Privacy Policy

Personal Information You Provide. We collect the following categories of personal information from you when you use or interact with us through the Service:

• Account and Profile Information: your email address and password, or the basic profile information released by Google when you choose "Sign in with Google" (name, email address, and profile photo). We never receive or store your Google password.
• Business and Brand Information: your business name, website URL, industry, target market, offers, tone of voice, and similar details you provide during onboarding or in settings. We use these to personalize AI-generated replies, tags, and suggestions.
• Financial Information: our payment processor Stripe, Inc. ("Stripe") collects the financial information necessary to process subscription payments through the Service. We do not receive or store your full card number. In addition to this Privacy Policy and our Terms of Service, your financial data is also processed pursuant to Stripe's services agreement and privacy policy.
• Content You Create in the Service: lead records, tags and tag keywords, notes, reminders, saved replies, automation rules, AI agent configuration, and messages you send through the Service.
• Instagram Account Data: when you connect your Instagram professional account through Meta's official authorization, we receive the data described in Section 6 below, including your direct message conversations, comments on your posts, your posts and media, and your account profile.
• Communication Information: the content of your communications when you contact support, respond to surveys, or provide feedback. Providing communication data is optional.
• Team Information: if you invite teammates to your workspace, the email addresses you supply and the account information of those teammates once they join.
• Other Information not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Internet Activity Information. When you visit and use the Service, the following information is automatically logged in our systems:

• Log Information: Internet Protocol address, browser type and settings, the date and time of your request, and how you interacted with the Site.
• Cookies and Local Storage: we use cookies and browser local storage to keep you signed in, remember preferences such as your sidebar and theme settings, and analyze usage patterns. We do not use third-party advertising cookies.
• Device Information: the device name, operating system, and browser you are using.
• Push Notification Tokens: if you install Leadsocial to your home screen and enable notifications, we store the anonymous push subscription issued by your browser so we can alert you to new messages. Revoking notification permission invalidates it.
• Usage Information: the features you use, the actions you take, and the time, frequency, and duration of your activities.

The core function of the Service is to help you manage conversations with people who message your Instagram account ("Leads"). To do this, we receive and store information about those people, including their Instagram username and display name, their profile picture, the content and timestamps of the messages they exchange with you, their comments on your posts, and any tags, notes, or reminders you attach to them.

We process this information on your behalf and at your direction, as a service provider to you. You are responsible for ensuring that your use of the Service, and any messages you send or automate through it, complies with applicable privacy, marketing, and anti-spam laws and with Instagram's own terms and policies. We do not sell this information, use it to build advertising profiles, or use it to contact Leads for our own purposes.

If a Lead contacts us directly to exercise a privacy right, we will generally refer them to you as the business responsible for the conversation, and will assist you in responding as required by applicable law.

We may use personal information for the following purposes:

• To operate and deliver the Service: to provide, operate, maintain, and secure the platform; to sync your Instagram messages and comments; to run the automations you configure; to process subscriptions through Stripe; to provide support and troubleshooting; and to send administrative messages such as changes to our terms or policies.
• To improve, monitor, personalize, and protect the Service: to enrich your experience, customize the suggestions we surface, protect the security of the Service, and prevent and detect security threats, fraud, or other malicious activity.
• For AI processing: our AI features (reply drafting, conversation summaries, lead scoring, automatic tagging, tag keyword suggestions, and plain-English search) use artificial intelligence. To provide them, message text and related content are sent to third-party AI providers for processing. See Section 4 for who those providers are.
  • Purpose: your content is used only to generate outputs for you and to operate the Service.
  • Training: your content is not used to train general AI models shared with other users.
  • Human Review: we do not manually review your conversations or AI outputs, except where necessary to investigate abuse, ensure safety, or comply with the law.
  • Third-Party AI Providers: our AI providers are contractually bound to use your data only for providing the requested service and not to train their models on it.
• For search indexing: to power plain-English search across your inbox, we generate numerical representations ("embeddings") of your message content and store them alongside your workspace. These are derived from your data and are deleted with it.
• For website and profile analysis: if you provide a website URL or connect your Instagram account, you consent to our systems accessing and analyzing publicly available content there to extract your brand voice, offers, and specialties, which we use to personalize AI outputs. You may remove your website URL at any time, after which no further analysis will be performed.
• For research and development: it is in our legitimate business interest to use personal information to develop, analyze, and improve the Service. As part of these activities, we may create or use aggregated, de-identified, or otherwise anonymized data.
• To comply with legal obligations and defend Leadsocial against legal claims or disputes: to comply with applicable laws and lawful requests; to protect our, your, or others' rights, privacy, safety, or property; to audit our compliance with legal and contractual requirements; to enforce the Terms of Service; and to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity.
• For marketing: we may use your contact details to send you product updates, educational content, special offers, and information about features we believe may interest you. You may opt out at any time by following the unsubscribe instructions in the communication or by contacting us. Where consent is required, we will obtain it; you may withdraw consent at any time.
• For advertising and promotion of Leadsocial: as further described in Section 8 of our Terms of Service, we may use your name, handle, profile photo, business name, and associated results or testimonials in our marketing materials. You may opt out at any time by emailing richard@leadsocial.co with the subject line "Marketing Opt-Out"; opt-out applies prospectively only.
• To facilitate corporate transactions: in connection with any merger, financing, acquisition, reorganization, or sale of all or part of our business or assets.

In certain circumstances we may share the categories of personal information described above with the following categories of third parties:

• Hosting and Infrastructure: Supabase, Inc., which provides our database, authentication, file storage, and backend functions. Your workspace data, including messages and lead records, is stored there.
• Instagram Messaging Providers: we use a third-party Instagram Messaging API provider to relay messages, comments, and webhook events between Instagram and the Service. Message content and Instagram profile data pass through that provider in order to reach your inbox.
• AI Providers: Google LLC, whose Gemini models process message text and related content to generate replies, summaries, tags, and search results. These providers are contractually bound to use your data only for providing the requested service and not to train their models on it.
• Payment Processing: Stripe, which handles checkout, subscription billing, and the billing portal.
• Meta Platforms: when you connect Instagram, information flows between the Service and Meta under the permissions you explicitly grant. Meta's handling of that data is governed by Meta's own terms and privacy policy.
• Other Vendors and Service Providers: email delivery, customer support tooling, error monitoring, and analytics providers who process personal information on our behalf and pursuant to our instructions.
• Teammates in Your Workspace: members you invite can see the conversations, leads, and settings in that workspace.
• Professional Advisors: our lawyers, accountants, and auditors, where doing so is necessary to facilitate the services they render to us.
• Business Transfers: if we are involved in a merger, acquisition, financing diligence, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your personal information may be transferred to a successor or affiliate as part of that transaction.
• Legal Requirements: if required by law or in the good-faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, prevent fraud, act in urgent circumstances to protect personal safety, or protect against legal liability.
• Aggregated or De-Identified Information: we may share aggregated or de-identified information that does not identify you with third parties for our lawful business purposes.

We do not sell or rent your personally identifiable information for monetary consideration.

Depending on where you are based, and as provided under applicable law and subject to any limitations in such law, you may have the right to:

• access the personal information we hold about you;
• correct incomplete or inaccurate data we hold about you;
• ask us to erase the personal information we hold about you;
• ask us to restrict our handling of your personal information;
• receive any personal information we hold about you in a structured, commonly used, machine-readable format (portability);
• opt out of any "sale" or "sharing" of your personal information for targeted advertising under applicable laws;
• opt out of profiling in connection with decisions that produce legal or similarly significant effects (we do not engage in such profiling);
• object to how we are using your personal information; and
• withdraw your consent to our handling of your personal information.

Requests can be made to richard@leadsocial.co. You may also update or correct information about yourself directly within your account settings, and you can delete your data as described in our User Data Deletion instructions. Prior to responding, we may require you to verify your identity. Depending on where you reside, you may be entitled to authorize an agent to submit requests on your behalf; we will require such agents to confirm their identity and authority. We may have valid legal reasons to refuse a request, and will inform you if that is the case.

Limits on your rights and choices. In some instances your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations or enforce our legal rights.

Opt out of direct marketing. You may opt out of marketing-related communications by following the unsubscribe instructions in any marketing email. You will continue to receive non-marketing messages, such as communications regarding your account or updates to this Policy.

"Do Not Track." Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. We do not currently respond to DNT signals.

Leadsocial connects to your Instagram professional account through Meta's official authorization flow. We only ever receive the permissions you explicitly approve on Meta's consent screen, and we ask for the minimum scope needed to run the Service.

• What we receive: your Instagram account profile (username, name, profile picture, and follower count); your direct message conversations and their message content; comments on your posts; your posts and media, so automations can be attached to a specific post; and the public profile of each person who messages or comments.
• What we do with it: display it in your inbox and CRM, run the automations you configure, and generate the AI outputs described in Section 3. We do not use Instagram data for advertising, resell it, or share it with other Subscribers.
• Message history: when you first connect, we import your recent conversation history so your inbox is not empty. Messages that predate your connection are marked as historical and are never replied to automatically.
• Revoking access: you may disconnect Instagram at any time in your Leadsocial settings, and you may independently revoke Leadsocial's access from Instagram under Settings → Apps and websites. Disconnecting stops all further syncing and automation immediately.

Our use and transfer of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including any limited-use requirements.

• Account data is retained for as long as your account or subscription is active.
• Messages, lead records, tags, notes, automations, and search indexes are stored for the duration of your subscription so your history remains searchable.
• Upon account deletion or termination, we will remove your personal data within a reasonable period, typically within 30 days, subject to legal, tax, accounting, or security exceptions.
• Disconnecting Instagram stops new data from arriving but does not by itself delete the conversations already imported. To remove those, follow our User Data Deletion instructions.
• Anonymized or aggregated data may be retained for analytics and platform improvement purposes.
• Payment records may be retained as required by applicable tax and financial regulations.
• Backups are retained on a rolling basis and are overwritten in the ordinary course; deleted data may persist in backups for a short period after deletion from live systems.

You can request deletion of your account and all associated data at any time. Full step-by-step instructions, including what is deleted and what is retained, are on our User Data Deletion page.

The Service is not directed to children under the age of 16. Leadsocial does not knowingly collect personal information from children under the age of 16. The Service is also not intended for use by individuals under the age of 18, and by creating an account you represent that you are at least 18 years old. If you have reason to believe that a child under the age of 16 has provided personal information to Leadsocial, please contact us and we will endeavor to delete that information from our systems.

The Service may contain links to other websites and platforms not operated or controlled by Leadsocial, including Instagram, Facebook, Stripe, and links shared inside your conversations ("Third Party Sites"). The information you share with Third Party Sites is governed by the privacy policies and terms of service of those sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.

You use the Service at your own risk. We implement commercially reasonable technical, administrative, and organizational measures to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption in transit and at rest, row-level access controls that scope every record to its own workspace, and restricted internal access to production systems. However, no Internet or email transmission is ever fully secure or error-free. You are responsible for maintaining the confidentiality of your account credentials. We are not responsible for the circumvention of any privacy settings or security measures contained on the Service or on third-party websites.

Leadsocial is operated from the United States and your personal information will be stored and processed there and in other jurisdictions where our service providers operate. We may share your personal information with third parties who are also based outside your country of residence. If you are based outside the United States, please note that the United States may not provide the same protections as the data protection laws where you are based. Where required, we will ensure that appropriate safeguards are in place to afford adequate protection for your personal information.

The Service and our business may change from time to time. As a result we may change this Privacy Policy at any time. When we do, we will post an updated version on this page and update the "Date of last revision" above, unless another type of notice is required by applicable law. By continuing to use the Service or providing us with personal information after we have posted an updated Privacy Policy, you consent to the revised Policy and the practices described in it.

If you have any questions about this Privacy Policy or our information practices, or if you wish to lodge a complaint about how we process your personal information, please contact us at richard@leadsocial.co. We will endeavor to respond to your complaint as soon as possible. Depending on where you reside, you may also have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred.

Leadsocial Group LLC · richard@leadsocial.co