What we hold, and why

Who operates Hottabl

Hottabl is a product of Loyvia Noowallet LLP, a limited liability partnership registered in India (LLPIN ACM-2803). In this notice, “we” and “us” mean that entity, and it is the data controller for the information described below that we hold in our own right.

Registered office: 68/1520, 5th Floor, C M Mathew Brothers Arcade, Chakkorathukulam, Nadakavu, Kozhikode – 673011, Kerala, India.
Written enquiries and any request under “Your rights” below: support@hottabl.com.

Who this is about

Hottabl provides a lead-management system to businesses. That gives us two very different relationships with two groups of people, and this notice covers both.

• Our customers — the businesses who use Hottabl, and the staff they invite into it. We decide what we collect about them, so for this group we are the data controller.
• Their leads — the members of the public who filled in one of our customer’s ad forms. We hold that information on our customer’s instructions and do nothing with it of our own accord, so here we are a processor and our customer is the controller. If you are a lead and you want your details removed, the business you contacted is the right first stop; we will also act on a request sent to us, and pass it to them.

What we collect

From people who write to us through this site

Your name, email address, company, an optional phone number, and whatever you type into the message box. It goes to our inbox so we can reply. It is not added to a marketing list, because we do not run one.

From our customers’ staff

A name, an email address, a role, and a branch if the workspace uses them. This is what signing in requires and what tells the system which leads that person is allowed to see.

From Meta, when a customer connects an ad account

A customer’s administrator grants us access using their own Facebook login. We never receive or ask for their password. What Meta then sends us is:

• the contents of lead form submissions — typically a name, phone number, email address, and whatever else that customer chose to ask for;
• which campaign, ad set and form the lead came from, so the customer can tell what their advertising produced;
• the list of ad accounts and Pages that administrator can reach, so they can choose which ones to connect;
• an access token, which we store encrypted and use only to fetch the above.

We request the narrowest set of permissions that makes this work, and if a permission we need is not granted we tell the customer rather than working around it. The grant is made by the customer’s business portfolio, so it can be withdrawn either from that portfolio’s connected-app settings or from within Hottabl, and it stops immediately.

From WhatsApp, where a customer uses it

Messages exchanged between the customer’s business number and a lead, so the conversation is filed against the right record. We do not read these for any purpose of our own.

From using the product

A record of significant actions inside a workspace — who changed a lead’s status, who reassigned it — because a shared pipeline that cannot answer “who did this” causes more arguments than it settles. Plus ordinary server logs, kept short, for security and diagnosing faults.

What we do not do

• We do not sell personal information, and we do not share it with advertisers or data brokers.
• We do not use one customer’s data to benefit another, and we do not aggregate across workspaces.
• We do not use anyone’s leads or messages to train machine-learning models.
• We do not run advertising or tracking cookies on this website. No analytics script loads here, which is why there is no cookie banner — there is nothing to consent to.

Why we are allowed to hold it

For our customers, because we have a contract with them and holding it is how we perform it. For leads, because our customer has a lawful basis for collecting the enquiry and has instructed us to hold it on their behalf. Where consent is the basis, it is the consent that person gave on the ad form when they submitted it, and it can be withdrawn.

Where it lives

Application data is held in a managed PostgreSQL database operated by Supabase, and the application runs on Vercel. Transactional email is sent through Resend. These providers process data on our instructions under their own contractual commitments. Data may be processed outside your country; where that happens we rely on our providers’ standard contractual clauses.

How workspaces are kept apart

Every workspace has its own address and its own sign-in session, and being signed in to one does not sign you in to another. Separation is enforced in the database on every read rather than by the interface choosing what to display, so a request for another workspace’s data returns nothing regardless of how it is made. The same mechanism enforces roles: a sales executive’s search does not match a colleague’s leads because those rows are not readable to them, not because they were filtered out afterwards.

Access tokens and other integration secrets are encrypted before storage, and are not readable by anyone signed in to a workspace.

How long we keep it

• Leads and workspace data — for as long as the customer keeps their workspace, because deciding when a lead stops being useful is theirs to make, not ours. On request, or when an account closes, see Deleting your data.
• Enquiries through this site — up to two years, then deleted.
• Server logs — a short rolling window, then discarded.
• Billing records — as long as tax law requires us to keep them, which is longer than we would otherwise choose.

Your rights

Depending on where you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable form. Write to support@hottabl.com and we will answer within 30 days. We will not charge you for it and we will not make you justify the request.

If you are a lead rather than a customer, the business you enquired with decides what happens to your record. Tell us anyway and we will forward it to them and act on it ourselves where we are able.

Children

Hottabl is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe we have, tell us and we will remove it.

Changes

If we change this notice in a way that matters, we will tell our customers directly rather than relying on them noticing a new date at the top of a page.

Contact

support@hottabl.com, or through the contact form. A real person reads both.