Privacy policy

DRAFT — not reviewed by a lawyer. Do not publish until it has had legal review.

Last updated: [DATE]

SpeedLead ("we", "us") is a mobile app that collects your business's incoming sales leads in one place, alerts your phone when a new lead arrives, and can text you a backup alert when a lead waits. Automatic replies to your leads (texts and emails sent on your behalf) are not switched on yet; where this policy says "when you turn them on", it describes what happens once you do. This policy explains what we store, why, who we share it with, and how to delete it.

[COMPANY LEGAL NAME, ADDRESS, CONTACT EMAIL]

Two kinds of people

• You (the account holder) — the business owner or staff member who signs in to the app.
• Your leads — people who contact your business through a form, an ad or an email that you connect to SpeedLead. For their data you are the controller and we process it on your behalf (we act as your processor).

What we store about you

• Account: email address and a password hash (or a one-time sign-in link), handled by our authentication provider.
• Business profile: business name, callback phone number, time zone and default country.
• Settings: alert preferences, quiet hours and backup-text settings, and, when you turn them on, your auto-reply templates.
• Subscription status: whether you are on the free trial or a paid plan, which plan, and when it renews. Payment is handled by Google Play or the App Store; we never see your card details. Our subscription provider receives your account ID and the store's purchase records.
• Device push token: an identifier that lets us send alerts to your phone. It is removed when you sign out, when the token stops working, or when you delete your account.
• Crash reports (if enabled): when the app crashes, a report with the error, device model and OS version may be sent to our error-reporting provider. Reports do not include your leads' messages on purpose, but stack traces can contain screen names and IDs.

What we store about your leads

When a lead reaches one of your connected sources (web form or Zapier link, Facebook Lead Ads, or a forwarded email) we store:

• name, phone number, email address and message;
• the other fields the form or email contained (for example service type or ZIP code) and, for forwarded emails, the email text (attachments are not kept);
• an activity history: alerts sent, the lead's replies, notes and status changes you add, calls/texts/emails you start from the app and, when you turn them on, the automatic texts and emails sent to the lead.

Phone numbers that opted out

If someone replies STOP to one of our texts, we store their phone number on an opt-out list so we never text them again. This list is kept even after the account that texted them is deleted, because it is shared by every account that sends from our number and the law requires us to honor the opt-out. Replying START removes the number from the list.

Why we use this data

• To deliver the service: show your leads, alert you and, when you turn them on, send the automatic texts and emails you set up.
• To send you a backup text to your callback number if a lead waits too long (you can turn this off in Settings).
• To keep the service secure and working (preventing abuse such as fake form submissions, fixing crashes).

We do not sell personal data, use it for advertising, or use your leads' data for anything other than providing SpeedLead to you.

Who we share it with

We use these service providers (sub-processors) to run SpeedLead:

Provider	What for	Data involved
Supabase	Database, authentication and server functions (hosting)	All data above
Twilio	Sending and receiving text messages	Lead phone numbers, message text; your callback number for backup texts
Resend	Sending automatic emails, when you turn them on	Lead email addresses, email text, your account email as reply-to
Postmark	Receiving forwarded lead emails	The forwarded email
Expo (push service)	Delivering alerts to your phone	Push token, alert title and text (lead name, phone, start of message)
Meta (Facebook Lead Ads)	Fetching leads from your ads, if you connect it	The lead form answers
Sentry	Crash reports, if enabled	Error details and device information
RevenueCat	Subscription status and purchase validation	Your account ID, purchase history and receipts from Google Play / the App Store
Google Play / Apple App Store	Taking payment for subscriptions	Handled under their own privacy policies

[Data location: SUPABASE REGION. International transfers: describe safeguards, e.g. Standard Contractual Clauses.]

We may disclose data if required by law.

How long we keep it

• Your account data and all your leads are kept while your account exists.
• When you delete your account (Settings → Delete account), we delete your profile, sources, leads, activity history, auto-replies, settings and push tokens. Copies in backups expire within [BACKUP RETENTION, e.g. 30 days].
• The opt-out list (see above) is kept indefinitely.

Your choices and rights

• Delete your account at any time in the app: Settings → Delete account. It cannot be undone.
• You can edit or delete individual information in the app, or email us for a copy of your data.
• Depending on where you live (for example the EU/UK under GDPR, or California under CCPA/CPRA), you may have rights to access, correct, delete, export or object to processing of your data. Contact us at [CONTACT EMAIL].
• Leads who want their data removed should contact the business that collected it. We will help that business respond.

Children

SpeedLead is a business tool and is not intended for anyone under 16.

Security

Data is encrypted in transit (HTTPS). Access to each account's data is restricted at the database level to that account. No method of storage or transmission is completely secure.

Changes

We will update the date above and notify you in the app if we make material changes.

Contact

[CONTACT EMAIL]