LEGAL

Privacy Policy

Last updated: September 14, 2026

Masal.ai ("we", "us", "our") is a real estate marketing automation platform. We help real estate developers and agencies generate property websites, and automate the creation and daily optimization of Google Ads and Meta (Facebook) advertising campaigns, and manage the leads those campaigns generate, including automated WhatsApp follow-up to leads who've opted in. This Privacy Policy explains what data we collect, why, and how you can control it.

1. Data We Collect

1.1 Data you provide directly

  • Name, email, phone, business name, when you sign up or connect a client account.
  • Property details (location, price, configuration, images, builder information) you provide to generate a website and ad campaigns.

1.2 Data from Google Ads, via the Google Ads API

When you connect a Google Ads account, we access campaign, ad group, keyword, and performance data via the Google Ads API, under Google's own API access level and permissible-use rules, solely to create, manage, and report on the campaigns you ask us to build. We request only the scopes needed for this, and no more.

1.3 Data from Meta, via Facebook Login for Business

When you connect your Facebook Business account and grant permissions, we access the following via the Meta Graph API:

  • business_management, ads_management, pages_manage_ads, pages_show_list, pages_read_engagement: to list your Business Manager, ad accounts, and Pages, and to create and manage campaigns, ad sets, and ads on your behalf. Real estate campaigns are created under Meta's Special Ad Category for Housing, as required by Meta's own advertising policy.
  • leads_retrieval: to retrieve leads generated from your Meta Lead Ads forms. We store the lead's name, email, phone, form ID, ad ID, and campaign ID, so it can appear in your Lead Centre.
  • Access tokens: stored encrypted, used only to perform the automation you've authorized.

1.4 Data from WhatsApp, via the WhatsApp Business Platform

When you connect your WhatsApp Business Account (WABA) and phone number, we access approved message templates and send WhatsApp messages only to leads who have explicitly opted in via your Meta Lead Form. We store the recipient's phone number, the message content, delivery status, and timestamp, so you can see confirmation of what was sent. We do not read personal WhatsApp conversations, and we only send messages through your own connected WABA.

1.5 Lead Centre data

Leads captured through a property website or a Meta Lead Ad are delivered to your Lead Centre through a dedicated, client-specific ingestion endpoint, authenticated by a unique passkey issued to that client. This is a one-way submission channel, not a general database connection, and no website has broader access to your account's data than that.

2. How We Use Your Data

  • To generate a property website from the details you provide.
  • To create, manage, and daily-optimize Google Ads and Meta ad campaigns on your behalf.
  • To generate ad creatives matched to your property and target audience.
  • To receive and display leads in your Lead Centre.
  • To send automated WhatsApp follow-up messages, using approved templates, to leads who opted in via your Lead Form.
  • To provide reporting and support.
  • To comply with Google's and Meta's own advertising and API policies, including Meta's Housing Special Ad Category requirements.

3. Data Sharing

We do not sell your data or your leads' data. We share data only with:

  • Google: to create and manage campaigns via the Google Ads API.
  • Meta: to create and manage campaigns and retrieve leads via the Meta Graph API.
  • WhatsApp (Meta): to send approved template messages to opted-in leads.
  • Infrastructure providers: our hosting and database infrastructure (Google Cloud Platform), under standard data processing terms.
  • When required by law.

4. Data Retention

  • Campaign and account metadata: retained while your account is active.
  • Leads: retained per your Lead Centre configuration, or until you or your client requests deletion.
  • WhatsApp message logs: retained for 12 months, for delivery confirmation and support purposes.
  • You can request deletion of your data, or a lead's data, at any time. See Section 7.

5. Security

Access tokens and credentials are encrypted at rest. All API calls use HTTPS. We enforce role-based access internally, so only authorized staff can view a given client's data, and we keep audit logs of access. We never store your Google or Facebook password, we only ever receive an authorization token you can revoke at any time.

6. Your Rights

You have the right to access, correct, export, or delete the data we hold about you or your business. For leads (the end-users who filled out a form on a property website or Meta ad), they can exercise the same rights via the property owner's own privacy contact, and we will assist as a data processor.

7. Data Deletion

You can request deletion of your data at any time, at no cost, regardless of your region:

  1. Email us at hello@masal.ai with the subject "Delete My Data", including your registered email and business name.
  2. If you connected a Meta account: go to Facebook Settings > Business Integrations > Remove Masal.ai, or see our dedicated Data Deletion Instructions page.
  3. We will delete all associated data, access tokens, campaign records, and retrieved leads, within 7 days, and confirm by email.

8. Children

Our service is not directed to children under 18, and we do not knowingly collect data from children. Real estate ad campaigns must not target audiences under 18.

9. International Data Transfers

Our infrastructure is hosted on Google Cloud Platform. Where data is transferred to Google or Meta's own systems via their APIs, that transfer is governed by Google's and Meta's respective data processing terms.

10. Contact

For privacy questions: hello@masal.ai
Address: Masal.ai, Bangalore, Karnataka, India

11. Updates to This Policy

We may update this policy as our services change, including if we add new marketing channels or capabilities in the future. We will update the "Last Updated" date above and notify active users by email or dashboard notice before any material change takes effect. This policy will always describe our services as they actually exist at the time you read it.