Privacy Policy

Last updated: November 3, 2026

Who we are. LeadsCoda is the product; LeadsCoda LLC is the registered company behind it. Based in Atlanta, GA, US. Contact privacy@leadscoda.com.

LeadsCoda is a follow-up CRM. Businesses use it to store their leads, send automated email and SMS follow-up, run ad campaigns, and track their pipeline. This policy explains what data we collect, how we use it, and the choices you have. We have tried to write it in plain English. If anything is unclear, email us at privacy@leadscoda.com and a human will answer.

Two kinds of data, two roles

There are two distinct categories of personal data in LeadsCoda, and we play a different role for each. First, there is data about you, our customer: your account email, your name, your workspace settings and content, and billing details processed by Stripe. For this data, LeadsCoda is the controller and this policy governs directly.

Second, there is data our customers store about their own leads: the names, email addresses, phone numbers, notes, and message history of the people a business is following up with. For this data, the customer is the controller and LeadsCoda is a processor acting on the customer's instructions. If you are a lead whose information appears in a LeadsCoda workspace, the business that added you is responsible for that data, and requests about it should go to them first. We help our customers honor those requests, and our Data Processing Agreement describes our obligations as a processor in detail.

Data we collect from you

When you create an account we collect your email address, your name, and the name of your business or workspace. Everything you put into your workspace, such as leads, sequences, templates, and messages, is stored so we can provide the service. If you subscribe to a paid plan, payment is handled by Stripe; we receive confirmation of payment and the last four digits of your card, but full card numbers never touch our servers.

Data from Facebook and Instagram

If you connect your Facebook Page to LeadsCoda, we receive the contact details people submit in your Facebook or Instagram lead forms, such as their name, email address and phone number, along with the ad, ad set, campaign and form that each inquiry came from. We also read the list of Pages you administer, so that you can choose which one to connect, and the name of the Page you choose.

We use this only to create leads in your own workspace, to follow them up on your behalf, and to report which of your ads produced booked work. We do not sell it, use it for our own advertising, or combine it with data from other customers. We only ever read from a Page you have connected yourself.

You can disconnect at any time from Settings, which removes our access and deletes the stored access token. Leads already in your workspace remain yours and can be deleted from within the product or by writing to privacy@leadscoda.com. If you remove LeadsCoda from your Facebook account, Meta notifies us and we disconnect the integration and delete the token automatically; you can check the status of such a request at leadscoda.com/data-deletion.

Data from your calendar

If you connect a Google or Outlook calendar to LeadsCoda, we read the times you are busy so the booking page cannot offer a slot you are already in, and so your own calendar screen shows the whole day rather than only the part LeadsCoda booked.

We read times only. The permission we ask for returns the start and end of a busy period and nothing else, so we never receive the title of a meeting, who is attending it, or anything written in it. That is the permission we ask for on purpose: connecting a calendar to a follow-up product should not hand that product the contents of your meetings.

If you also turn on writing bookings back, we create events on the calendar you name for bookings made in LeadsCoda, which sends that booking's title, time and notes to Google or Microsoft. Canceling or moving a booking removes or rewrites the event we created. We never read, change or delete an event we did not create.

You can disconnect at any time from Settings, which removes our access and deletes the stored tokens. LeadsCoda's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Files you import from Google Drive

Starting November 10, 2026, you can import a Google Doc or Sheet into LeadsCoda straight from Google, as this section describes.

When you choose a Google Doc or Sheet to import with Choose from Google Drive, Google asks you to let LeadsCoda open the files you pick, and only those: the permission is Google's drive.file, which never shows LeadsCoda anything else in your Drive. Your browser loads Google's picker from Google, downloads the file you picked, and sends it to LeadsCoda to read for the import you started. The permission stays in your browser while the page is open; it is never sent to LeadsCoda's servers and never stored.

If you paste a link instead, LeadsCoda's server asks Google for that one file, as anyone with the link could, and only a file shared with anyone who has the link can be read that way. Either way the file is read once, for that import, and is not kept: what is kept is what you choose to import, like any other import. LeadsCoda's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The customer portal

A business can give each of its customers a private page, the customer portal, opened from a link the business sends. The messages a customer and the business exchange there, the photos and documents either of them shares, and any orders the customer places are stored in that business's workspace with the rest of its records about that customer, so both sides can see the conversation. As with other lead data, the business is the controller and LeadsCoda is the processor, and the business can delete it.

If the business has switched on AI features, the AI may read a customer's portal messages to suggest or send a reply, and may look at photos a customer sends to write a short description for the business's team. The portal sets a cookie on the customer's device to keep them signed in to their page and, where the business asks for a code on new devices, a second cookie that remembers a device already confirmed. These cookies are used only for signing in.

Where a business charges saved cards for weekly orders, a customer can save a card from their portal to pay for their weekly order. The card is entered on Stripe's own page and kept by Stripe on the business's own Stripe account. LeadsCoda stores only the card's brand, last four digits and expiry date, and the words the customer agreed to and when, so the business can show what each charge was authorized by. The customer can remove the card from their portal at any time.

Data we collect automatically

Like most web services, we keep server logs that include IP addresses, request times, and error details, and we record basic device and browser information so we can debug problems and keep the service secure. We use cookies only for session authentication, that is, to keep you signed in. We do not use advertising or cross-site tracking cookies, and we do not embed third-party ad trackers on the product.

How we use data

We use your data to provide and improve the service, to send transactional email such as receipts, alerts, and account notices, and to respond to support requests. We never sell personal data, yours or your leads', to anyone. We never use the lead data our customers store in LeadsCoda for advertising, profiling, or any purpose other than running the service for that customer.

Message consent and opt-outs

LeadsCoda is built around consent-based messaging. The product records email and SMS consent per lead, so your workspace keeps a record of who agreed to be contacted and how. Marketing emails sent through LeadsCoda include an unsubscribe link that we enforce automatically, and SMS messages honor STOP replies: when a lead texts STOP, we mark them as opted out and block further messages to that number from your workspace. Customers remain responsible for having lawful consent for the people they message, as described in our Terms of Service.

If you give us, or a business using LeadsCoda, your mobile number and agree to receive text messages, message frequency varies and message and data rates may apply. You can opt out at any time by replying STOP, or reply HELP for help. We do not share or sell your mobile number, or your SMS opt-in and consent, with third parties or affiliates for their own marketing or promotional purposes.

Subprocessors

We rely on a small set of vendors to run LeadsCoda, each for a specific purpose: Vercel hosts the application and stores uploaded files, Neon hosts our database, Resend delivers email, Twilio delivers SMS, Stripe processes payments, Anthropic powers AI drafting and lead summaries, OpenAI transcribes voice notes and generates images, Mapbox estimates drive times from a business's address to its customer's when live tracking is used, Geoapify plans delivery routes and works out road travel times and directions from customers' and the business's delivery addresses and stop coordinates, the US Census Bureau places lead, job and property addresses on the map (it receives the address only, never a name, a phone number or our own ids), OpenFreeMap sends map tiles to the browser of whoever views a map (it sees their IP address, their browser and the area of the map being viewed, never names or addresses), Upstash counts requests for rate limiting, Cloudflare screens signups for bots, Expo delivers mobile push notifications, Meta Platforms is used to sync lead ads when you connect a Meta account, and Google and Microsoft receive calendar data when you connect a Google or Outlook calendar. Each vendor that offers one is bound by a data processing agreement. The US Census Bureau and OpenFreeMap are public services that offer none, which is why they receive only what is described above. We maintain the current list with details on our Security page. We give notice before adding a new subprocessor that handles customer lead data.

Retention and deletion

We keep your data for as long as your account is active. You can export your workspace data at any time: the workspace owner can download all of it from Settings, Billing as one file of spreadsheets. You can ask us to delete your account and everything in it by emailing privacy@leadscoda.com. Deletion requests are honored promptly, and deleted data rolls out of our encrypted backups within 35 days.

Your rights under GDPR

If you are in the European Union, the United Kingdom, or another region with similar laws, you have the right to access the personal data we hold about you, to correct it, to have it erased, to receive a portable copy, and to object to certain processing. Our legal bases for processing your account data are performance of our contract with you and our legitimate interest in operating and securing the service. To exercise any of these rights, contact privacy@leadscoda.com. If you believe we have not resolved your concern, you may also lodge a complaint with your local supervisory authority.

Your rights under CCPA

If you are a California resident, you have the right to know what personal information we collect about you, the right to request its deletion, and the right not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. Requests can be sent to privacy@leadscoda.com.

Security

All traffic to and from LeadsCoda is encrypted in transit with TLS, and data is encrypted at rest in our database and backups. Sensitive credentials, such as the API keys you connect for messaging providers, receive an additional layer of application-level encryption so they are never stored in plaintext. You can read more on our Security page, and you can report a vulnerability or concern to security@leadscoda.com.

Children

LeadsCoda is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@leadscoda.com and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make a material change, we will update the date at the top of this page and notify account owners by email before the change takes effect. Continued use of the service after that date means you accept the updated policy.

Contact

Questions about privacy at LeadsCoda can be sent to privacy@leadscoda.com. For security matters, use security@leadscoda.com. We aim to respond to every request within a few business days.