Privacy Policy

1. Definitions

To ensure clarity, we define the following terms used throughout this Policy:

• "Service": The Leadr Ai platform, including our website (aileadr.com), web application, and the Leadr AI mobile application available on iOS and Android.
• Service Professional ("Pro"): Any business or individual entity using the Leadr Ai platform to manage their leads.
• Lead Data / API Data: Any information related to a potential customer, including name, contact info, and project details, received via Partner Platforms (Thumbtack, Yelp, etc.).
• Partner Platforms: Third-party lead generation services (e.g., Thumbtack, Yelp) that connect to Leadr Ai via authorized APIs.
• AI Providers: Secure third-party processors (e.g., Google Gemini, OpenAI, ElevenLabs) utilized for real-time natural language processing.

2. Information Collection & Sources

We collect and process the following categories of information:

• Identifiers: Name, business email, phone number, and IP addresses. (Source: User, Partner Platforms).
• Commercial Information: Lead project types, service categories, and quote history. (Source: Partner Platforms).
• Internet Activity: Interactions with our website, log files, and diagnostic data. (Source: Cookies/Usage logs).
• Geolocation Data: Approximate location based on IP address or lead ZIP code. (Source: Partner Platforms).

3. Business Purposes for Processing

We process your data and Lead Data for the following specific purposes:

• Service Provision: To automate lead responses, schedule bookings, and synchronize data across Partner Platforms.
• Platform Security: To detect fraud, prevent unauthorized access, and maintain service integrity.
• Technical Support: To resolve issues and respond to Pro inquiries.
• Compliance: To satisfy legal obligations and partner platform requirements.

4. CCPA / California Privacy Rights

Leadr Ai does not "sell" or "share" personal information for cross-context behavioral advertising. We may disclose personal information to service providers/processors to operate the Service, under contractual restrictions. As a California resident, you have the right to:

• Right to Know: Request access to the specific pieces of personal information we have collected.
• Right to Delete: Request the deletion of your personal information (subject to legal exceptions like billing and security logs).
• Right to Correct: Request that we correct inaccurate personal information.

To exercise these rights, please email contact@aileadr.com. We will verify your identity via your registered business email and respond within 45 days.

5. AI Processing and No-Training Commitment

We use third-party AI providers solely to generate responses and perform real-time text processing. We configure and contractually require our AI providers to not use Lead Data to train their generalized AI/ML models, where such controls are available under the provider’s terms for API customers. Where an AI provider does not offer a no-training control for a given service, we will not use that service for processing Lead Data.

We minimize the data sent to AI providers, and when feasible, remove or mask non-essential identifiers prior to processing. We do not intentionally submit Lead Data for provider training.

6. Push Notifications (Mobile App)

If you use the Leadr AI mobile application, we may send push notifications to your device to alert you about new leads, messages, and important account updates. You can manage or disable push notifications at any time through your device settings or within the app. We do not use push notifications for advertising purposes.

7. SMS Communications

We may use your phone number to send text messages (SMS) related to your service requests, including notifications, confirmations, and follow-up messages. By providing your phone number, you consent to receive these messages. Message and data rates may apply.

You may reply STOP at any time to opt out of receiving further SMS communications. For help, reply HELP or contact support at contact@aileadr.com.

8. Cookies and Tracking

We do not use third-party advertising cookies. We do not track you across other websites for the purpose of targeted advertising.

8.1 Analytics and Service Providers

We use privacy-focused analytics (such as PostHog) to understand product performance and improve the Service. These providers act as our service providers/processors and are contractually restricted from using the data for their own purposes. We do not use third-party advertising cookies or enable cross-context behavioral advertising.

9. Partner API Data Deletion Standards (Thumbtack & Yelp)

We maintain strict data deletion or de-identification standards for data received via Partner Platform APIs in our active systems following termination of your integration or a verified compliance request:

• Thumbtack: Data is deleted or de-identified within five (5) business days.
• Yelp: Data is deleted or de-identified within thirty (30) days or upon request.

Exceptions apply where limited retention is required for security, fraud prevention, legal compliance, dispute resolution, or as required by law. Residual copies may persist temporarily in encrypted backups and disaster recovery systems, but will not be restored to active processing. Backups are rotated and overwritten on a scheduled basis consistent with our backup retention policy.

Retention of Records: Detailed logs of TCPA consents and opt-outs are kept indefinitely to protect the Pro and the platform against legal claims.

10. Data Security and Safeguards

We implement a robust security framework including:

• Encryption: AES-256 for data at rest and TLS 1.2+ for data in transit.
• RBAC: Role-Based Access Control to ensure only authorized personnel can access sensitive data.
• Audit Logging: Continuous monitoring of all administrative and API actions.
• Secrets Management: Use of hardware-backed vaults for API keys and credentials.
• Vendor Due Diligence: Periodic review of key subprocessors’ security posture (e.g., SOC 2 / ISO reports where available).

11. International Transfers

Leadr Ai is hosted on AWS (US-East Region). For users outside the United States, we utilize Standard Contractual Clauses (SCCs) to ensure that data transferred abroad receives the same level of protection as mandated by GDPR or CCPA.