Privacy policy

Last updated: [DATE]

Template — legal review required before launch

This document is a starting template, not legal advice. Have qualified counsel adapt it to your company, jurisdictions, data flows and sub-processors before publishing it.

This policy explains how [COMPANY LEGAL NAME] ("LeadPilot", "we") collects and uses personal data when you use the LeadPilot AI service and website.

1. Roles

For account and billing data about our customers, we act as a controller. For lead data our customers store in LeadPilot (e.g. names and emails of their prospects), our customers are the controllers and we act as a processor on their instructions, under our Data Processing Addendum [LINK].

2. Data we collect

Account data: name, email, password hash (managed by our authentication provider), time zone.
Workspace content: leads, notes, tasks, appointments, forms, emails and settings you create.
Billing data: plan, subscription status and invoices. Card details are handled by Stripe; we never store card numbers.
Usage and security data: audit events, AI usage counts, hashed IP addresses for rate limiting and spam prevention.
Contact form submissions you send us.

3. How we use data

To provide, secure and support the service; to process payments; to send transactional emails.
To generate AI suggestions you request. Relevant workspace data is sent to our AI provider to produce the result. [STATE PROVIDER DATA-RETENTION/TRAINING TERMS.]
To comply with legal obligations and enforce our terms.

4. Legal bases (EEA/UK)

[Contract performance, legitimate interests, consent where required, legal obligation — tailor to your processing.]

5. Sub-processors

Supabase (database, authentication) — [REGION]
Vercel (hosting) — [REGION]
Stripe (payments)
Resend (email delivery)
Groq (AI processing)
Google (calendar sync, only for team members who connect a Google Calendar)

6. Retention

Deleted workspace records are retained for 30 days and then permanently purged. Hashed IP addresses on form submissions are cleared after 90 days. Account data is deleted when you delete your account, except where retention is legally required. [ADJUST.]

7. Your rights

You can access and export your data (Settings → Account / Data & privacy), correct it, and delete your account in the app. For other requests, contact us. You may lodge a complaint with your supervisory authority.

8. Email recipients of our customers

If you received an email sent through LeadPilot, the sender is our customer. Every follow-up email contains an unsubscribe link; unsubscribing adds your address to that sender's suppression list immediately.

9. International transfers

[Describe transfer mechanisms, e.g. Standard Contractual Clauses.]

10. Changes & contact

We will notify customers of material changes. Contact: [PRIVACY EMAIL], [POSTAL ADDRESS].