leads unless allowed otherwise).

7. How long we keep it

  • Lead and account data: for as long as the company uses the CRM, or until it is deleted.
  • Records of incoming form, webhook and Facebook submissions: 180 days.
  • Comments, messages and reviews received from connected pages: for as long as the company keeps them, and deleted with the company’s data.
  • When a company disconnects an account, its access token is deleted immediately and no further data is received from it.
  • When a company account is deleted, its entire database is deleted.

8. Cookies and local storage

We use one essential cookie to keep you signed in, and short-lived cookies during Google or Facebook connection to protect against forged requests. Your browser also stores display preferences (such as layout settings) locally. The CRM itself does not use advertising or tracking cookies.

9. Your rights

You can ask to access, correct or delete your personal data, or object to its use. If you are a lead, contact the business you enquired with, or write to us and we will pass your request to that business. See Data deletion for how to remove data, including data received from Facebook.

10. Children

The CRM is a business tool and is not intended for anyone under 18.

11. Changes

We may update this policy. The date at the top shows the latest version; significant changes will be announced in the CRM.

12. Contact

BROADDCAST BUSINESS SOLUTIONS LLP, 4th floor, 6-3-905, Saboo Towers, Rajbhavan Road, Somajiguda, Hyderabad, Telangana, 500082. E-mail: leads@broaddcast.com.