Privacy Policy

What we collect

From visitors to this site

• Contact form: your name, business, trade, phone, email and message.
• Live demo: the text you type is sent to our AI provider to generate a sample reply. It is not stored as an enquiry.
• Aggregate analytics (page views, visits) via Vercel Web Analytics — no cookies, no cross-site tracking.
• Advertising measurement: when we run ads, we tell the platform that showed the ad that an audit or a signup happened, so we can tell which ads are worth paying for. That involves sharing a scrambled version of your email address with Meta, Reddit and TikTok. Exactly what is and is not sent is set out in Advertising and how to refuse it below, and you can turn it off there.
• Quote Rescue (the paid follow-up product, not the free audit): if you switch it on, we store the quotes in your Jobber account along with your customer’s name and email address, because sending them a follow-up is impossible without knowing who they are. It is stored only for businesses that turned the product on, and it is deleted with your account. It is not the only place we hold anything about your customers — every enquiry that reaches you is stored too, and that is set out in full below; what is specific to Quote Rescue is that we hold quotes you have already sent, which nobody has messaged us about. Every follow-up is drafted for you to approve — nothing is sent to a customer without you pressing send — and each one carries a one-click unsubscribe, as CASL requires of commercial email.
• Dead Quote Audit: if you connect Jobber from /quote-rescue, we read your quotes once, in that moment, to total them up. We keep only the totals and your business name — never your customers’ names, addresses, phone numbers or job details, and never a copy of the quotes themselves. The connection is read-only, we never store the access token, and we disconnect the app as soon as the numbers are computed. The totals are also sent to us as an alert so we know the audit ran.

From customers of the product

• Your account: email address and a password, handled by our authentication provider. We never see your password.
• Your business details: business name, trade, city, opening hours, booking and review links, the phone number and address you choose to publish, and photos you upload.
• What you build: the websites, AI instructions and automations you create, including drafts.

About your customers, on your behalf

• Their name, phone number and email, where given.
• The content of the message they sent you, and the reply our AI drafted, including any edit you made and whether it was sent.
• Whether the enquiry looked urgent, what kind of job it was, and whether it was flagged for you to handle personally.

Technical information

When you or your customers use this site, our servers briefly record the IP address a request came from. We use it only to count requests and block abuse — the count is held for at most an hour, and it is never joined to an enquiry, an account or anything else described on this page. We do not use it to build a profile of you, and we do not sell it.

How we use it

To run the service you asked for: drafting and sending replies, building and hosting your site, running your automations, alerting you to enquiries that need a person, and billing you for the plan you chose.

We do not sell your information, and we do not use your data or your customers’ data to train AI models.

Who processes it (sub-processors)

We use these providers to run the service. Several process data outside Canada, principally in the United States:

• Supabase — database and sign-in; where your account, your business details and your customers’ enquiries are stored
• Vercel — hosting for this site and for the sites we publish for you
• Anthropic (Claude) — drafting replies and website content
• Resend — email notifications
• Telegram — optional instant alerts to you
• Stripe — payments and subscriptions
• Upstash — a short-lived counter of requests per IP address, used to stop abuse of our forms and endpoints

Everything is encrypted in transit (HTTPS). We aim to align with Canada’s PIPEDA, and a data-processing agreement is available on request at hello@leadmend.com.

Email to your customers

If you use Leadmend to email your customers, you are responsible for having their consent to do so, under Canada’s anti-spam law (CASL) and the equivalent rules where your customers are.

Every commercial message we send on your behalf carries a working unsubscribe link and a mailing address. Anyone who unsubscribes is suppressed immediately and is not emailed again for that business. That applies across every part of the product — there is no message type that ignores it.

How long we keep it

• Your account and content: for as long as your account is open. Delete your account from Settings and they go immediately, not within thirty days — except anything we must keep for tax or legal reasons, and the backups described below.
• Backups: we take a private backup of the database every night, encrypted at rest, and keep each one for 30 days. If you delete your account, your data is gone from the live service straight away, and disappears from the last backups within 30 days as they expire. We do not restore a backup to recover deleted accounts.
• Your customers’ enquiries: kept while your account is open so you have your own history, and deleted with your account. Ask us and we will delete individual enquiries sooner.
• Dead Quote Audit results: the totals are kept so your result link keeps working. Send the link to hello@leadmend.com and we will delete it — there is nothing in it but numbers and your business name, and no way for us to reach your customers from it.
• Unsubscribe records: kept even after an account closes. This is deliberate — it is the only way to guarantee we never email someone again who asked us not to, and the database enforces it rather than relying on us to remember.
• Website enquiries to us: up to 24 months, so we can pick a conversation back up.

If something goes wrong

If personal information in our care is lost, or accessed by someone who should not have it, and that creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and tell the people affected as soon as feasible, as PIPEDA requires. Where the information belongs to your customers we will tell you as well, because you are the one who holds the relationship with them. We keep a record of any such incident, whether or not it meets that threshold.

Your choices

You can delete your account and everything in it yourself, from Settings, whenever you like — it happens immediately. Most of what we hold is a download, not a request: Settings gives you your enquiries as a CSV and a full JSON archive, immediately. For anything the archive does not cover, or to have something corrected, email hello@leadmend.com and we will action it within 30 days at no charge.

If you are a customer of a business that uses Leadmend and want your details removed, contact that business directly — the information is theirs, not ours. If you cannot reach them, email hello@leadmend.com and we will help.

If you are in the UK or the EU

The GDPR and UK GDPR apply to you wherever we are, so this section says what we rely on and where we fall short.

Our lawful bases. For running the service you signed up for — your account, your site, your automations — the basis is performance of a contract. For keeping the service secure, preventing abuse and improving it, the basis is legitimate interests, balanced against your rights. For anything we ask permission for, it is consent, and you can withdraw it at any time. For records we are required to keep, such as tax records, it is legal obligation.

Your rights. Access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Most of these do not need a request: Settings gives you an immediate export and an immediate deletion. For the rest, email hello@leadmend.com. You also have the right to complain to your supervisory authority — the ICO in the UK, or your national data protection authority in the EU — and you can do that without contacting us first.

Data leaving the UK and EEA. It does. Our processors are named above and several are US-based, so any transfer relies on the data-processing terms those providers publish, which incorporate the European Commission’s Standard Contractual Clauses. We have not negotiated bespoke transfer terms with any of them, and we would rather you knew that than assume otherwise.

An Article 27 representative — we have not appointed one. Article 27 requires a representative in the Union for organisations outside it, and exempts processing that is occasional, excludes special-category data at scale, and is unlikely to result in a risk to people. Leadmend serves a small number of businesses and processes little personal data originating in the EU, so we currently rely on that exemption. It is a position with an expiry date rather than a permanent answer: when EU processing stops being occasional, a representative gets appointed, and this paragraph changes. If you are in the EU and want to raise something in the meantime, email hello@leadmend.com and it reaches a person directly.

If you are in California

Under the CCPA as amended by the CPRA, the categories we collect are identifiers (your name, email, business details), commercial information (your plan and billing records), internet activity (basic, privacy-preserving analytics), and, where your own customers contact you through us, the identifiers and message content they send. Why we collect each is described above; we keep them for the periods listed above.

We do not sell your personal information, using that word as the statute defines it, and we never have. We do share it, in the statute’s sense of the word, for one purpose only: measuring our own advertising. That counts as sharing for cross-context behavioural advertising, so there is an opt-out and it is Do Not Sell or Share My Personal Information. What that sharing consists of, and the other way to refuse it without following any link, is set out in Advertising and how to refuse it. We do not use or disclose sensitive personal information for purposes that require a limitation right. We also do not use your data, or your customers’ data, to train AI models.

You have the right to know what we hold, to delete it, to correct it, and not to be treated differently for exercising any of them. Settings does the first two immediately and without asking us; for anything else, email hello@leadmend.com. We will not charge you and we will not degrade your service for asking.

Children

Leadmend is a tool for businesses and is not directed at anyone under 16. We do not knowingly collect their information.

Contact

Leadmend Studio is based in Halifax, Nova Scotia, Canada. Questions about this policy, or about anything above? Email hello@leadmend.com. We may update this page as the business grows; the date at the top always reflects the current version.