Privacy Policy

1. INTRODUCTION

This Privacy Policy explains how CrocLeads, operated by Hustle Ventures ("we", "us", "our"), collects, uses, stores, discloses, and protects personal information obtained through our website at crocleads.com ("Platform") and related services. By accessing or using the Platform, you consent to the practices described in this policy. If you do not agree, please do not use our services.

2. DEFINITIONS

"Personal Information" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, IP address, device identifiers, and financial information.

"Builder" means a registered user of the Platform who purchases leads through the service.

"Homeowner" means a person whose contact details and project information are captured as a lead through our network of content websites.

"Processing" means any operation performed on Personal Information, including collection, recording, storage, retrieval, use, disclosure, combination, erasure, or destruction.

3. INFORMATION WE COLLECT

3.1 From Builders (Registered Users): Company name, Australian Business Number (ABN), full name, email address, mobile phone number, password (stored in hashed form only), payment information (processed and stored by Stripe — we do not store credit card numbers), and service preferences including coverage areas, industry categories, and lead alert settings.

3.2 From Homeowners (Leads): Full name, email address, phone number, postcode, building project details (project type, scope, timeline), and estimated budget range. This information is collected through our network of content websites with clear and informed consent at the point of collection.

3.3 Automatically Collected Information: IP address, browser type and version, operating system, device type, screen resolution, pages visited, referral source, landing page URL, UTM campaign parameters (source, medium, campaign), session duration, and interaction timestamps.

3.4 Proof-of-Life Data: To verify lead authenticity and prevent fraud, we collect form load time, form submission time, form completion duration, Cloudflare Turnstile verification result, honeypot field status, and user agent string. This data is used solely for fraud prevention and dispute resolution.

4. LEGAL BASIS FOR PROCESSING

We process Personal Information on the following legal bases:

(a) Consent: Where you have given clear consent for us to process your Personal Information for a specific purpose, including when homeowners submit their details through our lead capture forms.

(b) Contractual Necessity: Where processing is necessary for the performance of a contract with you, such as when builders register for an account and purchase leads.

(c) Legitimate Interest: Where processing is necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, provided these interests are not overridden by your rights.

(d) Legal Obligation: Where processing is required to comply with applicable laws, regulations, or legal proceedings.

5. HOW WE USE INFORMATION

5.1 Builder Information: To create and manage accounts, process lead purchases and payments, send lead alerts via WhatsApp and email, communicate service updates and platform changes, provide customer support, and comply with tax and legal obligations.

5.2 Homeowner Information: To verify lead quality and authenticity, match leads with relevant builders based on location and project type, enable builders who purchase leads to contact homeowners about their building projects, and resolve disputes regarding lead quality.

5.3 Automatically Collected Information: To maintain platform security and prevent abuse, analyse usage patterns to improve the service, detect and prevent fraudulent activity, and generate anonymised and aggregated analytics.

6. DISCLOSURE OF INFORMATION

We may disclose Personal Information to the following categories of recipients:

(a) Builders: Homeowner lead information (name, contact details, project details) is shared only with builders who purchase the specific lead through the Platform. Shared leads may be disclosed to a maximum of three (3) builders. Exclusive leads are disclosed to one (1) builder only.

(b) Payment Processors: Stripe processes all payment transactions. We share only the minimum information required to process payments. Stripe's privacy policy governs their handling of your data.

(c) Messaging Services: We use third-party services for WhatsApp notifications and email communications. Only the information necessary for message delivery is shared.

(d) Infrastructure Providers: Our Platform is hosted on Cloudflare. Data processing by Cloudflare is governed by their privacy policy and data processing agreements.

(e) Legal and Regulatory: We may disclose information as required by applicable law, court order, subpoena, or government request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell, rent, lease, or trade Personal Information to third parties for their marketing purposes.

7. INTERNATIONAL DATA TRANSFERS

Our Platform is operated by Hustle Ventures from India. Our infrastructure is hosted on Cloudflare's global network, which means your data may be processed in jurisdictions outside your country of residence, including India, the United States, and other countries where Cloudflare operates data centres. By using the Platform, you consent to the transfer of your Personal Information to these jurisdictions. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

8. DATA STORAGE AND SECURITY

We implement appropriate technical and organisational measures to protect Personal Information against unauthorised access, alteration, disclosure, or destruction. These measures include:

(a) Encryption of data in transit (TLS/SSL) and at rest.

(b) Passwords stored using industry-standard one-way hashing algorithms. We cannot and do not store plaintext passwords.

(c) Access controls limiting data access to authorised personnel only.

(d) Cloudflare Turnstile for bot protection — no Google reCAPTCHA or third-party tracking involved.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security. You acknowledge and accept this inherent risk.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 Essential Cookies: We use strictly necessary cookies for session management, authentication, and security. These cookies are required for the Platform to function and cannot be disabled.

9.2 Analytics: We use Cloudflare Web Analytics, a privacy-preserving analytics service that does not use cookies, does not collect personal data, and does not track users across sites. No personally identifiable information is collected for analytics purposes.

9.3 No Third-Party Trackers: We do not use Google Analytics, Facebook Pixel, advertising trackers, retargeting pixels, or any other third-party tracking technology that collects personal data or tracks users across websites.

10. DATA RETENTION

We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

(a) Builder Account Data: Retained for the duration of the active account and for seven (7) years after account closure for tax, legal, and regulatory compliance purposes.

(b) Homeowner Lead Data: Retained for two (2) years from the date of capture. After this period, lead data is permanently deleted or irreversibly anonymised.

(c) Proof-of-Life Evidence: IP address, form timing, user agent, and verification status are retained for the dispute resolution period (typically twelve (12) months) and then permanently deleted.

(d) Transaction Records: Payment transaction records are retained for seven (7) years for tax and audit purposes as required by applicable law.

11. YOUR RIGHTS

Depending on your jurisdiction, you may have the following rights in relation to your Personal Information:

(a) Right of Access: You may request a copy of the Personal Information we hold about you.

(b) Right to Rectification: You may request correction of inaccurate or incomplete Personal Information.

(c) Right to Erasure: You may request deletion of your Personal Information, subject to our legal obligations and legitimate interests in retaining certain data (such as transaction records required for tax compliance).

(d) Right to Restrict Processing: You may request that we restrict the processing of your Personal Information in certain circumstances.

(e) Right to Data Portability: You may request a copy of your Personal Information in a structured, commonly used, and machine-readable format.

(f) Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within thirty (30) days. We may require verification of your identity before processing your request.

12. COMPLIANCE WITH APPLICABLE LAWS

We are committed to complying with applicable data protection laws in the jurisdictions where we operate, including but not limited to:

(a) India: The Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and any successor legislation including the Digital Personal Data Protection Act, 2023 (DPDPA), as applicable.

(b) Australia: The Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Australian users retain their rights under the APPs, including the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

13. CHILDREN'S PRIVACY

Our Platform is not intended for individuals under the age of eighteen (18). We do not knowingly collect Personal Information from children. If we become aware that we have inadvertently collected Personal Information from a child under 18, we will take immediate steps to delete such information. If you believe a child has provided us with Personal Information, please contact us at [email protected].

14. THIRD-PARTY LINKS

The Platform may contain links to third-party websites, services, or applications that are not operated or controlled by us. This Privacy Policy does not apply to such third-party services. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party services before providing your Personal Information.

15. DATA BREACH NOTIFICATION

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant regulatory authorities as required by applicable law. Notification will be made without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach.

16. CHANGES TO THIS POLICY

We reserve the right to update this Privacy Policy at any time. Material changes will be communicated to registered users via email. The updated policy will be posted on this page with a revised "Last Updated" date. Your continued use of the Platform after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

17. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in Bengaluru (Bangalore), Karnataka, India.

18. GRIEVANCE OFFICER

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the contact details of the Grievance Officer are:

Grievance Officer: Hustle Ventures — Privacy Team

Email: [email protected]

The Grievance Officer shall address your concerns and resolve any grievances in a time-bound manner, not exceeding thirty (30) days from the date of receipt of the grievance.

19. CONTACT US

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at [email protected].