How LeadsaholicOS collects, processes, and safeguards data for the agency clients and end-customers who use our AI sales agent operating system.
We collect information in three ways: (1) form submissions — when a visitor fills out the Book a Demo form at /book, we store the name, email, phone number, and business name they provide so a LeadsaholicOS team member can follow up. (2) analytics events — every page view posts a small payload (path, referrer, UTM parameters) to /api/analytics/track, used to understand traffic sources and improve the marketing site. (3) synced CRM and web data — once an agency client connects their stack to the platform (lead inbox, scheduling system, missed-call carrier, website forms), the AI agent processes inbound messages and the contact records they reference to deliver the contracted service — respond to leads, qualify them, and book appointments.
We use the information we collect to: (a) respond to inbound leads on behalf of the customer — the AI agent drafts replies, asks qualifying questions, and books appointments into the client's scheduling system; (b) operate and improve the performance dashboard at /dashboard — response times, conversion rates, per-lead revenue, and health scores visible to the client; and (c) troubleshoot, prevent abuse, and maintain service integrity — rate-limit suspicious traffic, investigate support tickets, and audit agent behavior.
Under data-protection frameworks such as the GDPR, the parties to data processing are split by role. The agency client (the service-business operator onboarding onto the platform, or the sales-agent agency operating on their behalf) is the data controller for end-customer personal data flowing through their CRM and web properties — they determine the purposes and means of processing that data. LeadsaholicOS acts as the data processor on their behalf, processing end-customer data solely to deliver the contracted service (responding to leads, booking appointments, syncing records). Our use of controller-supplied data is governed by our Data Processing Addendum, available on request to privacy@leadsaholicos.com.
Application data is stored in a managed PostgreSQL database hosted on Neon (a serverless Postgres provider). Records are retained for the lifetime of the client's active subscription and for a reasonable wind-down window after cancellation. On account closure, client-controlled data is exported to the former client on request and then deleted from production systems within 30 days. Backups follow Neon's standard retention policy. Demo-request submissions from /book are retained for up to 18 months for sales follow-up unless the prospect requests earlier deletion.
We share data only with vetted sub-processors who help us run the service, and we list them here so customers can perform their own diligence:
Neon — managed Postgres database host (regional replication, encryption at rest). Polsia — analytics beacon already injected on the public landing page; collects page-view and visitor-id data for aggregate traffic reporting. OpenAI — AI model inference used by the AI agent to draft replies and qualify leads (only when the connected client has inference enabled; no audio or telephony content is sent to OpenAI). Stripe — payment processing for the monthly subscription (currently via Stripe Connect payment links through Polsia; native billing may ship in a future release). We do not sell personal data. We do not share data with advertisers or third-party data brokers.
We use a small number of cookies and browser-storage items, all first-party: ab_hero_variant — a sticky cookie that remembers which homepage hero variant a visitor was assigned for the A/B test (set to expire after 30 days). polsia_vid — a localStorage UUID generated by the analytics beacon to dedupe page views within a session. We do not place advertising cookies. We do not use third-party tracking pixels.
Data is transmitted over TLS (HTTPS) in transit. At rest, data is encrypted by Neon using AES-256 on the underlying storage volume. Session cookies are flagged HttpOnly to prevent client-side script access. Access to production data is restricted to a small number of operators with documented justification and audit logging. We will notify affected clients without undue delay in the event of a personal-data breach affecting their data.
If you submitted a demo request, you can request access to, correction of, or deletion of your record at any time by emailing privacy@leadsaholicos.com. If you are an end-customer whose data is being processed by the AI agent on behalf of one of our agency clients, please contact that business directly — they are the data controller for your data and can route a request to us through their account. We support data portability for client records on termination (see the Termination section of our Terms of Service).
We will post material changes to this policy on this page and update the “Last updated” date below. Non-material changes (clarifications, typo fixes) may be made without notice. For significant changes that affect our processing of your personal data, we will provide reasonable advance notice by email where we have it on file.
Last updated: 2026-07-26