Privacy Policy — LeadRecover

LeadRecover is a lead-response and business-management platform for local service businesses, operated by Angel Calderon ("we," "us," or "our"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you.

This policy covers two groups of people: (1) LeadRecover customers — businesses and their team members who create an account and use the dashboard, and (2) leads — the visitors and potential customers of a LeadRecover customer's own website who interact with that business's AI assistant or submit an inquiry.

1. Information We Collect

Account information (customers). When you create a LeadRecover account, we collect your full name, business email address, and password. Passwords are handled by our authentication provider, Supabase Auth, and are never stored by us in plain text.

Authentication cookies. When you log in, our authentication provider (Supabase Auth) sets a session cookie in your browser so you stay signed in between requests. This cookie is required for the account area of LeadRecover to function and is not used for advertising or cross-site tracking.

Business profile information (customers). During onboarding and in Settings, we collect the business name, phone number, business email, website URL, main service city, service areas, list of services offered, and business hours. You may also provide a business description and custom instructions that configure how your AI assistant responds — this content is used as context for the AI assistant. Per Anthropic's own published API data-use policy, this content is not used to train Anthropic's models; this reflects Anthropic's current stated practice, not an independent guarantee we can enforce ourselves.

Lead and conversation information (leads). When a visitor submits a form or chats with a business's AI assistant, we collect the information they provide — typically name, phone number, email address, the service requested, and the full content of the conversation. This information is stored on behalf of, and is visible to, the LeadRecover customer whose website or widget the visitor interacted with.

Billing information. Subscription payments are processed by Stripe. We never receive or store full payment card numbers. We store only what Stripe provides back to us: a Stripe customer identifier, subscription identifier and status, the package purchased, and billing amounts/dates.

Notification preferences. If you enable lead-alert emails, we store the notification email address you provide and use it to send those alerts.

Referral information. If you sign up using a referral link, we record the referral code (via a browser cookie that expires after 30 days) to attribute the signup to the referring sales representative.

Technical and abuse-prevention information. Our public endpoints (lead submission and the embeddable chat widget) process the requesting IP address to enforce rate limits and prevent abuse. This is used transiently in a time-windowed rate-limit check and is not compiled into a profile of any individual.

Widget session identifiers. The embeddable website widget uses a hashed, time-limited session token to keep a visitor's conversation connected to the correct lead record. We store only the hash of this token, not a value that can be used outside our own systems.

2. How We Use Information

To provide, operate, and maintain the LeadRecover platform.
To power the AI assistant: lead/visitor messages and the business's configured context (services, hours, policies, business description) are sent to our AI provider, Anthropic, solely to generate a reply for that conversation.
To process payments, manage subscriptions, and send billing-related communications.
To send account emails (such as password reset) and, where enabled, lead-alert notification emails.
To detect, prevent, and respond to fraud, abuse, and security issues.
To comply with legal obligations.

3. Who We Share Information With

We do not sell personal information. We share information only with the service providers ("sub-processors") that are necessary to operate LeadRecover, and only for that purpose:

Stripe — payment processing, subscription billing, and the customer billing portal. Stripe receives payment details directly from you; we never receive your full card number.
Supabase — our database and authentication provider. All account, business, lead, and conversation data described above is stored in Supabase-hosted infrastructure.
Anthropic — the AI provider whose Claude models generate the AI assistant's replies, using the lead conversation and business-configured context described above.
Resend — our transactional email provider, used to send lead-alert notification emails to a business's configured notification address.
Vercel — our hosting provider, which serves the application and processes web request logs as part of running the service.
Twilio — an SMS provider integrated into LeadRecover's infrastructure for a future SMS feature. This feature is not enabled at this time, and no lead or customer phone number is sent to Twilio while it remains disabled. This policy will be updated before that feature is turned on.

We may also disclose information if required by law, or to protect our rights, property, or safety, or that of our customers or others.

4. Data Security

We use database-level row security so that each LeadRecover customer can only access their own business's data. All traffic to LeadRecover is encrypted in transit (HTTPS). Payment data is handled directly by Stripe under its own PCI-compliant infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Data Retention

We retain account, business, and lead data for as long as your account is active, and for a reasonable period afterward as needed to comply with legal, accounting, or billing-record obligations. You may request deletion of your account and associated data as described in Section 6.

6. Your Choices and Rights

You can review and update most of your business's information directly in Settings. To request access to, correction of, or deletion of your personal information, or to ask any question about this policy, contact us at leadrecoveraiofficial@gmail.com. These requests are currently reviewed and completed manually by our team — we do not yet offer an automated self-service deletion tool. Depending on where you live, you may have additional rights under local law (for example, the GDPR in the European Economic Area or the CCPA in California); we will honor requests to the extent required by applicable law.

7. Children's Privacy

LeadRecover is a business tool. We do not direct it to, and do not knowingly collect personal information from, children under 13.

8. International Users

The LeadRecover platform is operated from the United States by Angel Calderon. If you access LeadRecover from outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do. Material changes will be communicated through the LeadRecover dashboard or by email.

10. Contact Us

Angel Calderon, operator of the LeadRecover platform
Email: leadrecoveraiofficial@gmail.com
Governed by the laws of Colorado, without regard to its conflict-of-laws principles.