Privacy

Two kinds of data

For the enquiries people send to a business, the business decides what happens to them and we handle them on its behalf: we are its processor. For the accounts of businesses using NeatLeads, and their billing, we are the controller.

We do not sell data, and we do not use it for advertising. We email the people who write to a business only on that business’s behalf: its replies, and the thank-you and the link for missing details when the business switches them on.

Your customers’ enquiries. We use them only to sort and show your enquiries. We never sell them, and the AI we use doesn’t train on them.

What we keep

About a business that uses NeatLeads:

• The email address you sign in with, those of anyone you invite to your business, and your name if you give it.
• The devices you are signed in on (such as "Chrome on macOS") and the IP address each last used.
• The IP address recorded when an address is locked out after too many sign-in tries, and when someone changes the email a business’s enquiries are forwarded to.
• Your business name, your forms, topics, rules and settings.
• If you give us your website during setup, we read a few of its public pages.
• Your plan and whether it is paid. Card details are typed into Stripe’s own page and never reach us.

About a person who sends an enquiry:

• What they sent: their name and email address, what they wrote, the form’s answers and any files.
• A copy of the original email as it arrived.
• What NeatLeads made of it: whether it looks like a real customer, its topic, how sure it was, and whether it was forwarded to the business.

If a business’s form sends them, we also keep the page address, referrer and campaign tags (utm, gclid, fbclid) that came with an enquiry, for that business’s own reports later. They are deleted with the enquiry.

A business’s Always let through and Always filter out lists can contain a person’s email address. The people in a business can see that business’s enquiries, and no other business can.

How the AI is used

NeatLeads uses AI to:

• sort each enquiry and say how sure it is;
• draft replies and follow-ups;
• read your website during setup;
• read photos sent with an enquiry, on Pro;
• read documents you upload about your business.

When an enquiry arrives, NeatLeads may send it to Google’s Gemini model to decide whether it is from a real customer and which topic it fits. We send the subject, what they wrote and the form’s answers, cut to about 4,000 characters, with the business’s name and what it has told us about the work it wants. Numbers that look like card or US Social Security numbers are replaced with [redacted] first. Files attached to an enquiry may be sent too, so it can read them.

We use Gemini’s paid tier. Google does not use enquiries to train or improve its models. It keeps them for a limited time, only to detect abuse and for legal reasons. See Google’s Gemini API terms.

The AI cannot send email or change anything. It returns an answer and our code decides. If it cannot decide, or gives no answer, the enquiry is let through to the business.

Who else handles data

These companies run parts of NeatLeads for us:

• Supabase: our database, sign-in and stored files.
• Vercel: runs the app.
• Amazon Web Services (AWS), in the United States (Northern Virginia): Amazon SES, which takes in enquiries and sends our emails, such as forwarded enquiries and sign-in codes, and Amazon S3, which keeps each email SES takes in until we have stored it.
• Google (Gemini): sorts enquiries, as described above.
• Meilisearch (Meili SAS), in the United States (New York): keeps a copy of each enquiry’s text so you can search your enquiries — the customer’s name, email address, phone number and company, the subject, and about the first 4,000 characters of what they wrote and the form’s answers. Files are never sent. When an enquiry is deleted, its copy is deleted too. Meilisearch may not use this data for any other purpose.
• Inngest: runs our background jobs.
• Upstash: short-lived records that limit how often things can be tried, such as sign-in.
• Stripe: billing and payment.
• Sentry: reports errors. Email addresses and what people wrote are stripped from reports, and screens are not recorded.
• Better Stack: checks that the app is up. It is sent no enquiries.

Where it lives

Our database and stored files are in the United States (Northern Virginia), and the search copy of enquiries is in the United States (New York). The companies above may process data in the countries where they operate.

How long we keep it

Enquiries in Filtered out are deleted after 30 days. Other enquiries, their files and the copies of the original emails are kept until they are deleted on request, or until 30 days after a business closes its account.

Some things are removed on a schedule:

• An account that asked for a sign-in code and never used it, after 7 days.
• A record that an email address was locked out after too many sign-in tries, after 90 days.
• Copies of emails taken in through Amazon SES and kept in Amazon S3. Each copy is deleted once we’ve processed the email, and in any case within about a week.
• An email that comes in through Amazon SES for an address we don’t recognise is kept for about a week for error recovery and then deleted.

Our database provider also keeps backups, which age out on its own schedule.

What you can ask us to do

You can ask us what we keep about you, for a copy of it, or to delete it. This applies to business users and to people who sent an enquiry. If you sent an enquiry, ask that business first, because it decides what happens to it.

Today we handle these requests by hand. For someone who sent an enquiry, we delete their records: their enquiries and the emails in them, list entries and sign-in records, and with them the search copy of those enquiries. We then remove the files and original emails stored with those enquiries. We cannot reach copies already forwarded to a business’s own email, which are that business’s to delete.

Closing a business user’s account, or deleting a whole business and everything it keeps, is also done by hand on request. There is no button for any of this in the app yet, and no download of your data yet.

Send these requests, and any complaint about how we handle your data, to privacy@neatleads.app. If you have a NeatLeads account, write from the address you sign in with.

Cookies

NeatLeads uses only the cookies needed to sign you in and keep you signed in. There are no advertising or analytics cookies.

Your browser also keeps a copy of what you see in NeatLeads, such as enquiries, settings and replies you are writing, along with preferences like light or dark theme. That copy stays on the device until you sign out of NeatLeads there, so on a shared computer, sign out when you finish.

Forwarded enquiries and our alerts do not track whether they are opened or their links clicked.

Contact

For a copy of your data, an export, deleting it, or a complaint, write to privacy@neatleads.app. For anything else, write to hello@neatleads.app.