Privacy Policy

1. Information We Collect

We collect information you provide directly, including your name, email address, and payment information when you install the app on your Shopify store. Payment details are collected and held by Shopify, not by us.

If you connect a Shopify store, we also collect data from that store through your read-only Shopify integration, including customer profiles, order history, and browsing behavior. We use this data to generate the lead scores that make up the service.

We also collect technical data such as IP address, browser type, and pages visited, which we use to operate, secure, and improve the service.

2. How We Use Your Information

We use your information to provide and improve our AI lead generation services, process transactions, send you technical notices and support messages, and communicate with you about products, services, and promotions.

3. Sub-processors and Data Sharing

We do not sell your personal information. We share data with the following sub-processors, each under a contract that limits them to processing on our instructions:

• Vercel - application hosting and edge delivery
• Managed PostgreSQL provider - primary database storage
• OpenAI - generates lead scores from your store data
• Shopify - subscription billing. Shopify processes app subscription charges and collects your payment details directly; we never see or store your full card number.
• Upstash - rate limiting and caching
• Resend - transactional email delivery

If you connect a Shopify store, your store's customers are data subjects whose information we process on your behalf as a processor. You remain responsible for the lawfulness of your collection of that data and for the notices you provide to those customers.

4. Data Security

We implement appropriate security measures to protect your personal information, including TLS 1.3 in transit and AES-256 at rest. However, no method of transmission over the Internet is 100% secure. If you discover a vulnerability, please report it to support@leadup.business.

5. Your Rights

Where the GDPR or the CCPA/CPRA applies to you, you have the right to:

• Request access to a copy of the personal information we hold about you
• Request correction of inaccurate or incomplete personal information
• Request deletion of your personal information
• Request restriction of processing, or portability of your data to another provider
• Object to processing based on legitimate interests, and withdraw consent at any time
• Under the CCPA/CPRA, opt out of the sale or sharing of your personal information for cross-context behavioral advertising. We do not sell or share personal information in that sense, so there is nothing to opt out of.

You can export or delete your data from within the app using the account export and delete controls. To exercise any other right, email support@leadup.business.

We respond to verified requests within 30 days. You may also lodge a complaint with your local supervisory authority.

6. Cookies

We use a session cookie to keep you signed in and a small number of cookies to remember your interface preferences, such as light or dark mode. We do not use third-party advertising or cross-site tracking cookies. You can instruct your browser to refuse cookies, though some features of the service may not function properly without them.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. We will also retain your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

8. International Transfers

Some of our sub-processors are located outside your jurisdiction, so your information may be transferred to and maintained on servers elsewhere. Where the GDPR applies, transfers outside the EEA or UK are made under an adequacy decision or the European Commission's Standard Contractual Clauses.

9. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@leadup.business.