Privacy Policy

The service is operated by Lead Inbox. You can reach us about anything in this policy at info@lead-inbox.com.

Our role. For the accounts of people who sign up to Lead Inbox (our users) we act as the data controller. For the messages and contact details of the people who write to a business through a connected Instagram, Facebook or TikTok account, the business that connected the account is the controller and Lead Inbox processes that data on the business's behalf, only to provide the service to it.

Account and workspace data. Name, email address and password of users (passwords are stored only as a secure hash by our authentication provider), the workspace (business) name, team members and their roles, invitations, and workspace settings such as time zone, notification preferences and AI preferences.

Connected social accounts. When a business connects a Facebook Page, an Instagram professional account or a TikTok business account, we store the account's ID, name, username and profile picture, the permissions that were granted, and the access token issued by the platform. Access tokens are encrypted before they are stored and are never shown to anyone.

Messages and contacts. Messages that people send to a connected account and the replies the business sends, including the sender's platform user ID, name, username and profile picture where the platform provides them, the message text, links to attachments and timestamps. Recent conversations are imported when an account is connected and new ones arrive through the platforms' webhooks.

Lead information added by the business. Details a team adds to a lead: phone number, email, notes, tags, status, assignments and follow-up reminders.

AI results. If the business uses the AI features, we store the results: a conversation category, intent and sentiment, a short summary and suggested replies.

Technical data. A session cookie that keeps you signed in, and standard request logs (such as IP address, browser type and time of request) kept by our hosting providers for security and troubleshooting. We do not use advertising or analytics trackers.

• To provide the service: show conversations in the inbox, send the replies a user writes, keep lead records, reminders, notifications and reports.
• To run the AI features a business turns on: classify conversations, draft suggested replies and summarize leads. AI suggestions are never sent automatically; a person reviews and sends them.
• To keep the service secure, prevent abuse and fix problems.
• To contact users about their account and important changes to the service.

We do not sell personal data, we do not use it for advertising, and we do not use data obtained from Meta or TikTok for any purpose other than providing the service to the business that connected the account.

Where the EU/EEA or UK GDPR applies, we process account data to perform our contract with our users, and we process technical and security data on the basis of our legitimate interest in operating a secure service. Businesses are responsible for having a legal basis for the customer conversations they manage with Lead Inbox.

We use the following providers to run the service. They process data only on our instructions:

• Supabase: database and authentication. Data is stored in the European Union (Ireland).
• Vercel: application hosting. Our server functions run in the European Union (Dublin); static content is delivered through a global network.
• OpenAI: only when a business uses the AI features. We send the relevant conversation text and the business description to generate a result, with storage of the request disabled. Under OpenAI's API terms, this data is not used to train their models.
• Meta (Facebook, Instagram) and TikTok: to receive messages and send replies through their official APIs, as requested by the business that connected the account.

We may also disclose data if the law requires it. Some providers may process data outside the EU; in that case transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

• Account and workspace data: for as long as the account or workspace exists.
• Conversations, messages and leads: until the business deletes them or deletes its workspace.
• Access tokens: deleted as soon as a business disconnects the account.
• Webhook delivery logs (which can include message content): deleted automatically 30 days after they are processed.

Deleted data may remain in our providers' encrypted backups for a limited time before it is overwritten.

All traffic is encrypted in transit (HTTPS). Platform access tokens are encrypted at rest. Each business's data is isolated from other businesses at the database level, and access inside a workspace is limited by role (owner, admin, agent).

Depending on where you live, you can ask to access, correct, export or delete your personal data, and object to or restrict its processing. You can also complain to your data protection authority.

• Users can change their profile in Settings and delete data inside their workspace at any time.
• If you messaged a business that uses Lead Inbox, contact that business first; we will help them handle your request. You can also write to us at info@lead-inbox.com.

How to delete data, including data received from Facebook and Instagram, is described on our Data deletion page.

Lead Inbox is a tool for businesses and is not intended for children under 16.

We may update this policy. We will change the effective date above and, for significant changes, inform users by email or in the app.

Questions or requests about privacy: info@lead-inbox.com.