Privacy notice

LeadSprint is operated by [Your company's registered name], [Your registered address]. For anything in this notice, write to [support@your-domain.com].

Data about you, our customer. Your name, work email, phone number, business details, the settings you choose and the records of your use of the service. We decide how this is handled.

Data your business puts in. Your customers' and leads' names, numbers, addresses, the messages exchanged with them, estimates and appointments. Your business decides what goes in and why; we hold and process it on your instructions, and we do not use it for our own purposes. If your customer asks you to delete their details, you can do it in the app, and we will help if you need us to.

• Account and organisation details — to give you an account, place you in the right business, and apply your role and permissions.
• Leads, customers, conversations, appointments and estimates — the work the service exists to do.
• Delivery records for every text and email sent through the service — so you can see what was sent, when, and whether it arrived.
• Security and audit records, including the IP address and browser description behind sensitive actions and sign-in attempts — to detect abuse and to show who changed what.
• AI usage records: which model was asked, how many tokens, what it cost — so spending is visible and can be capped.
• Enquiries from this website: the name, email, phone, business, message and the IP address the form was sent from — to answer you, and to recognise a flood of automated submissions. Sending the form does not add you to any mailing list.

We do not run advertising or analytics trackers on this site, and there is no third-party cookie on it.

The application sets a small number of cookies, all of them necessary: a session cookie and a refresh cookie that your browser cannot read from JavaScript, a token used to stop cross-site request forgery, and a short-lived cookie that ties an integration sign-in to the browser that started it. Nothing tracks you across other websites.

We use other companies to run the service, and they see only what they need to: a hosting and database provider, an email sending provider, the texting provider whose account you connect, the AI provider you choose, the payment provider you pay through (Stripe, PayPal or Razorpay, which hold your card details — we never see them), and an error-reporting service that receives diagnostic information with personal details stripped out. Messages you have the assistant write or send are handled under that AI provider's terms; you may use your own account with them instead of ours.

We do not sell your data or your customers' data, and we do not train models of our own on it. We disclose data otherwise only where the law requires it.

Each business's rows are separated inside the database by row-level security, forced on the account the application connects with, so application code alone cannot reach another business's data. Credentials you connect — AI, texting, CRM, Slack — are encrypted with a key of their own and are never shown back to you. Passwords are stored as Argon2id hashes. Sensitive actions are appended to a log that the running application has no permission to alter. Traffic is encrypted in transit.

Your business's data is kept while the account is open, and is exportable at any time. When an account is closed, we keep it for a short wind-down period so it can be recovered or exported, then delete it. Audit and security records are kept longer, because their point is to show what happened. Website enquiries are kept while they are being answered and then archived.

A copy of your data, a correction, deletion, a restriction on how we use it, or that we stop altogether. Write to [support@your-domain.com] and we will answer within one month. If you are unhappy with the answer, you may complain to the data protection authority where you live. If your request is about data a business put into the service about you, we will pass it to that business, which decides what happens to it.

Data is held in the region our hosting and database providers run in for your account, and is transferred only as needed to the providers described above. The service is for businesses; it is not intended for children, and we do not knowingly collect their data.

When this notice changes we update the date at the top, and tell account holders in the app or by email if the change matters. Jurisdiction and governing law for this notice follow [Your city and country].