Privacy Policy
This Privacy Policy explains how personal data is collected, used and protected in connection with the LeadSignal platform ("LeadSignal", the "Service"), operated by LEAD SIGNAL AI TECHNOLOGIES LIMITED, a company registered in England & Wales, Company No. 17361862 ("LeadSignal", "we", "us"). It covers both visitors to our website and people whose data is processed through LeadSignal on behalf of our clients.
1. Who we are
LeadSignal is operated by LEAD SIGNAL AI TECHNOLOGIES LIMITED, a company registered in England & Wales, Company No. 17361862, with its HQ at Imperial Place, 4 Maxwell Rd, Borehamwood, Herts, WD6 1JN. For personal data processed through the Service on behalf of a client, that client is the data controller and we act as a data processor. For our own website and business contacts, we are the controller. You can reach us at our support assistant.
2. Data we process
| Category | Examples |
|---|---|
| Lead & conversation data | Instagram, Facebook and LinkedIn DM content captured via connected tools, names, usernames, email addresses, phone numbers, traffic source and attribution details. |
| Meta Platform data (optional) | Where you connect a Facebook Page and Instagram Professional account: comments on your own posts, commenter usernames, and post/media identifiers; your Page list during connection; where messaging is enabled, direct messages sent to your connected account, the sender's public profile name and username, and message delivery/read status; and, where publishing is enabled, the posts you schedule through LeadSignal. See section 8. |
| LinkedIn data (optional) | Where you connect LinkedIn: your profile identity for the connection; posts you publish through LeadSignal; and, where you authorise your ad account: campaign performance data, Lead Gen Form submissions, and member verification status. See section 9. |
| YouTube data (optional) | Where you connect a YouTube channel: public comment text and comment IDs, commenter display names, and video and channel identifiers and titles. See section 7. |
| CRM & booking data | Contact records, appointment and pipeline events, and deal outcomes synced from GoHighLevel or HubSpot. |
| Derived data | AI-generated lead scores, tiers, summaries and suggested replies. |
| Account & usage data | User names, email logins, authentication data, and technical logs needed to run and secure the Service. |
3. How we use data
- To provide the Service — ingesting conversations, scoring and prioritising leads, and reporting on attribution.
- To generate AI insights and, where a client enables it, draft suggested replies.
- To authenticate users and keep the Service secure.
- To communicate with clients about setup, support and billing.
- To comply with legal obligations.
4. Legal bases
Where we act as controller, we rely on legitimate interests (operating and improving our business and website), performance of a contract, consent (where required, e.g. certain communications), and compliance with legal obligations. Where we act as processor, we process data under our client's instructions and their agreement with us.
5. AI processing
Lead scoring and reply suggestions are produced using AI models. Conversation content is sent to our AI provider solely to generate this output for the relevant client. We do not use client conversation data to train third-party foundation models.
6. Sharing and sub-processors
We share data only as needed to run the Service, including with:
- hosting and database infrastructure providers;
- the AI model provider used for scoring and drafting;
- connected platforms you authorise (ManyChat, GoHighLevel, HubSpot, Calendly, Meta Platforms where you connect Facebook/Instagram, LinkedIn where you connect it, and Google/YouTube where you enable the YouTube funnel);
- email delivery and payment processing providers;
- authorities where required by law.
We require sub-processors to protect personal data under appropriate contractual terms.
7. Google user data (Gmail, Calendar and YouTube)
LeadSignal offers several optional connections to your Google account — a Gmail or Google Workspace mailbox, your Google Calendar, and a YouTube comment funnel. Each is connected by signing in with Google and granting access through Google's own consent screen, each is entirely optional, and you can decline or disconnect any of them at any time without affecting LeadSignal's core lead scoring.
Gmail / Google Workspace mailbox. If you connect a mailbox, LeadSignal requests the gmail.send and gmail.readonly scopes so that it can:
- send email on your behalf from your own mailbox (for example a reply to a lead, or a nurture message you have configured), so those messages come from you and replies return to you;
- read incoming email so that a reply from a lead is logged against the matching contact in your CRM, keeping a conversation started by email in one place.
We store the metadata and content of messages that relate to your leads and contacts (sender, recipient, subject, timestamp and body) so they can be shown on the contact's timeline. We do not read, store or index mail unrelated to your CRM activity, and we do not access your Google contacts, Drive or any Google data beyond the scopes you approve.
Google Calendar. If you connect a calendar, LeadSignal requests the calendar.events scope so it can read your availability — so a lead booking a call never double-books you — and write a confirmed booking onto the calendar you actually keep. We do not read the content of unrelated calendar events beyond the busy/free times needed to offer accurate availability.
YouTube comment funnel. When the YouTube funnel is enabled, LeadSignal uses the YouTube API Services to:
- read comments left on videos on your connected channel, so commenters who mention your keyword can become scored leads in your pipeline;
- read basic channel and video metadata (titles, IDs, publish dates), so each lead can be attributed to the video that produced it;
- post replies from your channel to those comments, where you have configured an automatic reply.
We store the comment text, the commenter's public YouTube display name and comment ID, and the associated video and channel identifiers. We do not access your private videos, your subscriber list, your analytics, or any Google data beyond the scopes you approve.
Limited Use. LeadSignal's use and transfer of information received from Google APIs — including Gmail message content, Google Calendar data and YouTube data — adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use this data solely to provide and improve the user-facing features you have enabled. We do not sell Google user data, we do not use it for advertising, and we do not use it to train generalised or machine-learning models. We do not allow humans to read your Gmail or other Google user data except: with your explicit consent for a specific message; where necessary for security purposes such as investigating abuse; to comply with applicable law; or where the data has been aggregated and anonymised. Where we send content to our AI provider — for example to draft a reply or summarise a conversation for your own account, as described in section 5 — it is processed only to deliver that feature to you and is not used to train the provider's models.
By using the YouTube funnel you are also agreeing to the YouTube Terms of Service, and Google's own handling of your data is governed by the Google Privacy Policy.
You can disconnect any Google connection — mailbox, calendar or YouTube channel — at any time from the Integrations settings inside LeadSignal. Disconnecting immediately deletes the stored Google refresh token and stops all further access. You can also revoke LeadSignal's access directly at Google's security settings page. Records already created in your CRM — leads from YouTube comments, or email logged onto a contact — remain in your own pipeline so your reporting stays intact; they are retained under section 9 and are deleted on request to our support assistant or when your account is closed.
8. Meta Platform data (Facebook & Instagram)
LeadSignal offers an optional connection to Meta Platforms via Facebook Login for Business. You connect your own Facebook Page and its linked Instagram Professional account through Meta's consent dialog; connecting is entirely optional and you can disconnect at any time from the Integrations settings.
Comment capture. When enabled, LeadSignal reads comments on the connected account's own posts (via the permissions instagram_basic, instagram_manage_comments, pages_show_list, pages_read_engagement and business_management) so that commenters become scored leads in the connected business's own pipeline. We store the comment text, the commenter's public username, and the post identifier for attribution. We only read comments — we do not reply to, hide or delete them — and we only access the account you connected.
Messaging. Where messaging permissions are enabled (instagram_manage_messages, pages_messaging), LeadSignal receives the direct messages sent to your connected Instagram account or Facebook Page and sends replies on your behalf — replies you send yourself, and AI-assisted replies under the controls you configure (including a drafts-only mode where nothing sends without a person's approval). For each conversation we store the message content, the sender's channel identifier, and — where Meta makes it available — the sender's public profile name and username, together with delivery and read status so your team can see whether a message was seen. Replies respect Meta's messaging window rules; where a human team member replies after the standard window, the message is sent under Meta's Human Agent provision and only ever as a human-initiated reply. The permission pages_manage_metadata is used solely to subscribe your connected Page to these message and comment events — it is what lets Meta deliver them to us.
Publishing. Where publishing permissions are enabled (instagram_content_publish, pages_manage_posts), LeadSignal publishes only the posts you compose and approve in the platform, to the Page and Instagram account you connected. We never post without your action or schedule.
Deletion. Disconnecting stops all further access immediately. We honour Meta's data deletion requests via our registered Data Deletion callback: if you remove LeadSignal from your Meta account settings, we delete the associated platform data. Records already created in the connected business's CRM (leads and their comment text) belong to that business and are deleted on request or when the account closes. Meta's own handling of your data is governed by the Meta Privacy Policy.
9. LinkedIn data
LeadSignal offers optional LinkedIn connections, each authorised through LinkedIn's own OAuth consent screen and disconnectable at any time:
- Publishing (Share on LinkedIn). Posts you compose and approve in LeadSignal are published to your own LinkedIn profile (and, where the Community Management API is enabled, to Company Pages you administer). We read back only the posts we created, to show their status and link.
- Advertising reporting. Where you authorise your own LinkedIn Ad Account, we read its campaigns, spend, impressions and clicks to show return-on-investment reporting alongside your CRM outcomes. Read-only; visible only within your own account.
- Lead Gen Form sync. Where enabled, submissions to your own LinkedIn Lead Gen Forms sync into your CRM as leads (the fields the person submitted, and the campaign and form identifiers for attribution).
- Verification status. Where enabled, we display a lead's LinkedIn verification status as a trust indicator on their record, visible only within the owning account. It is not used for automated decisioning.
LinkedIn data is used solely to provide these features to the account that connected it, is never shared across customers or resold, and is not used to train AI models. LinkedIn's own handling of your data is governed by the LinkedIn Privacy Policy.
10. International transfers
Data may be processed in countries outside your own. Where it is, we use appropriate safeguards such as standard contractual clauses to protect it.
11. Retention
We keep personal data for as long as needed to provide the Service and for legitimate business or legal purposes. When we act as a processor, retention follows our client's instructions; on termination we delete or return client data within a reasonable period, subject to legal requirements.
12. Security
We use technical and organisational measures including encryption in transit, access controls, optional two-factor authentication and shared-secret verification on inbound webhooks. No system is perfectly secure, but we work to protect data against unauthorised access, loss or misuse.
13. Your rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. Where LeadSignal processes your data on behalf of a client, please direct requests to that client; we will assist them in responding. Otherwise, contact our support assistant.
14. Cookies
Our website uses cookies needed to operate it, including an authentication cookie used to keep you signed in to the dashboard. We do not sell data, and the lead data we process for clients is never used for advertising.
Our public marketing pages also use Google Analytics to measure how the site is used — which pages are visited, how visitors arrive, and which content leads to a demo. This sets analytics cookies and sends Google a pseudonymous identifier along with page and device information. It is not used on the signed-in dashboard, and it is never used to track individual leads or the conversation data we process for clients. Where we show a cookie banner, these analytics cookies are not set until you accept, and declining keeps them off. You can also opt out with the Google Analytics opt-out browser add-on, or by blocking cookies in your browser. Google's own handling of this data is governed by the Google Privacy Policy.
Our public marketing pages also use the Meta pixel to measure the performance of our own advertising — for example, whether a Meta ad led to a demo booking. This sets advertising cookies and shares page-visit information with Meta, governed by the Meta Privacy Policy. Like our analytics cookies, it runs only on the public marketing pages — never on the signed-in dashboard and never against client lead data — and where we show a cookie banner it is not set unless you accept.
15. Children
The Service is not directed at children and is intended for business use. We do not knowingly collect data from children.
16. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email, and the "last updated" date above will change.
17. Contact
Questions or requests? Email our support assistant.