Privacy Policy

• We collect what we need to run the service: your email, workspace data, lead data you add, payment info (handled by Stripe), and product analytics.
• We never sell your data. We never share lead data with third parties for marketing.
• We use a small set of sub-processors (Supabase, Stripe, Vercel, PostHog, ImprovMX) listed below.
• You can export or delete your data at any time. Email support@leadsorted.com and we'll handle it within 30 days.

Account information. When you sign up we collect your email address, password (hashed via Supabase Auth, never stored in plaintext), and your name if you provide one. If you sign in with Google or another OAuth provider, we receive your email and basic profile info from them.

Workspace and lead data. Data you enter into the app — workspace names, lead names, contact details, notes, statuses, follow-up dates, and any files or CSVs you import. This data belongs to you. We process it on your behalf to provide the service.

Payment information. We do not store credit card numbers. Stripe handles all card data and we receive only a customer ID, subscription status, and the last 4 digits of your card for display purposes.

Usage data. Page views, clicks, and feature usage — used to understand what's working and to debug issues. Captured by PostHog. Session recordings have all input fields masked (passwords and credit cards are never recorded).

Support correspondence. If you email us or submit a bug report, we keep that thread so we can follow up.

• Provide the service. Authenticate you, store your leads, deliver follow-up reminders, and run the features you signed up for.
• Bill you. Process payments, prevent fraud, and send receipts via Stripe.
• Improve the product. Aggregate usage analytics to learn which features matter and where users get stuck. We never use your lead data for this — only your own interactions with the app interface.
• Communicate with you. Send transactional emails (welcome, billing, security), reply to support tickets, and occasionally announce features or pricing changes.
• Comply with the law. Respond to legitimate legal requests when we're required to.

We use the following companies to run Lead Sorted. Each one processes a specific slice of your data on our behalf, under their own privacy and security commitments. We don't sell data to anyone.

We use cookies and local storage for two purposes:

• Essential. Keeping you signed in (session token), remembering your workspace, and protecting against CSRF attacks. Without these, the app doesn't work.
• Analytics. PostHog drops a cookie/local-storage entry to measure usage and group repeat visits. You can opt out by enabling Do Not Track in your browser, or by emailing us to request opt-out.

We do not use third-party advertising cookies, retargeting pixels, or social media tracking pixels.

• While your account is active: we keep your data so the service works.
• If you delete a workspace: the leads, notes, and history in it are deleted from our database immediately. Encrypted backups are purged within 30 days.
• If you delete your account: we remove your personal information within 30 days. We may keep limited records (invoices, account history) for up to 7 years to meet tax and accounting obligations.
• Analytics data: raw events are retained for up to 12 months in PostHog.

Depending on where you live (GDPR for the EU/UK, CCPA for California, PIPEDA for Canada), you have the right to:

• Access the personal information we hold about you.
• Correct anything that's wrong.
• Export your workspace data in a portable format.
• Delete your account and the personal info we hold.
• Object to or restrict certain processing.
• Withdraw consent for marketing communications at any time.

To exercise any of these, email support@leadsorted.com. We'll respond within 30 days. We don't require you to use any specific form — just tell us what you want.

We use industry-standard security practices:

• All traffic is encrypted in transit via TLS 1.2+.
• Database is encrypted at rest. Authentication uses bcrypt password hashing via Supabase Auth.
• Row-level security policies enforce that you can only access your own workspace's data.
• We follow the principle of least privilege internally — only authorized personnel can access production systems.

No system is 100% secure. If you discover a vulnerability, please email support@leadsorted.com and we'll respond promptly.

Lead Sorted is built for businesses. We do not knowingly collect information from anyone under 16. If you believe a minor has signed up, contact us and we'll delete the account.

Our infrastructure is hosted primarily in the United States. If you're using Lead Sorted from outside the US, your data will be transferred there for processing. We rely on standard contractual clauses where required by EU/UK law.

We'll update this policy when we add features, change sub-processors, or when the law requires it. Material changes will be announced by email at least 30 days before they take effect. Minor edits (typo fixes, clarifications) get a quiet update with a new effective date.

For privacy questions, data requests, or anything else legal:

support@leadsorted.com

Mailing address for legal and privacy notices:

Lead Sorted is operated by Nexora Unity LLC, a Delaware limited liability company. By using the service, you agree to our Terms of Service.