Privacy Policy

SOU Tours operates SOU Leads, a customer relationship management application used by authorised SOU Tours staff to receive and follow up tour enquiries. The service is hosted at https://leads.soutours.in.

This policy covers CRM staff accounts, Facebook Login for Business used to connect Pages, and personal data submitted through Facebook Lead Ads (Instant Forms) on those Pages.

Depending on how you interact with us, we may collect:

• CRM account data: name, work email address, role (for example administrator or sales), and a password hash managed by our authentication provider. Accounts are invite-only. There is no public self-registration.
• Tour enquiry / lead data: name, phone number, email address, city, travel dates, group size, package preferences, notes, call history, and other details staff record while following up an enquiry.
• Facebook connection data: described in Section 3.
• Facebook Lead Ads data: described in Section 4.
• Technical and security logs: timestamps, webhook receipt status, import or retry status, and limited diagnostic information needed to operate the service. We do not use these logs to build advertising profiles.

We do not collect Facebook friends lists, Messenger conversations, Instagram content, Ads Manager spend, or payment card details through Meta.

Authorised CRM users may connect Facebook using Facebook Login for Business. This is not a public “Sign in with Facebook” for travellers. It exists so staff can attach a Facebook Page they administer to SOU Leads.

When a user connects Facebook, we may receive and store:

• Facebook user identifier and display name
• A user access token, token expiry, and the permissions granted
• The list of Facebook Pages the user is permitted to manage
• For a Page the user selects: Page id, Page name, category, Page access token, and whether lead-form webhooks are subscribed

Permissions are limited to what the CRM needs to list Pages, subscribe a Page to lead-form notifications, and retrieve Lead Ad submissions (including companion permissions required by Meta for that workflow). Access tokens are stored on the server only. They are not sent to the browser or to other Facebook apps.

You can disconnect Facebook inside the CRM (Settings → Integrations → Facebook) or remove the app from Facebook under Settings → Apps and websites. Either action stops new Graph API calls on your behalf once tokens are revoked or deleted on our side.

When someone submits a Facebook Lead Ad (Instant Form) on a Page connected to SOU Leads, Meta sends our server a notification. We then retrieve the form answers from Meta’s Graph API so our sales team can contact the person about the tour they requested.

That data typically includes:

• Name, phone number, and email address provided on the form
• Answers to custom questions on the Instant Form (for example city, travel dates, or number of travellers)
• Meta lead identifier, form name or id, and related ad or campaign names where Meta provides them
• The Facebook Page the form belongs to, and the time of submission

We create a CRM lead from that submission so staff can call or message the person about the enquiry. We do not sell Lead Ads data. We do not use Meta Platform Data to build a surveillance dossier or an independent social graph of people who are not making a tour enquiry.

We use personal data to:

• Operate SOU Leads for SOU Tours staff
• Import Facebook Lead Ads enquiries into the CRM and assign them for follow-up
• Keep the Facebook connection working (for example refreshing Page tokens and receiving leadgen webhooks)
• Record calls, notes, quotations, and reminders related to an enquiry
• Secure the service, diagnose faults, and prevent abuse
• Respond to privacy, deletion, or support requests

We process this data because it is needed to provide the CRM and to follow up a tour request the person submitted, and because we have a legitimate interest in running a secure sales operation. Where a law requires consent, we rely on the consent given on the Facebook Instant Form and on staff account terms.

Application data is stored in a Supabase project (PostgreSQL database with row-level security). The application itself is hosted on Hostinger. Facebook access tokens, Page tokens, and webhook payloads are written to that database on the server. Staff access the CRM over HTTPS after signing in.

Supabase and Hostinger act as processors: they host infrastructure we configure. They are not authorised to use SOU Tours lead data for their own marketing.

We share personal data only with:

• SOU Tours staff who need it to follow up an enquiry or administer the CRM
• Hostinger, which hosts the application
• Supabase, which stores the database
• Meta Platforms, when staff use Facebook Login or when we retrieve a Lead Ad submission the person already sent to Meta

We do not sell personal data. We do not share Facebook access tokens with third-party marketing tools. If we are required by law to disclose data, we will do so only to the extent required.

We take reasonable technical and organisational measures, including:

• HTTPS for the CRM and public pages
• Staff sign-in required for CRM features; accounts are issued by administrators
• Database access controlled with row-level security; server jobs that import leads use a privileged server key that is not exposed to the browser
• Facebook access tokens stored server-side only
• Meta webhook requests verified with the X-Hub-Signature-256 HMAC before we accept them
• OAuth state protected with an httpOnly cookie to reduce cross-site request forgery during Facebook Login

No method of transmission or storage is perfectly secure. If we become aware of a breach that legally requires notice, we will notify affected people and regulators as required.

SOU Leads uses cookies and similar technologies that are needed to run the service:

• Authentication session cookies so a signed-in staff member stays logged in (provided through our Supabase auth integration)
• A short-lived httpOnly cookie used only during Facebook Login to confirm that the OAuth callback matches the request we started
• Cookies required by the hosting platform to deliver the site securely

We do not place advertising cookies, Facebook Pixel tracking, or third-party analytics cookies on these legal pages. Public visitors can read this policy without creating an account. If you block essential cookies, staff sign-in and Facebook connection may not work.

We keep CRM leads while we may need to fulfil or follow up a tour enquiry, and thereafter as needed for our records, disputes, or applicable law. Facebook access tokens are removed when you disconnect Facebook, when a token expires and is no longer usable, or when we complete a deletion request. Webhook and import logs are kept only as long as needed for operations and security.

Subject to applicable law (including India’s Digital Personal Data Protection Act, 2023, and other laws that may apply to you), you may request to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete personal data we hold about you (see Section 12)
• Withdraw consent where processing was based on consent, without affecting earlier lawful processing
• Lodge a complaint with a competent data protection authority

CRM staff may also review and update lead records inside the application according to their role. We may need to verify your identity before fulfilling a request.

You can request deletion of your data at any time. Use our Data Deletion page (form or email). Include your name, email address, Facebook Page if relevant, and why you are writing.

We will confirm receipt and complete deletion or irreversible anonymisation within 30 days, unless a law requires us to keep a limited record. If we cannot delete something, we will say why.

Facebook users can also remove SOU Leads from Facebook under Settings → Apps and websites, and optionally send a deletion request from Facebook. Please also use our Data Deletion page so we can match your Facebook user id or Page.

SOU Leads is not directed at children. We do not knowingly collect personal data from children through Facebook Login or Lead Ads for this CRM. If you believe we have collected a child’s data in error, contact privacy@soutours.in and we will delete it.

We may update this Privacy Policy when our practices or legal requirements change. The “Last updated” date at the top will change. Continued use of the CRM after an update constitutes notice to staff users. Material changes that affect Lead Ads respondents will be reflected on this public page.

SOU Tours
Product: SOU Leads
CRM: https://leads.soutours.in
Privacy and data requests: privacy@soutours.in

Related documents: Terms & Conditions and Data Deletion instructions.