Privacy Policy

1. Introduction

LeadFocus AI respects your privacy and is committed to handling personal information responsibly. This policy explains how our platform collects, uses, stores, shares, retains and protects personal information.

We handle two kinds of information: (1) information about our registered users — the agents and agencies who hold accounts — and (2) prospect and client information that those users upload or create in their workspace. Different rules apply to each, as explained below.

2. Information We Collect

Account information: name, email address, phone number, agency name, professional details you choose to add (such as title, license number, National Producer Number, licensed states, products sold and profile photo), and login and authentication information.

CRM and prospect information: contact names, phone numbers, email addresses, lead sources, notes, tags, appointments, sales pipeline activity and communication history.

Communication information: SMS content and metadata, email communications, calling activity and call outcomes, communication preferences, and consent and opt-out records. LeadFocus AI does not currently record or transcribe calls; if that feature is added, this policy will be updated before it is enabled.

Technical information: IP address, device and browser information, login activity and security logs collected by our hosting and authentication infrastructure, and information stored in your browser as described in the Cookies section.

Billing information: subscription plan, billing history, payment status and payment processor identifiers. Payment card details are handled by our payment processor; LeadFocus AI does not store full card numbers. Online checkout is not yet active.

Public booking and lead forms: when a visitor books an appointment or submits a form on an agent's page, we collect the name, phone number, email and any message they provide, on behalf of that agent.

3. How Information Is Used

We process personal information to:

• Provide CRM services
• Authenticate users
• Manage subscriptions
• Support communication services
• Maintain contact records
• Execute automation workflows you authorize
• Schedule appointments
• Provide customer support
• Generate analytics for your own workspace
• Prevent fraud
• Maintain security
• Comply with legal obligations

4. AI Data Processing

When you use AI features, the information you authorize may be processed to:

• Draft messages
• Summarize conversations
• Suggest follow-up actions
• Assist with scheduling
• Generate campaign content
• Support CRM workflows

AI requests are sent through the Lovable AI Gateway to large language model providers, such as Google (Gemini) and OpenAI. Only the information needed for the request you make is sent. Processing, retention and training practices are governed by those providers' terms. We do not make a zero-retention or no-training claim at this time.

AI output is always a draft that you review before use.

5. Customer Data Ownership

Agencies and users keep their rights in the business and contact information they lawfully upload. LeadFocus AI processes this information only to deliver the services you subscribe to.

For prospect and client data, our business customer (the agency) decides why and how the data is used and is responsible for having a lawful basis and any required consent. LeadFocus AI acts as a service provider (processor) to that agency. For our own users' account information, LeadFocus AI determines how it is processed.

Each agency's records are kept separate from every other agency's at the database level, and access within an agency depends on each user's assigned role.

6. Third-Party Service Providers

We share information with service providers only as needed to deliver the features you use. Our current providers are:

• Cloud hosting and database infrastructure: Lovable Cloud (built on Supabase) and Cloudflare
• AI services: Lovable AI Gateway, routing to model providers such as Google and OpenAI
• Telephony and SMS: Twilio
• Sign-in: Lovable Cloud authentication (including Google sign-in where enabled)

Email delivery, payment processing and calendar integrations are not yet connected. When they are, the provider will be listed here before the feature is enabled. We do not sell customer data to data brokers.

7. SMS and Call Data

Phone numbers, message content, call metadata and delivery status may be processed through our telecommunications provider (Twilio) to place calls and send or receive messages you request. Call outcomes and notes you log are stored in your workspace. We do not currently record or transcribe calls.

Mobile opt-in information and consent collected for SMS communications will not be shared with third parties or affiliates for their own marketing or promotional purposes. Information may be shared with service providers as necessary to deliver the messaging services requested.

8. Data Security

We use measures that include:

• Role-based access controls and user permissions
• Password and single sign-on authentication
• Encrypted transmission (HTTPS/TLS)
• Encryption at rest provided by our hosting infrastructure
• Database-level separation between agencies
• Audit logging of important account and record changes
• Private file storage restricted to your agency
• Provider credentials kept on the server, never in the browser

No system is completely secure. We do not claim any independent security certification at this time.

9. Data Retention

Active account information is kept while your account is open. CRM records, messages and appointments are kept until you or your agency delete them, or until the account is closed. Call recordings are not created. Audit logs are kept as long as needed for security and compliance review. Billing records are kept as long as tax and accounting laws require.

When an account is deleted, we delete or de-identify its data within a reasonable period, except where the law requires us to keep it. Copies in backups may persist until those backups expire on their normal schedule.

10. Privacy Rights

Depending on where you live, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion
• Obtain a copy of your information
• Opt out where applicable
• Withdraw consent where processing is based on consent

Registered users can edit their profile and records directly in the portal. To make a privacy request, contact us using the details in the Contact section. If you are a prospect or client of an agent who uses LeadFocus AI, please contact that agent or agency first; we will assist them in responding. We will verify your identity before acting and will not discriminate against you for exercising your rights.

11. California Privacy Disclosures

If you are a California resident, the California Consumer Privacy Act as amended (CCPA/CPRA) may give you the rights listed above, plus the right to know the categories of personal information collected, the sources, the purposes, and the categories of recipients.

In the past 12 months we collected the categories described in Section 2 (identifiers, commercial information, internet activity, professional information and communication content) from users directly, from their devices, and from records users upload. We disclose them to the service providers listed in Section 6 for business purposes.

We do not sell personal information and do not share it for cross-context behavioral advertising, based on our current practices (no advertising or tracking tools are installed). For prospect data uploaded by agencies, we act as a service provider and process it only on the agency's instructions.

12. Cookies and Analytics

The website uses only essential browser storage: sign-in session data needed to keep you logged in, and preferences such as the light/dark display setting. We do not currently use advertising cookies or third-party marketing trackers. Our hosting provider may collect basic visit statistics. If we add analytics or marketing tools, we will update this policy and provide consent controls where legally required.

13. Children's Privacy

LeadFocus AI is intended for professional users aged 18 and older and is not directed to children. We do not knowingly collect personal information from children.

14. International Data

LeadFocus AI is operated from the United States and is intended for U.S. insurance professionals. Our infrastructure and providers may process data in the United States and other countries where they operate, under their own safeguards.

15. Data Breach Response

We maintain processes for investigating security incidents. If an incident affects your personal information, we will notify affected users and authorities when and as required by applicable law.

16. Policy Updates

We may update this policy. For material changes we will notify users by email or inside the platform before the changes take effect, and update the effective and last-updated dates at the top of this page.

17. Contact