Privacy Policy

1. Overview

This Privacy Policy explains what data LeadRescue ("Service") collects, how it is stored and processed, and what your rights are regarding it — both as a registered account holder of the Service, and as a customer of an account holder ("lead") whose information is processed through the system. This policy is designed to meet international data protection standards, including the EU General Data Protection Regulation (GDPR), where applicable.

2. Information We Collect

We collect and process two main categories of information:

• Account information: business name, email address, branding details (logo, brand color), and integration settings (such as WhatsApp API credentials) that you enter yourself.
• Lead and cart data: customer names, phone numbers, email addresses, and shopping cart contents — received via webhooks from online stores (such as Shopify, WooCommerce, or Elementor Forms), or entered manually by you.
• Proposal and signature content: proposal details, digital signatures, and payment references (not full card details — these are processed directly by the payment provider).
• Technical usage data: IP address, browser type, and basic in-app actions — for operation, security, and service improvement purposes.

3. How We Use Your Information

The information we collect is used solely to provide the Service: sending WhatsApp lead-recovery messages, creating and displaying proposals, processing payments, and operating your account properly. We do not sell, rent, or trade personal information belonging to users or leads to third parties for marketing or any purpose unrelated to providing the Service.

4. Legal Basis for Processing (GDPR)

Where the GDPR applies, we process personal data on the following legal bases: performance of a contract with you (providing the Service you signed up for), your consent (for example, when you agree to these policies at signup, or when a lead is contacted via WhatsApp as part of a recovery flow you configured), and our legitimate interests in operating, securing, and improving the Service, balanced against your rights and freedoms.

5. How Your Information Is Secured

All information is stored in a PostgreSQL database managed by Supabase, encrypted in transit (HTTPS/TLS) and at rest. Access to data is restricted through database-level Row Level Security (RLS) policies, so each account holder can only access data belonging to their own business. Sensitive access keys (such as API keys) are stored securely and are never exposed client-side. Administrative access to the system is limited and audited.

6. Sharing With Third-Party Processors

To operate the Service, certain information is shared with trusted infrastructure providers, limited to the minimum necessary:

• Supabase — database hosting and user authentication.
• GreenAPI / Twilio — sending the actual WhatsApp messages (phone number and message content only).
• Stripe — payment and subscription processing.
• Anthropic / OpenAI — drafting recovery messages using AI (customer name, cart value, and message tone only — no payment details).

Each provider is bound by its own privacy and security policy, and is not permitted to use the information for any purpose other than providing the relevant service to us.

7. WhatsApp Business API & Messaging Data

Messages sent through the Service are delivered using the WhatsApp Business API, via GreenAPI or Twilio as our messaging providers, built on infrastructure operated by Meta Platforms, Inc. ("Meta"). When a message is sent to a lead, the recipient's phone number and the message content pass through Meta's infrastructure and are subject to Meta's own WhatsApp Business Policy and Privacy Policy, which are outside of our control. We recommend reviewing WhatsApp's own privacy policy for details on how Meta processes message data.

8. Cookies & Local Storage

The Service uses cookies and browser local storage for strictly necessary purposes: managing your login session, and remembering display preferences (such as dark/light mode, interface language, and display currency). We do not use advertising or cross-site tracking cookies. Session cookies are deleted or expire automatically when you log out or after a period of inactivity; local storage preferences remain on your device until you clear your browser data or change the preference again.

9. International Data Transfers

Our infrastructure providers (including Supabase, Stripe, and our AI and messaging providers) may process and store data on servers located outside your country of residence, including in the United States and the European Union. Where required by applicable law, we rely on appropriate safeguards for such transfers, such as standard contractual clauses or the provider's own certified compliance mechanisms.

10. Data Retention & Deletion

Information is retained for as long as your account is active. Upon account closure, you may request data deletion by contacting us; lead and proposal data will be deleted in accordance with your request, subject to any legally required retention period (for example, for accounting purposes).

11. Your Rights

Subject to applicable data protection law (including, where relevant, the GDPR), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or outdated data.
• Request deletion of your data ("right to be forgotten"), subject to legal limitations.
• Request a copy of your data in a portable, machine-readable format.
• Object to, or request restriction of, certain processing of your data.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection supervisory authority.

End customers ("leads") who wish to have their details removed are asked to contact the business they interacted with directly, as that business controls the relationship with its customer.

12. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify affected account holders without undue delay and in accordance with applicable law, and will take reasonable steps to assess and mitigate the impact.

13. Children's Privacy

The Service is intended for business use only and is not directed at, or intended for use by, individuals under the age of 18.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated "Last updated" date.

15. Contact Us

For questions or requests regarding your privacy, you may contact us through the contact details on our website or in the Service's settings page.