Privacy Policy
Version 2026-10-09 · last updated 9 October 2026
This explains what FollowThroo does with personal data — yours, your team's, and the people in your CRM — in plain terms. It describes how the product actually works; where something depends on a setting, it says which.
Who is responsible
FollowThroo is a product of Brandstac, a company based in India. FollowThroo decides how account, billing, website and product-usage data is used, and is responsible for it. For the leads, messages and campaigns a workspace adds, the workspace (our customer) decides why that data is processed; FollowThroo processes it on their behalf to run the service.
Your account and workspace
Your name, email address, sign-in method (password, Google or Zoho), the workspaces you belong to and your role in them, your settings, and security records such as sign-in sessions. Passwords are stored only as secure hashes.
Leads and CRM data
Whatever your workspace adds: names, email addresses, phone numbers, LinkedIn profile addresses, companies, notes, tasks, pipeline stages, deal values and the source each lead came from (a CSV, a form, a marketplace, the Chrome extension). Leads from connected lead sources arrive with the details that source sends; the raw copy of a webhook payload is kept for 30 days, then only the fields we use remain.
Connected inboxes
When a mailbox is connected, FollowThroo checks new mail to find replies to your outreach. It keeps only mail that is about your work in FollowThroo: replies to messages it sent, messages on conversations it already tracks, and messages from people who are leads in your workspace. Everything else — a teammate's newsletters, personal mail, other business — is looked at only far enough to decide (sender, subject and threading headers; the body is not downloaded) and is not stored. It is never moved out of your spam folder. A returned-mail notice is recorded as a bounce on the message it is about, and the notice itself is not kept. What is kept is the sender, recipients, subject, the plain text of the message (capped in length) and the headers needed to thread it — no attachments and no original HTML.
Campaign email
Campaign emails are sent from your own connected mailbox. To report opens and clicks, they include a small image and route links through FollowThroo; opens are approximate, since some mail apps load images automatically and others never do. Every campaign email carries a visible unsubscribe link and a one-click unsubscribe header. Unsubscribing, replying “stop”, a hard bounce or a spam complaint puts the address on your workspace's suppression list, and nothing more is sent to it from any campaign. Account and service emails (sign-in links, invitations, billing and task notices) aren't marketing and don't carry an unsubscribe link.
Connection requests and messages are sent by the FollowThroo desktop app on your own computer, in your own LinkedIn session — not from our servers, and we never hold your LinkedIn password. It reports back what happened (sent, already connected, pending, failed) so your campaigns and reports stay accurate, and it reads your connections list to learn which invitations were accepted and your recent messages to record replies from your leads. It stops and touches nothing if LinkedIn shows a security check. The Chrome extension adds the people you choose from LinkedIn pages to your CRM. If you connect LinkedIn sign-in, we receive your LinkedIn identity and can publish the posts you schedule.
Facebook, Instagram and WhatsApp
When a workspace connects a Facebook Page for lead ads, FollowThroo keeps the Page's name and id and an access token for it, encrypted, and uses that token for one thing: reading each new lead form submission on that Page. The lead then belongs to the workspace like any other. When a workspace connects a WhatsApp Business number, FollowThroo keeps the number's ids, the access token Meta issues and the number's registration PIN, encrypted, along with the messages sent and received on it. We read nothing else from Facebook, Instagram or WhatsApp, and none of it is used for advertising.
To delete it: an owner or admin can disconnect a Page in Settings → Lead sources, which deletes its token and stops new leads, or disconnect WhatsApp in Settings → Channels, which deletes the token, the PIN and the synced templates. Leads that already arrived stay in the workspace until someone deletes them, one at a time from the lead's page or all at once by deleting the workspace in Settings → Privacy & data. You can also remove FollowThroo from your Facebook account under Settings → Business integrations. Or write to hello@followthroo.com saying which Page, number or lead, and we will delete it and tell you when it's done.
AI features
Some features use AI models through OpenRouter (or Anthropic directly, where configured): drafting replies, reading whether a reply is interested or asking to unsubscribe (up to 2,000 characters of that reply), writing LinkedIn messages and posts, answering questions about your reports, and Throo, the AI agent you chat with. When you ask Throo something, it sends the model what it needs to answer from your workspace: the lead, template, campaign or report details its tools read for that request; your Throo chats are kept for 180 days after the last message. Report questions send aggregate numbers only — no names, email addresses or message content — and people and mailboxes are replaced with codes like “member_2” before anything leaves our servers. We don't use your data to train models; the model providers handle it under their own terms.
Billing
Payments are taken by Razorpay in its own checkout; card details go to Razorpay and never reach FollowThroo. We keep the plan, the order and payment references, amounts and dates.
When you contact us
If you write to us through the contact form on www.followthroo.com, we receive your name, email address, your company if you give it, what your message is about, and the message itself. We use them to reply to you and to follow up on what you asked. The form emails your message to our team through Resend, which also sends you a receipt, and adds you as a contact in FollowThroo's own CRM so we can keep track of the conversation. For this data FollowThroo is responsible, not a customer. We keep it while we're in touch and afterwards for as long as it's useful to us, until you ask us to delete it — write to hello@followthroo.com and we will. Writing to us by email is handled the same way.
Cookies and analytics
Necessary cookies keep you signed in and secure. Preference cookies (your theme) and Google Analytics are used only if you allow them, and saying no never limits the product. Analytics receives a random browser identifier, sanitised page routes and interactions — not names, emails, lead data, message content or record ids — with advertising features and Google Signals off. The Cookie Policy lists every cookie.
Who else handles data
We don't sell personal data or lead data. Service providers handle it only to run the service — hosting, database, email, AI, payments — and each gets only what its job needs. They're listed, with what each receives and where, on the Subprocessors page. Some process data outside India, including in the United States and Japan.
How long we keep it
Workspace data stays until the workspace deletes it or is deleted. Unrelated inbox mail isn't kept at all. Raw lead-source payloads: 30 days. Cached AI insights: 7 days. Workspace exports: 7 days, then deleted. Warm-up delivery checks: 180 days. When a lead is deleted, its messages and conversations go with it; only the address stays on the suppression list, so the person you removed isn't contacted again. Billing records are kept as long as tax and accounting law requires, even after a workspace is deleted.
Security
Data is encrypted in transit. Mailbox passwords, OAuth tokens and signing keys are encrypted at rest with a key held outside the database, and are never sent to your browser. Access is limited by role within a workspace and by workspace across the service. Sensitive actions — plan changes, campaign starts and stops, exports, deletions, role changes — are kept in an audit log owners and admins can read.
Your rights
You can ask what personal data we hold about you, correct it, have it erased where we aren't required to keep it, withdraw consent, nominate someone to act for you, and raise a grievance. In the app, Settings → Privacy lets an owner or admin export the whole workspace, an owner delete it (with seven days to change your mind), and anyone delete their own account. Deleting a lead removes it and its conversations. If you are one of the people in a customer's CRM, contact that customer, or write to us and we'll pass your request on.
Children
FollowThroo is a business tool and isn't meant for anyone under 18.
Changes
Each version of this policy is numbered, with a line below saying what changed. Cookie choices record the version they were made against, and when the cookie notice changes you're asked again.
Contact and grievances
For privacy questions, rights requests or grievances, email privacy@followthroo.com — from the email address on your account, so we can verify it's you. If your grievance isn't resolved, you may complain to the Data Protection Board of India once the relevant provisions are in force.
What changed
- 2026-10-09 — Names Brandstac, the company that makes FollowThroo.
- 2026-10-02 — Added Throo, the AI agent: what it sends to the AI model when you ask it something, and that its chats are kept for 180 days after the last message.
- 2026-10-01 — Added what happens to messages sent through the website contact form, and what FollowThroo keeps from a connected Facebook Page or WhatsApp number and how to delete it.
- 2026-09-29 — Rewritten to describe how FollowThroo actually handles data: only mail about your leads is kept from connected inboxes, the LinkedIn desktop app, AI processing, retention periods, export and deletion, and the list of service providers.
- 2026-09-27 — India DPDP framing; optional Google Analytics only with consent.