Who we are
Leads is an app that helps small businesses follow up with people who asked about their work. It is run by The Leads team (“we”, “us”). You can reach us at leads.colon@gmail.com.
For your own account details, we decide how they are used, so we are the controller. For the details you add about your customers, you decide, so you are the controller and we are your processor: we handle that data only to run Leads for you, as described below.
What we collect
When you create an account
- Your name and email address.
- Your password, stored only as a secure hash by our authentication provider. We never see it.
- If you sign in with Apple or Google: an identifier and the email address they share. With Apple you can choose to share a private relay address instead of your real one.
- When you agreed to these terms and this policy, and which version.
What you add to Leads
- Details about your leads: names, email addresses, phone numbers, company, what they asked about, where they found you, notes and status.
- The follow-ups you write or send, your templates and your follow-up settings.
- Your workspace name and the teammates you invite.
If you subscribe to Leads Pro
- Apple handles the payment. We never see your card or bank details. From Apple we get the subscription’s transaction number, which plan it is, its start, renewal and end dates, and whether it will renew, so the app knows your workspace has Pro.
If you turn on push notifications
- A push token for your phone, which lets us send it notifications. It is deleted when you log out, turn push off, or delete your account.
Technical information
- Server logs with your IP address, the time of a request and the app version, used to keep the service secure and working.
Follow-ups you send leave from your own email app; Leads does not send or see them after that. The app contains no advertising and no third-party analytics or tracking SDKs. This website uses no analytics. When you log in to Leads in your browser, it sets one kind of cookie, which keeps you logged in and is removed when you log out. Nothing else is stored in your browser except which workspace you last opened.
How we use it
- To run the app: show your leads, work out who needs a follow-up, draft and send messages, and share a workspace with your team. Legal basis: our contract with you.
- To keep it safe: prevent abuse, investigate problems and protect your account. Legal basis: our legitimate interest in a secure service.
- To talk to you about your account, such as confirmation and password-reset emails, or important changes. Legal basis: our contract with you.
- To follow the law where we have to keep or share information. Legal basis: legal obligation.
We never sell your data, never share it with advertisers and never use your customers’ details for anything other than running Leads for you.
The writing assistant
The writing assistant is not available yet. When it is, and only when you ask it to write a draft, the lead’s name, what they asked about, earlier messages and your sender details will be sent to our AI provider, Anthropic, which returns the text. Anthropic processes this only to produce the draft and, under its commercial terms, does not use it to train its models. We will update this policy before it is switched on.
Who helps us run Leads
We use a small number of providers that process data on our behalf:
- Supabase: database, sign-in and hosting of the app’s backend. Your data is stored in Frankfurt, Germany (EU).
- Google (Gmail): delivers the emails Leads sends you about your account, such as sign-up and password reset codes.
- Apple and Google: only if you choose them to sign in.
- Apple: takes payment for Leads Pro and tells us the state of your subscription.
- Expo: delivers app updates and push notifications to your phone (push notifications go on through Apple or Google). A notification contains its title, such as “Follow up with Sarah”, and never the text of your messages.
- Vercel: hosts this website.
- Have I Been Pwned: when you choose a password, the app checks whether it has appeared in a known data breach. Only the first five characters of a one-way hash of the password are sent, which is not enough to work out the password, and nothing about you is included.
Some of these companies are based in the United States. Where data leaves the EEA, the transfer is covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long we keep it
We keep your data while you have an account. When you delete your account, it is removed from our live systems straight away: your profile, your sign-in methods, and every workspace only you use, with all its leads and messages. Shared workspaces stay for your teammates.
Backups are kept for a limited time, at most 30 days, and are then overwritten. Server logs are kept for a short period for security, normally no longer than 90 days.
Your rights
Under data protection law (GDPR) you can:
- get a copy of your data, and have it in a format you can take elsewhere;
- correct it (most of it you can edit in the app);
- delete it: in the app, go to Settings → Delete account;
- object to or limit how we use it;
- withdraw consent you have given, at any time.
Email leads.colon@gmail.com for anything you cannot do in the app. We answer within one month. You can also complain to the data protection authority in your country; in Norway that is Datatilsynet.
If a business contacted you using Leads, that business controls your details. Ask them first; we will help them answer.
Security
Data is encrypted in transit and at rest. Each workspace is separated by the database itself, so one business can never see another’s leads. Keys for email and drafting live only on our servers, never in the app.
On your phone, your sign-in and the copy of your leads the app keeps for offline use are encrypted with a key held in the iPhone’s Keychain, which never leaves that device. Email addresses are confirmed with a one-time code, changing your password after a while needs a fresh code, and resetting it signs you out everywhere else. You get an email when your password changes or a new way to sign in is added.
No system is perfectly secure, but we will tell you without delay if a breach affects your data.
Children
Leads is a tool for businesses and is not meant for anyone under 16.
Changes to this policy
When we change this policy we update the date at the top. If a change matters, we tell you in the app before it applies and, where needed, ask you to agree again.