1. Roles and scope
LeadPending acts as a service provider for customer-submitted lead data and for the view records of documents a customer shares. The customer determines why that data is collected and must provide any notice or legal basis required on its website or to the people it shares documents with.
2. Data we process
We process account and security data needed to provide access, configure organizations, and protect sessions. We also process connected-site settings and inbound lead content.
- Account identity, email, authentication and security events.
- Site name, domain, sender profile, response context, locale, and API-key prefix.
- Lead name, email, optional phone and company, message, source page, locale, and customer-defined metadata.
- Visitor context a customer's site chooses to send with a lead: IP address, user agent, referrer and landing page, country, campaign parameters (UTM, gclid, fbclid), a site-computed browser fingerprint, and the visitor's page-by-page path through the site. What is sent is decided by the customer's own site.
- Email thread content, draft revisions, delivery state, bounce or complaint events, and suppression records. Mail that reaches a lead's reply address or a site's sending address but cannot be tied to a lead with certainty is kept as text only, for the customer to attach to a lead or discard, and is deleted after 30 days in any case.
- For an optional Telegram connection: Telegram user and private-chat numeric identifiers, username and display name, binding status, and delivery and security audit records. The new-lead alert sent to the linked chat carries the lead's contact details and message, so an operator can answer from their phone; an operator may also reply from Telegram, and that reply is still explicitly sent by a person.
- Documents a customer uploads, any recipient details it enters for a document link, and the record of every view of a shared document, described in section 5.
- Operational telemetry such as provider status, duration, token usage, and audit events.
3. How data is used
We use data to receive and display leads, prepare an operator-requested draft, send an explicitly approved reply, receive responses, show a customer how a document it shared was viewed, enforce plan limits, prevent abuse, support customers, and operate the service. Lead content and documents are not used to train a general LeadPending model.
4. Open tracking
A reply sent from LeadPending may carry a 1x1 image loaded from t.leadpending.com. When the recipient's email client loads it, we record the time, IP address, user agent and referer against that reply, and nothing else. It tells the operator whether the reply was read; it is never used to profile the recipient or shared with anyone else.
Mail providers, privacy proxies and security scanners fetch remote images without a person reading anything. Those fetches are recorded but classified and excluded from the count an operator sees. Links in a reply are never rewritten, clicks in email are not tracked, and the plain-text part of a reply is never altered. Document views, described in section 5, are recorded only when someone opens a document link.
A customer can switch open tracking off for its organization, after which its replies carry no image. Tracking records are deleted with the lead they belong to.
5. Document views
A customer can share a PDF through LeadPending Documents, as a personal or public link on view.leadpending.com or embedded on the customer's own website. When someone opens it, we record for the customer who shared it: the time, IP address, user agent and device, approximate location (country, region, city and time zone), the network the visit came from, browser language, time zone and screen size, the website the document was embedded on, and how it was read (reading time, pages viewed, downloads, printing, copying and links clicked inside the document).
The viewer sets no cookies and loads nothing from third parties. It keeps a random browser identifier in local storage so a repeat visit can be told from a new one. Link previews, mail security scanners and automated browsers are recorded but classified as robots and not counted as people, and the customer's own views are not counted either. When a person opens the document, the customer may get a Telegram message about the visit.
The customer decides who receives each link and is responsible for any notice its recipients need. Raw viewing events are kept for 180 days; view records are kept while the document exists and are deleted with it.
6. Service providers
Only the data required for a specific operation is sent to the relevant provider. This may include an OpenAI-compatible AI provider for draft generation and for turning an instruction an operator speaks — in the cabinet or as a Telegram voice note — into text; the recording is not kept, only its text, as the instruction of the draft it produces. It also includes AWS SES and related AWS services for email transport and inbound parsing, VeriMail for address validation, Telegram for an optional new-lead alert, carrying the lead’s contact details and message, and for document-view alerts in a linked private chat, a DNS-based IP-to-network lookup service, which receives the IP address of a document view, and infrastructure or observability providers for secure operation. Web search is not used for draft generation.
7. Retention and deletion
Messages and account data are retained while needed to provide the service and meet security or legal obligations. Deleting a site or account begins a 30-day recovery window before hard deletion, except where a longer period is required by law, dispute preservation, fraud prevention, or backup lifecycle. Deleting a document stops its links at once; its files and view records are then deleted after the same recovery window.
8. Security
Site API keys are stored as one-way hashes and the full secret is displayed only when created. Sessions use opaque random tokens. Access checks scope customer data to its organization, and provider callbacks are authenticated and deduplicated. No online service can promise absolute security.
9. International processing and rights
Providers may process data in countries outside your own. Where applicable, you may request access, correction, deletion, restriction, or portability. Leads should direct data requests to the organization that collected the request, and document recipients to the organization that shared the document; we assist customers with valid requests.
10. Changes and contact
We may update this policy as the service changes and will publish the revised date here. Privacy questions can be sent to [email protected].