LeadOne

by OneConstruction

Privacy Policy

Effective date: 4 October 2026

This policy explains what LeadOne by OneConstruction ("LeadOne", "we", "us") collects, why, who else handles it, how long it is kept and what you can do about it. LeadOne is a sales CRM for real estate builders in India and the people who sell for them: owners, sales heads and sales representatives.

1. Who is responsible for what

  • Your account. For your own sign-in and profile details, OneConstruction is responsible for your data (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023).
  • Your organisation's business records. Leads, buyers, units, bookings and payments are entered by a builder's team and belong to that builder's organisation. For these records the builder is the Data Fiduciary and we process them on the builder's behalf and on its instructions (as a "Data Processor"). If you are a home buyer or enquirer whose details are in LeadOne, please contact the builder you dealt with first; we will help them answer you.

2. What we collect

Your account

  • Your name and your role (owner, sales head or sales representative).
  • Your mobile number, verified with a one-time code (OTP) sent by SMS. It is optional if you sign up with email.
  • Your email address and password, if you sign up with email. Passwords are stored only as a secure hash by our sign-in provider; we never see them.
  • A profile photo, if you add one.
  • Your organisation and the team members you invite (name, mobile number and role).

What you and your team enter

  • Leads and buyers: names, mobile numbers, email addresses, budgets, unit preferences, source, stage, notes, follow-ups, site visits, call outcomes and the history of changes.
  • Projects and inventory: company and project names, RERA numbers, locations, towers, units, unit types, prices and charges, amenities.
  • Bookings and payments: booked units, buyer names and numbers, agreement values, payments received, payment modes and dates, escrow bank details and construction milestones.
  • Files you upload: company and project logos, project brochures and profile photos.
  • Leads you import from a spreadsheet (CSV or Excel) or, if your organisation connects a Facebook or Instagram page, lead form answers sent by Meta (name, mobile number, email and the form's questions).

From your phone

  • Microphone and speech recognition, only while you dictate a lead or a to-do. Speech is turned into text by your phone's built-in speech service (Apple or Google), which may process the audio on its own servers under its own privacy terms. LeadOne keeps only the text.
  • Camera and photos, only when you choose to take or pick a photo (a visiting card, a logo, your profile photo).
  • Face ID, fingerprint or device PIN, only to confirm it is you when you punch in for attendance. The check happens on your phone; LeadOne never receives your biometric data. Attendance records are kept on your phone.
  • Notifications, to remind you of follow-ups and site visits. These reminders are scheduled on your phone.
  • Crash reports: when the app crashes we receive the error, the app version, the device model and operating system, and an anonymous user and organisation identifier. Before a report leaves your phone, phone numbers, email addresses, passwords, codes, tokens and web addresses are removed from it.

We do not collect your location, your contacts, your call logs or your SMS messages. Calls, SMS and WhatsApp messages you start from LeadOne open in your phone's own apps; LeadOne does not read or send them.

3. Why we use it

  • To run LeadOne for you and your team: sign-in, keeping your organisation's records, syncing them between phones, and showing each person what their role allows.
  • To work offline: a copy of your organisation's data is kept on your phone, encrypted (AES-256, with the key held in your phone's secure keychain), and synced when you are back online.
  • To send sign-in codes, reminders and invitations you ask for.
  • To provide the optional LeadOne AI features (section 4), only if you allow them.
  • To find and fix crashes, and to protect LeadOne against misuse (for example, limits on sign-in codes and AI requests).

We do not show ads. We do not sell, rent or share your data or your organisation's data for advertising or marketing, and we do not use it to profile buyers. There is no third-party advertising or analytics tracking in the app.

4. LeadOne AI (optional)

Some features use an AI service: reading a brochure to fill in a project's setup, reading a visiting card or a chat screenshot into a lead, tidying up imported leads, and answering questions in LeadOne AI. The AI service is Google's Gemini API, provided by Google.

  • Nothing is sent until you allow LeadOne AI. You can turn it off any time in Settings → Privacy → LeadOne AI, and nothing is sent while it is off.
  • Only what the feature needs is sent: the file or photo you choose, the lead details you are tidying up, or your question. Questions to LeadOne AI are sent with a summary of your pipeline that uses counts, stages and first names only; phone numbers, emails, notes and budgets are not included.
  • Requests go through our own server, which holds the AI keys and applies usage limits; your phone never talks to Google directly.
  • Under the terms we use the Gemini API on, Google does not use this data to train its models.
  • AI answers can be wrong. Check anything the AI fills in before you rely on it.

5. Who else handles your data

We share data only with service providers that run parts of LeadOne for us, only for that purpose:

  • Supabase hosts our database, file storage, sign-in and server functions.
  • SurePass delivers sign-in codes by SMS through Indian telecom networks (your mobile number and the code).
  • Google (Gemini API) for LeadOne AI, only if you allow it (section 4).
  • Sentry receives crash reports (section 2).
  • Meta, only if your organisation connects a Facebook or Instagram page: Meta sends that page's lead form answers to LeadOne.

Within your organisation, members can see its records in LeadOne, and what the app shows and lets each person do depends on their role. Only the owner can export all leads. Logos and brochures are stored so they can be shared by link, and anyone who has such a link can open the file.

We may disclose data if Indian law, a court or a government authority requires it, or to protect the safety of people or LeadOne.

Some providers may process data outside India. Where they do, we rely on their contractual commitments to protect it, and we follow any restrictions the Government of India notifies under the DPDP Act.

6. How long we keep it

  • Your organisation's records are kept while the organisation uses LeadOne, until a member with the right role deletes them or the organisation is deleted.
  • Your account details are kept until you delete your account.
  • Sign-in code logs and rate-limit counters are deleted after about two days; records of deleted items kept to sync phones are deleted after 90 days.
  • Copies in our hosting provider's backups are replaced in the normal backup cycle.

7. Deleting your account

You can delete your account in the app: Settings → Delete account. You confirm it, and for your security you may be asked to sign in again first.

  • If you are a sales head or sales representative: your profile, sign-in, memberships and LeadOne AI history are deleted, and this phone's saved data is cleared. Your team entry is marked as deactivated. Leads, units and payments you worked on stay with your organisation, because they belong to it.
  • If you are the owner: if anyone else is still active in your organisation, nothing is deleted until you make another member the owner or remove them. If you are the only active member, deleting your account also deletes your organisation and all of its data: projects, units, leads and their history, payments and team invites; connected Facebook and Instagram pages are disconnected. Export your leads first if you need them.
  • Uploaded files (logos, brochures, profile photos) are not yet removed automatically when an account is deleted. Write to us at support@oneconstruction.in and we will delete them.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

  • ask for a summary of the personal data we hold about you and who we have shared it with;
  • ask us to correct, complete, update or erase it;
  • withdraw consent you gave (for example, turn off LeadOne AI) at any time; this does not affect what was done before;
  • nominate another person to exercise your rights if you die or become unable to;
  • raise a grievance with us, and if you are not satisfied with our answer, complain to the Data Protection Board of India.

You can see and correct most of your data in the app. For anything else, write to us at support@oneconstruction.in. We may need to confirm who you are before acting. For records that belong to a builder's organisation, we will work with that builder to answer you.

9. Security

Data travels between the app and our servers encrypted (HTTPS). Each organisation's records are kept apart in the database by access rules, so one organisation cannot read another's. The copy on your phone is encrypted. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

10. Children

LeadOne is a business app for adults. It is not meant for anyone under 18, and we do not knowingly collect children's data.

11. Changes to this policy

We will update this policy when LeadOne or the law changes. The effective date above shows the latest version. If a change is significant, we will tell you in the app before it applies.

12. Contact and grievances

LeadOne by OneConstruction

Email: support@oneconstruction.in

Grievance Officer: Vedant Suryawanshi, support@oneconstruction.in

Registered address: B-205, 206, Megdhut Shopping Centre, CBS, Shalimar, Nashik, Maharashtra 422001, India

We reply to grievances within the time the law requires.