Privacy Policy

1. Who We Are

LeadProof (“we”, “us”, “our”) is a service operated by DIGITALFACTORY2026 LLC, a Florida limited liability company. We provide an AI-powered call quality auditing platform for insurance agencies. Our service is accessible at leadproof.app. For privacy-related questions, contact us at privacy@leadproof.app.

2. What Data We Collect

• Account data: Name, email, organization name, and role (admin, agent, or caller).
• Call recordings:Audio files uploaded by your organization for quality auditing. These files are stored securely in your organization's isolated storage bucket.
• Transcriptions and AI scores: Text transcriptions and quality scores generated by our AI pipeline from uploaded recordings.
• Usage data: Log data, page views, and feature usage for product improvement (via PostHog analytics, anonymized).
• Integration credentials: OAuth tokens for connected platforms (e.g., Zoom). Stored encrypted and never logged.

3. How We Use Your Data

• To provide the call auditing and scoring service your organization subscribed to.
• To generate AI transcriptions and quality scores from uploaded recordings.
• To display performance metrics, leaderboards, and coaching insights to authorized users.
• To send operational notifications (e.g., weekly performance reports).
• To monitor and improve the reliability and quality of the Service using aggregated, anonymized operational metrics. We do not use your call recordings, transcripts, or scores to train or fine-tune AI models.

4. Data Isolation and Security

LeadProof is a multi-tenant platform. Each organization's data is strictly isolated via Row-Level Security (RLS) policies at the database level. An agent from Organization A cannot access any data from Organization B under any circumstances.

PII protection: Agent names and phone numbers are accessible only to admin-role users. Agent-role users cannot query, export, or view lead PII — this is enforced at the database level, not only in the UI.

All data is stored on Supabase (PostgreSQL) with encryption at rest and in transit. Audio files are stored in Supabase Storage with signed URLs that expire after 5 minutes.

5. Data Retention

While your account is active:call recordings, transcriptions, and audit results are retained according to your plan's retention tier (see our Security page for tier details), so your historical archive stays available to you for as long as you remain a customer.

Upon termination: you have a 30-day window to export your data, and within those same 30 days we delete the recordings, transcriptions, and audit results belonging to your organization — the commitment in section 12 of our Terms. A failed payment is not a termination: while your account is open, your data stays where it is.

We would rather be precise about how that deletion happens than let you assume it. We run it — it is not a timer that fires on its own. Every purge is previewed before it executes, verified after: it re-counts every table and your recording storage and reports itself as unclean if anything survives, and the result is written to an audit log. You may also request deletion at any time, before or after termination, at privacy@leadproof.app.

6. Third-Party Services

We share data with the following service providers, solely to operate the Service. Each provider processes only the minimum data required for its function, and all of them process data in the United States. This is the complete list; it is also published on our Security page, and the two are kept in step deliberately.

• Zoom:Call source. With your administrator's authorization we read your Zoom Phone directory and download the recordings you have already chosen to make. We never create, modify, or delete anything in your Zoom account.
• Deepgram: Audio transcription. Recordings are sent to Deepgram for transcription and are not retained by them beyond processing.
• Anthropic (Claude):Primary AI quality scoring. Transcription text (not audio) is sent to Anthropic's API for compliance scoring. Anthropic does not train its models on data submitted through its commercial API.
• OpenAI (failover): Secondary AI scoring provider, used only if the primary provider is unavailable. Transcription text (not audio) is sent with data retention disabled; OpenAI does not train on your data.
• Supabase: Database, authentication, and file storage provider. All data resides in United States data centers (AWS us-west-2) with encryption at rest and in transit.
• Vercel: Application hosting. No user data is stored at the edge layer.
• Resend:Transactional email delivery. Receives the recipient's address and the message body, which may quote excerpts of a call transcript in the coaching note. It also delivers our authentication emails (password reset, invitation, sign-in link), for which it receives the user's address and a single-use link token.
• Sentry: Error monitoring. Captures technical error data (stack traces, browser info) to help us fix bugs. No call content or PII is included in error reports.
• PostHog: Product analytics. Collects anonymized usage events only — no recording content, transcriptions, or PII is sent to PostHog.
• Upstash: Rate limiting. Request counters keyed by organization. No call content.
• Stripe: Billing. Payment data only. No call content.

7. Cookies and Tracking

LeadProof uses the following types of cookies and tracking technologies:

• Essential cookies: Required for authentication and session management (Supabase Auth). These cannot be disabled.
• Analytics cookies: PostHog sets cookies to track anonymized usage patterns (page views, feature usage). No personal information or call content is tracked.

We do not use advertising cookies or sell tracking data to third parties.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. To exercise these rights, contact privacy@leadproof.app from the email address associated with your account. We will respond within 30 days.

Data portability:You may request an export of your organization's data (account info, call metadata, transcriptions, and scores) in a machine-readable format at any time.

Note on call recordings: Call recordings may contain personal data of third parties (callers, leads). Your organization is responsible for obtaining consent from all parties recorded, in accordance with applicable laws (e.g., TCPA, state wiretapping laws).

9. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

• Right to know: You may request details about the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions (e.g., data needed to complete a transaction or comply with legal obligations).
• Right to non-discrimination: We will not deny you service, charge different prices, or provide a different quality of service because you exercised your CCPA rights.
• No sale of personal information: LeadProof does not sell personal information to third parties, as defined under the CCPA.

To submit a CCPA request, email privacy@leadproof.appwith the subject line “CCPA Request.” We will verify your identity before processing any request.

Our role. For purposes of the CCPA, the Texas Data Privacy and Security Act (TDPSA), and the Oregon Consumer Privacy Act (OCPA), your organization is the Business or Controller and LeadProof acts solely as a Service Provider or Processor. We process personal information only to provide the Service under your documented instructions, and we never sell or share it, use it for cross-context behavioral advertising, combine it with personal information from other sources, or use it to train or improve AI models across our customer base.

10. Children's Privacy

LeadProof is a business-to-business service and is not intended for use by individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this policy as our service evolves. We will notify active subscribers by email at least 14 days before material changes take effect. Continued use of LeadProof after the effective date constitutes acceptance of the updated policy.

12. Contact

Questions about this policy? Email privacy@leadproof.app.