Privacy Policy

How RealRevenue collects, uses, shares and protects personal information — including data obtained through the Meta (Facebook and Instagram) platform.

Effective: 3 August 2026
Last updated: 3 August 2026

Earlydays Innovations Private Limited ("RealRevenue", "we", "us") provides a lead capture and sales follow-up platform at https://realrevenue.app. This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices you have.

It applies to our website, our web application, and our integrations with third-party platforms including Meta's Facebook Lead Ads. By creating an account or connecting a lead source, you agree to the practices described here.

1. Two groups of people, two different roles

RealRevenue handles personal information about two distinct groups, and our responsibilities differ for each. Understanding which group you fall into tells you which parts of this policy apply to you.

Group	Who they are	Our role
Customers	The businesses and individuals who sign up for an account and use the platform.	We are the data controller. We decide how your account data is handled, and this policy governs it in full.
Leads	People who submit a Facebook or Instagram lead form, a web form, or are otherwise added to a customer's account.	We are a data processor acting on the customer's instructions. The customer is the controller and is responsible for the lawful basis and the notice given at the point of collection.

If you submitted a form to a business and want your details removed, contact that business directly — they control the record. If you cannot reach them, email support@realrevenue.in and we will route the request to the correct account within 5 business days.

2. Information we collect

Account and profile information you give us:

Name and email address.
A hashed password (we never store passwords in readable form), or, if you sign in with Google, the identifier your provider returns.
Two-factor authentication settings, including an encrypted TOTP secret and hashed backup codes when you enable 2FA.
Profile picture URL, if you set one.
Team membership — which workspace you belong to and who invited you.

Information collected automatically as you use the service:

Session records containing your IP address, browser user agent, and sign-in and last-used timestamps — used to keep you signed in, show you your active sessions, and detect account abuse.
Server request logs recording the time, HTTP method, path, status code, response time and IP address. Sensitive query values such as OAuth codes and access tokens are redacted before anything is written.
Failed sign-in counts and lockout timestamps, used for brute-force protection.

Lead data you bring into the platform:

The answers a person submitted to a lead form — typically full name, email address and phone number, plus any custom questions the form asked, stored in the order the form presented them.
The unaltered payload we received from the source platform, retained so a failed import can be reprocessed without asking the person to submit again.
Attribution metadata: page, form, ad, ad set and campaign identifiers, the platform the lead came from (Facebook or Instagram), and whether the lead was organic or paid.
Sales pipeline data your team adds: stage, notes, contact timestamps and activity history.

Content you upload:

Files you add to your content library (brochures, price lists, images) together with their filename, MIME type and size, so you can attach them to follow-up messages.
Message templates you write.

3. Data we receive from Meta (Facebook and Instagram)

When you connect a Facebook account, you are redirected to Meta to approve a specific set of permissions. We request only what the product needs to function, and we use the resulting data solely to deliver the features described below. We never sell it, never use it for advertising or profiling, and never transfer it to a data broker.

Permission requested	What it gives us	Why we need it
public_profile, email	Your Facebook name, ID and email address.	To identify the connected account and show you which Facebook user the integration is running as.
pages_show_list	The list of Pages you manage.	To let you pick which Pages should send leads into your account.
pages_read_engagement	Basic Page metadata: name, category, follower count and picture.	To display recognisable Pages in the picker rather than raw numeric IDs.
pages_manage_ads	Permission to subscribe our app to a Page's leadgen webhook.	This is the switch that turns on real-time lead delivery for a Page.
leads_retrieval	The content of leads submitted through your lead forms — the answers the person gave, plus the ad, ad set and campaign identifiers attached to their submission.	The webhook notification contains only identifiers; this permission lets us fetch the actual answers so they appear in your inbox, and tells you which campaign produced each lead.

That is the complete list. We do not request access to your ad accounts, your campaign or spend data, or your Business Manager, and we cannot create, edit or pause ads. The campaign attribution shown on each lead comes from the lead's own submission, not from reading your advertising account.

Access tokens issued by Meta are encrypted at rest with AES-256-GCM before they are written to our database and are decrypted only in memory at the moment an API call is made. Every server-to-server call to Meta is additionally signed with an app secret proof, so a token alone is not usable from anywhere else.

You can revoke our access at any time — from within RealRevenue under Settings → Integrations → Disconnect, or from Facebook under Settings & Privacy → Settings → Business Integrations. Disconnecting removes the stored tokens and unsubscribes our app from your Pages, so no further leads are delivered. Leads already in your account are not deleted by disconnecting; see the deletion section below.

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including the Limited Use requirements.

4. How we use information

To provide the service — receiving leads, showing them in your inbox, sending follow-up messages you compose or schedule, and reporting on results.
To authenticate you, keep your session alive, and enforce two-factor authentication where you have enabled it.
To protect the service — rate limiting, brute-force lockouts, signature verification on inbound webhooks, and investigating abuse.
To support you — responding to your emails and diagnosing problems you report, which may involve looking at a specific failed delivery in your account.
To improve the product — aggregate, non-identifying usage measurement such as how many deliveries succeeded across the platform.
To meet legal obligations — tax records, and responding to lawful requests from authorities.

We do not sell personal information. We do not use lead data to train machine learning models. We do not use lead data for our own marketing, and we do not build cross-customer profiles.

5. Legal bases (EEA and UK users)

Performance of a contract — providing the service you signed up for.
Legitimate interests — securing the platform, preventing fraud and abuse, and improving the product, balanced against your rights.
Consent — where you opt in, for example by approving the Facebook permission dialog or subscribing to product emails. You may withdraw consent at any time.
Legal obligation — retaining records we are required by law to keep.

7. How long we keep information

Data	Retention
Account and profile	For as long as your account is open, then deleted within 30 days of account closure.
Leads and their activity history	For as long as you keep them. You can delete an individual lead at any time; all of a workspace's leads are deleted when the account is closed.
Webhook delivery records (raw payloads)	Retained so failed deliveries can be replayed without data loss. Deleted with the account.
Sessions	Until expiry, revocation, or you sign out — whichever comes first.
Server request logs	Rotated on a short cycle and not used to build user profiles.
Uploaded content files	Until you delete them or close the account.
Records we must keep by law	For the period the applicable law requires, after which they are deleted.

TODO: replace the log rotation period and any billing-record retention period with your actual figures before publishing.

8. How we protect information

All traffic to and from the platform is encrypted in transit with TLS.
Passwords are stored as bcrypt hashes. Refresh tokens are stored only as SHA-256 hashes, so a database copy cannot be replayed as a session.
Third-party access tokens and TOTP secrets are encrypted at rest with AES-256-GCM using a key held outside the database.
Inbound webhooks are rejected unless they carry a valid HMAC-SHA256 signature computed with our app secret, so a third party cannot inject fake leads into your account.
Access to production systems is limited to staff who need it, and sensitive values are redacted from logs.
Two-factor authentication is available to every account, and enforced organisation-wide on higher plans.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it.

9. Your rights

Depending on where you live, you may have some or all of the following rights over your personal information:

Access — obtain a copy of the personal information we hold about you.
Rectification — correct information that is inaccurate or incomplete.
Erasure — ask us to delete your personal information.
Restriction and objection — limit or object to certain processing, including processing based on legitimate interests.
Portability — receive your information in a structured, machine-readable format.
Withdraw consent — at any time, without affecting processing already carried out.
Complain — lodge a complaint with your local data protection authority.

To exercise any of these, email support@realrevenue.in from the address on your account. We respond within 30 days. We do not charge for these requests and we will not discriminate against you for making one.

10. Deleting your data

Deletion is self-service and needs no approval from us. Full step-by-step instructions, plus a lookup for any request already in flight, are at https://realrevenue.app/data-deletion — that page is our data deletion instructions page for the purposes of the Meta Platform Terms. In summary:

Remove the app in Facebook (Settings & Privacy → Settings → Apps and Websites → RealRevenue → Remove). Facebook notifies us automatically and deletion begins without you contacting us.
Sign in and use Settings → Privacy, which offers "Delete Facebook data" and "Delete my account".
Delete individual records at any time: a lead from its detail page, a file from Content, a session from Settings → Security. These are immediate and have no grace period.
Or email support@realrevenue.in if you cannot sign in, and we will handle it by hand.

Whichever route you take, your Facebook access tokens are deleted and our app is unsubscribed from your Pages immediately, so no further data can reach us. The data already collected is then permanently erased after a 30-day grace period, which exists so you can export your records or cancel a request made by mistake. You receive a confirmation code and an email at each stage.

After erasure, encrypted backups are purged on their normal rotation cycle, after which no copy remains. We keep the deletion request record itself — its code, status and dates — so you can still look it up; it contains no lead data.

If you are a lead rather than a customer — you filled in a form and want your details removed — email support@realrevenue.in with the phone number or email address you submitted. We will identify the controlling account and pass the request to them, and confirm back to you once actioned.

11. Cookies and similar technologies

We use the minimum set of cookies needed to run the product. We do not use advertising or cross-site tracking cookies.

Authentication cookies — HTTP-only, Secure, SameSite-restricted cookies that keep you signed in and let us rotate refresh tokens safely. Blocking these makes it impossible to sign in.
A short-lived, signed state cookie used during OAuth flows to prevent cross-site request forgery.
A browser localStorage entry recording your light/dark theme preference. This never leaves your device.

12. International transfers

We and our service providers may process personal information in countries other than your own. Where information is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with technical measures including encryption in transit and at rest.

13. Children

The service is a business tool and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, email us and we will delete it.

14. Changes to this policy

We may update this policy as the product changes or the law requires. The effective date at the top always reflects the current version. For material changes we will notify account holders by email or with an in-app notice at least 14 days before the change takes effect.

15. Contact us

Questions, requests or complaints about privacy go to support@realrevenue.in. You can also write to us at Earlydays Innovations Private Limited, 19th Floor, Ethearea, Bhutani Alphathum Tower B, Sector 90, Noida 201304.