Legal

Privacy Policy

Last updated: June 23, 2026

1. Information We Collect

We collect information you provide directly and information generated through your use of our service.

a. Information You Provide

• Contact information: name, email address, phone number, and company name
• Lead data: information about your potential customers (leads) submitted via our webhooks, including any notes, source, or status data you include
• Account information: when you create an account, you provide a company name, email, and password

b. Information Collected Automatically

• Usage data: how you interact with our platform (pages visited, features used, actions taken)
• Device and log data: IP address, browser type, operating system, and referring URLs
• Communication data: content of messages sent and received through our AI agent (inbound inquiries and AI-generated responses)

2. How We Use Your Information

We use your information to provide, improve, and secure our AI lead response service. Specifically, we use your data to:

• Receive and process inbound leads via phone calls and webhooks
• Route, qualify, and respond to leads using our AI agent
• Schedule appointments on your behalf based on your calendar integration
• Send you notifications about lead activity, appointments, and account status
• Improve our AI models and service performance (on anonymized, aggregated data only)
• Detect and prevent fraud, abuse, or security threats

We do not sell your personal information.

3. How We Share Your Information

We share your data only in the following circumstances:

a. GoHighLevel Integration

We transmit lead data to GoHighLevel (GHL) via webhook when you have connected your GHL account. This integration is opt-in only — you choose which leads are shared and can disconnect at any time. We are not responsible for how GoHighLevel uses your data once shared; please review their privacy policy.

b. Service Providers

We share data with vendors who provide infrastructure, hosting, analytics, and AI processing services under strict data processing agreements. These providers may not use your data for their own purposes.

c. Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, safety, or the public.

d. Business Transfers

If LeadReply is acquired or merged, your information may transfer to the acquiring entity under the same privacy commitments.

4. User Rights

You have rights over your personal data. To exercise any of these, email admin@leadreply.org.

a. Access

You may request a copy of all personal data we hold about you, including lead data, account records, and communication logs.

b. Correction

You may request that we correct inaccurate or incomplete personal data.

c. Deletion (Right to Erasure)

You may request deletion of your account and all associated personal data. We will delete your data within 30 days, subject to any legal retention requirements.

d. Portability

You may request your data in a machine-readable format (JSON or CSV).

e. Objection / Restriction

You may object to or request restriction of certain processing activities.

f. Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

g. Non-Discrimination

We will not discriminate against you for exercising any privacy rights.

5. Data Retention

Advisor accounts are retained until you request deletion. We keep:

• Account data: until account deletion is requested
• Lead communications: up to 2 years for service quality and compliance purposes
• Analytics data: anonymized and aggregated after 12 months
• Audit logs: 1 year for security purposes

When you request deletion, all personal data is removed within 30 days. Some data may be retained longer if required by law.

6. Cookies and Tracking

We use cookies and similar technologies as follows:

a. Essential Cookies

Required for authentication and security. These cannot be disabled without losing access to your account.

b. Analytics Cookies

We use anonymized session analytics to understand how users interact with our platform. This data is aggregated and cannot be used to identify you.

c. UTM Tracking

We store UTM source/medium/campaign parameters from marketing links to measure campaign effectiveness. This data is stored for 90 days.

d. Third-Party Cookies

We do not use third-party advertising or tracking cookies. We do not respond to Do Not Track signals.

7. Security Measures

We implement the following technical and organizational safeguards:

• Encryption in transit: All data transmitted to and from our platform is encrypted using TLS 1.2+
• Encryption at rest: All stored personal data is encrypted at rest
• Access controls: Role-based access controls limit employee access to data on a need-to-know basis
• Audit logging: All data access and modifications are logged
• Vulnerability management: Regular security reviews and dependency updates
• Data minimization: We collect only what is necessary for the stated purpose

While we take reasonable measures, no system is 100% secure. In the event of a data breach, we will notify affected users within 72 hours in accordance with applicable law.

8. Children's Privacy

Our service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children.

9. International Data Transfers

LeadReply is based in the United States. If you are located in the EU or other jurisdictions, your data may be transferred to and processed in the US. Where required, we use Standard Contractual Clauses (SCCs) to ensure adequate protection.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. For significant changes, we will send a notification to your registered email address.

11. California Residents — CCPA Notice

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for which we collect it, and whether it has been sold or shared
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out: You may opt out of the sale or sharing of your personal information
• Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

We do not sell or share personal information for cross-context behavioral advertising. To exercise your rights, contact us at admin@leadreply.org. You may also designate an authorized agent to make requests on your behalf.

Shine the Light Law: California residents may also request information about whether we have disclosed your personal information to third parties for their direct marketing purposes. To make such a request, contact us at the address below.

12. Contact Us