Privacy Policy

1. Scope and our privacy roles

This policy applies to leadhold.co, the LeadHold web application, and the services described here. It does not replace the separate SMS Privacy Notice for LeadHold's business-owner new-lead notification program.

LeadHold is designed for service businesses (each, a "Business Customer"). People who call or message a Business Customer are referred to here as "Callers." Depending on the information and context:

• Kaitoi determines why and how account, billing, website, security, support, and service-operation information is processed.
• A Business Customer generally determines why LeadHold processes the Caller and lead information submitted to that customer's account. For that information, Kaitoi generally acts as a service provider or processor on the Business Customer's instructions, while also processing limited information for security, abuse prevention, compliance, and reliable operation.

If you are a Caller seeking access to or deletion of information held for a Business Customer, contacting that business directly is usually the fastest route. We will assist the business with a valid request when required.

2. Information we process

Website, contact, and support information

We process information you submit through our website or support channels, such as your name, business name, email address or phone number, and the contents of your question or message.

Account and authentication information

We process names, business names and locations, email addresses, password hashes, account roles, session and refresh-token records, Google sign-in identifiers when you choose Google authentication, password-reset and single-use sign-in token records, and account-security events. We do not store plaintext account passwords.

Business configuration and phone information

We process business descriptions, greetings, AI receptionist settings, notification preferences, owner phone numbers and verification status, provisioned LeadHold numbers, call-forwarding and webhook configuration, and consent or suppression records needed for enabled communications.

Calls, messages, leads, and AI-generated information

Depending on how a Business Customer configures and uses LeadHold, we may process Caller and called phone numbers, provider call and message identifiers, call timing and status, live call audio, voicemail audio, optional call recordings where specifically enabled, transcripts, SMS or web-message contents, and information a Caller provides such as name, contact details, requested service, timing, urgency, budget, address or location, and other free-form details. LeadHold may generate summaries, classifications, suggested follow-up details, duplicate-lead assessments, and other inferences from this information.

Billing and subscription information

Our payment provider processes payment-card and bank information. LeadHold receives and stores related customer, subscription, price, checkout, invoice, and payment-status identifiers. We do not receive or store full payment-card numbers.

Technical, security, and usage information

We process IP address, browser and device type, operating system, requested URLs, timestamps, request and event identifiers, authentication and error events, application logs, service health and performance data, provider usage, and estimated provider costs. We do not use a precise-location SDK; location information may still be supplied by a user or inferred at a general level from a phone number, IP address, or business setting.

3. Sources of information

We obtain information:

• directly from account holders, authorized users, Callers, and website visitors;
• from a Business Customer's configuration and instructions;
• automatically from browsers, devices, calls, messages, and use of LeadHold;
• from service providers such as telephony, AI, payment, authentication, email, hosting, storage, crawling, and monitoring providers; and
• from public business websites when a Business Customer asks LeadHold to analyze one.

4. How we use information

We use information to:

• create and secure accounts and authenticate authorized users;
• receive and route calls, operate the AI receptionist or voicemail flow, create leads, transcribe and summarize conversations, and present results to the correct Business Customer;
• send enabled account, lead, service, security, and billing communications;
• provision and manage phone numbers and verify owner phone possession;
• process subscriptions, trials, invoices, cancellations, and account changes;
• provide support and respond to privacy or legal requests;
• detect spam, fraud, abuse, security incidents, and service failures;
• measure provider usage and costs and improve service reliability and features;
• enforce our agreements and comply with law; and
• create aggregated or de-identified information that does not reasonably identify a person.

5. Artificial intelligence, calls, and recordings

When the AI receptionist is enabled, LeadHold and its providers process call audio in real time so the assistant can respond. The assistant is configured to identify itself as an AI receptionist. LeadHold may transcribe the call and use AI models to create a lead summary and structured lead details. AI output can be incomplete, inaccurate, or misclassified and should be reviewed by the Business Customer before relying on it.

If a call reaches voicemail, the voicemail is recorded for processing. Live AI audio is processed even when optional full-call recording is off. Optional full-call recording is not generally enabled and, where made available, is controlled separately by LeadHold administrators and Business Customer configuration. A Business Customer is responsible for using call handling, transcription, and any recording features in accordance with applicable notice and consent laws.

6. How we disclose information

We may disclose information in the following circumstances:

• To the relevant Business Customer. Leads, messages, transcripts, and related information are made available only to authorized users of the Business Customer for which they were collected.
• To service providers. We use providers for cloud hosting, database and object storage, caching and queues, telephony and messaging, AI and transcription, email, payment processing, authentication, website analysis, logging, error monitoring, and security. Current providers include Fly.io, Upstash, Tigris, Twilio, OpenAI, Resend, Stripe, Google, Firecrawl, and Sentry. They process information under their agreements with us and may maintain their own required records.
• For legal and safety reasons. We may disclose information when we reasonably believe disclosure is required by law, legal process, or to protect rights, safety, security, and service integrity.
• In a business transaction. Information may be disclosed in connection with financing, due diligence, a merger, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.
• At your direction. We may disclose information when an authorized Business Customer asks us to or when you otherwise consent.

A limited number of authorized personnel may access information when needed for support, security, abuse review, legal compliance, or service operation.

7. No sale, targeted advertising, or promotional use of mobile consent

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use advertising pixels to target ads based on activity across unrelated services. We do not disclose mobile phone numbers or text-message opt-in data and consent for third-party or affiliate marketing or promotional purposes.

8. Cookies and browser storage

LeadHold uses browser storage and similar technology needed to operate the service, including local storage for access and refresh tokens, theme and interface preferences, and other functional state. Providers involved in authentication, payment, security, and embedded service flows may set their own necessary cookies. We do not currently use third-party advertising cookies or behavioral advertising trackers.

9. Retention and deletion

Retention depends on the type of information, the Business Customer's account, legal and security needs, provider obligations, and whether information is needed to establish, exercise, or defend claims.

• LeadHold's recurring retention process is configured to delete stored voicemail and optional call-recording audio from LeadHold-controlled object storage after 90 days. Transcripts, extracted lead details, messages, and related event records may remain after the audio is deleted.
• Lead and account information is generally retained while the Business Customer uses LeadHold and for a reasonable period afterward. Deleting a lead in ordinary product flows first soft-deletes it; it is not an immediate erasure from all systems.
• Consent, opt-out, security, billing, fraud-prevention, and audit records may be retained longer where needed to honor choices, prevent abuse, comply with law, or document transactions.
• Backups, logs, and provider-held copies may persist for their ordinary rotation or legally required periods and are not always deleted immediately.

Account cancellation stops future renewal but does not by itself immediately delete account data. Contact us to request account deletion or to ask about a specific record.

10. Security

We use administrative, technical, and organizational measures designed to protect information, including access controls, tenant-scoped authorization, transport encryption, credential hashing, provider webhook validation, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Account holders are responsible for protecting their credentials, devices, forwarding configuration, and access granted to staff.

11. Choices and privacy rights

Depending on where you live and applicable law, you may have rights to:

• request access to or a copy of personal information;
• request correction or deletion;
• request information about categories, sources, purposes, and disclosures;
• object to or restrict certain processing;
• withdraw consent where processing depends on consent; and
• appeal a decision or complain to a privacy regulator.

To make a request, email privacy@leadhold.co. We may need to verify your identity and authority. If the information is controlled by a Business Customer, we may direct the request to that customer or work with the customer to respond. We will not discriminate against you for exercising an applicable privacy right.

Account holders can change many settings in LeadHold. For owner new-lead SMS notifications, reply STOP or disable SMS in authenticated settings. Email is managed separately.

12. California privacy disclosures

The table below describes categories of personal information we may have collected in the preceding 12 months. Whether a particular California law applies can depend on the context and our role for the information.

We use sensitive personal information only as reasonably necessary to provide, secure, maintain, and comply with law for the service, not to infer personal characteristics for advertising. Because we do not sell or share personal information for cross-context behavioral advertising, there is no separate sale/share opt-out link. If our practices change, we will process recognized Global Privacy Control signals where required by applicable law.

California residents may make the requests described in Section 11. An authorized agent may submit a request, but we may require proof of authority and verification of the resident's identity.

13. Children

LeadHold is a business service and is not directed to children under 13. We do not knowingly create accounts for children. A Business Customer's callers may include minors; the Business Customer is responsible for configuring and using LeadHold appropriately for its audience. If you believe a child has provided personal information improperly, contact us.

14. Processing in the United States

Kaitoi is based in the United States, and LeadHold and its providers process information in the United States and other locations where they operate. Data protection laws in those locations may differ from those where you live.

15. Changes to this policy

We may update this policy as LeadHold changes. We will post the revised policy and update the date above. When required, we will provide additional notice or obtain consent. Material changes to the owner SMS program will be addressed in that program's separate notice and consent flow.

16. Contact us

For general product support, email support@leadhold.co.