Privacy Policy

This website

What we collect. When you submit our contact form, we collect the details you provide, such as your name, work email, company, website and message, so we can respond to your inquiry and, if you become a customer, deliver the service.

Attribution. This site stores a small record in your browser (localStorage) noting how you found us, for example a campaign tag in the link you clicked. It contains no personal details and is used only to understand which marketing channels work. It expires automatically.

Analytics. We use Google Analytics to understand how visitors use this website (pages viewed, general location, device type). We do not send names, email addresses, or form contents to analytics. Google Analytics applies to visits to this website only and does not receive Google user data described below. You can block analytics cookies in your browser or with common opt-out tools.

Client portal and service data

Accounts and security records. If you use the client portal, we hold the account details needed to run it: your name, email address, username, company, and a hashed (not readable) password. We also keep security records of sign-in events, which include IP addresses.

Portal usage. We record when you sign in and out, which dashboards you open and how you use them (for example, changing a date range), and an approximate city and country worked out from your IP address at sign-in using a database stored on our own server. We do not store the IP address with this usage information and we do not send it to a third party for this purpose. We use this information to keep the portal secure, to understand how it is used, and to support you.

Your reporting data. When we work on your reporting systems, we access only the data needed to deliver the service, treat it as confidential, and you retain ownership of your data and reporting assets.

Google user data

This section describes how AndLeads accesses, uses, stores, keeps and shares information that we receive from Google APIs ("Google user data"). It applies in addition to the rest of this policy.

How Google is connected

AndLeads connects to Google using Google's OAuth 2.0 authorization. The connection is made by an authorized AndLeads team member who has been given access to the Reporting area, who signs in to the AndLeads platform and approves Google's consent screen for a Google account that has access to the spreadsheets being reported on. Clients who only view their dashboards in the client portal are not asked to connect a Google account and do not grant Google permissions through the portal. Before the administrator is sent to Google, the AndLeads screen shows a notice that points to this policy.

Permissions we request

AndLeads requests only the following Google permissions (OAuth scopes):

AndLeads does not request access to Google Drive, Gmail, Google Contacts or Google Calendar. AndLeads does not request access to the files in your Google Drive as a whole: a team member adds a spreadsheet by choosing it in the Google file picker, and the permission above then covers only the files chosen this way. AndLeads does not request the broad Google Sheets permission, and it does not use a pasted link or file ID to reach any spreadsheet that was not chosen in the picker. Google may word or group these permissions differently on its consent screen.

How we use Google user data

• Connect the account and choose a spreadsheet. To identify the connected account, and to read the title, worksheet names, column headings and rows of the spreadsheet a team member chooses in the Google file picker while a dataset is set up.
• Refresh reporting data. To read the selected worksheet again, manually or on the schedule an administrator sets, so dashboards and reports reflect the current spreadsheet.
• Provide the reporting you asked for. To show dashboards, KPIs and reports built from that data to the client who owns it and to AndLeads staff who build and maintain them.
• Troubleshoot, secure and maintain the integration. To keep records of each refresh (time, number of rows read, warnings, errors and column headings that changed) and of connection events.

We use Google user data only for these purposes. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

Storage, retention and deletion

• Authorization tokens. After you approve access, Google gives AndLeads an access token and a refresh token. They are stored in AndLeads' database encrypted with AES-256-GCM. The encryption key is kept in the server's configuration file, separate from the database. Tokens are decrypted only on the server when AndLeads contacts Google and are never sent to your browser.
• Spreadsheet data. AndLeads copies the spreadsheet data it needs into its own database: the worksheet columns an administrator enables (up to 100,000 rows per worksheet), together with the spreadsheet's name and ID, the worksheet name, the column headings and the connected account's email address. The copy is rebuilt on every refresh, so it reflects the spreadsheet as of the last refresh. This is stored data, not a temporary cache. It is protected by access controls, encrypted connections and our hosting provider's measures described under Security, and is not separately encrypted inside the database.
• How long we keep it. We keep the stored copy while the dataset is part of the reporting service for that client. Disconnecting Google stops refreshing the data, and dashboards keep showing what was last copied until the dataset is removed. Removing a dataset takes it out of reporting, but neither step by itself erases the stored copy. We delete the stored copy when you ask us to (see Your controls for Google data).
• When Google is disconnected in AndLeads. The stored tokens are deleted from our database and refreshing stops. AndLeads does not send a revocation request to Google at that moment, so the permission stays listed in your Google Account until you remove it there.
• When a chosen spreadsheet is removed in AndLeads. AndLeads stops refreshing it and no longer opens it. Data already copied stays stored as described above until it is deleted. Google keeps its own record of the files you chose until you remove AndLeads in your Google Account.
• When you revoke access in your Google Account. AndLeads can no longer read new data. The next refresh fails, the connection is marked as needing to be reconnected, and nothing new is read. Data already copied stays stored as described above until it is deleted.
• Closing a client account. Ending service does not automatically erase stored spreadsheet data. Ask us to delete it when service ends.
• Backups. Routine server backups made by our hosting provider may continue to hold copies of stored data for a limited time after deletion.

Sharing and disclosure

We do not sell Google user data and we do not share it for advertising. Google user data is available only to:

• The client it belongs to. Authorized users of that client's company see the dashboards and reports built from their data in the client portal. If an organization uses several companies in AndLeads, authorized administrators of a parent company can see reports for its sub-companies.
• Authorized AndLeads personnel, as needed to set up, maintain, secure and support the service.
• Our hosting provider (Namecheap), which stores AndLeads' database and files on our behalf as infrastructure, under its own terms. Its staff may have technical access to the servers.

We do not send Google user data to analytics, advertising, artificial intelligence or other third-party services. We may disclose information if required by law, or where necessary to protect the security of the service and its users.

Google API Services User Data Policy and Limited Use

In line with those requirements:

• We use Google user data only to provide and improve the user-facing reporting features described in this policy.
• We do not transfer Google user data to others except as needed to provide those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after notice to affected users.
• We do not use or transfer Google user data to serve advertisements, including retargeting, personalized or interest-based advertising.
• We do not allow people to read Google user data unless we have the relevant user's consent, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and used for internal operations. Because AndLeads provides a managed reporting service, our personnel access the data you ask us to report on as part of providing that service.

Your controls for Google data

• Disconnect. Ask us to disconnect your Google account, or, if you have administrator access to the AndLeads platform, use Disconnect on the Data Sources screen. This deletes the stored tokens and stops refreshing.
• Revoke access in Google. You can remove AndLeads at any time at myaccount.google.com/permissions by choosing AndLeads and selecting to remove access.
• Delete stored data. Contact us through the contact page, tell us which spreadsheet, dataset or client it concerns, and we will delete the stored copy.
• Questions. Contact us at any time using the details under Contact.

Security

Connections to Google and to the AndLeads platform use HTTPS. Authorization tokens are encrypted as described above and kept on the server. Each Google sign-in request carries a single-use security value tied to the administrator's session to guard against forged requests. Portal users sign in with individual accounts, passwords are stored hashed, and each client user can only see the data of the companies they are authorized for. Two-step verification is available for AndLeads staff accounts, which are the accounts that connect Google. Connection events are logged. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Use, retention and your rights

How we use information. To respond to inquiries, provide and improve the service, and manage the customer relationship. We do not sell your information.

Retention. We keep inquiry and customer records for as long as needed to provide the service and meet legitimate business or legal requirements. Retention of Google user data is described above.

Your choices. You may request access to, correction of, or deletion of your personal information at any time through the contact page.

Changes

We may update this policy. The current version is always published on this page, and the date at the top shows when it was last changed. If we change how we use Google user data, we will update the Google user data sections accordingly before the change takes effect.

Contact

For privacy questions or requests, including requests about Google user data, contact AndLeads through our contact page (https://andleads.com/contact).