Privacy.

1. About this policy

This privacy policy explains how Lead Source handles personal data. It covers our website at leadsource.co, our application at app.leadsource.co, the lead-source tracking script our customers install on their own websites, the WhatsApp pages, tracked links and QR codes Lead Source hosts for its customers, and the WhatsApp integration customers connect through Meta.

Lead Source is operated by Leadsource Pty Ltd trading as Lead Source, registered in Victoria, Australia. We serve customers globally.

Because the tool works on behalf of other businesses, on their websites and on their WhatsApp business numbers, this policy is unusual: it has to handle the data of two different groups of people. We’ve split it clearly so you can read the part that applies to you.

2. What we collect from customers

Account information. When you sign up, we collect your email address and a hashed version of your password. If you provide a name, company name, role, or phone number, we store those too. Billing information for paid plans is processed by our payment provider; we receive a token, never your card number.

Application usage. When you use app.leadsource.co, we collect standard log information: IP address, browser type, pages viewed, actions taken, and timestamps. We use this for security, debugging, and product improvement.

WhatsApp connection. If you connect WhatsApp, we hold the details of that connection: the WhatsApp business numbers you connect, the business account they belong to, and the authorisation Meta issues to Lead Source for them. See section 9A.

Communications. If you contact our support team, we keep a record of the conversation and any information you share with us in it.

Marketing data. If you visit leadsource.co before signing up, we may capture your visit through Google Analytics, Google Ads, and our own Lead Source script (we use our own tool on our own site. See “Tracking on leadsource.co” below).

3. How we use customer data

We use customer data to:

• Provide the product and authenticate your account
• Send notification emails, monthly summaries, and product updates you opted into
• Respond to support requests
• Bill you for paid plans
• Diagnose technical issues and improve the product
• Send you marketing about Lead Source. Only if you opted in or are an existing customer (you can opt out any time)
• Detect, prevent, and respond to fraud, abuse, and security incidents
• Comply with legal obligations and respond to lawful requests

Our legal basis for processing customer data, where GDPR or equivalent laws apply: performance of our contract with you (running the service), our legitimate interests (security, product improvement, marketing to existing customers), and your consent (marketing to prospects, optional features).

4. Who we share customer data with

We don’t sell customer data. We don’t share it with anyone for their own marketing.

We do use third-party services to run the business. They handle data on our behalf as sub-processors, under contracts that require them to keep it confidential and only use it for the purposes we specify. See section 11 for the categories.

We will share customer data if required by law (subpoena, court order, regulatory request), if necessary to protect our rights or someone’s safety, or as part of a business transfer (merger, acquisition, sale. We’d notify you).

5. Marketing

We may send you marketing emails about Lead Source if you signed up for them, or if you’re an existing customer (in which case you can unsubscribe any time using the link in every email).

6. What we collect on customer sites

When the Lead Source script runs on a customer’s website, it captures:

• The form submission itself. Whatever fields the customer’s form sends to us. This typically includes name, email, phone, message, and similar fields. The customer chooses what their form collects.
• Source attribution. URL parameters present at the time of submission (UTM source, medium, campaign, term, content, plus our supported equivalents like gclid, fbclid).
• Referrer. The URL of the page that linked to the customer’s website, where available.
• Page journey within the customer’s website. The sequence of pages you visited on that site, in that session, before submitting the form.
• Device metadata. IP address, user agent (browser and OS), country derived from IP.
• Timestamp. When the submission happened.

7. What we deliberately don’t collect

This is just as important. The Lead Source script does not:

• Record keystrokes, mouse movements, or session replays
• Use device fingerprinting
• Track you across different websites. Our data is scoped to the customer’s site only
• Capture form values you typed but didn’t submit
• Read content from other parts of the page (no DOM scraping beyond the form)
• Send your data to advertising networks or data brokers

The business you contacted can export its own lead data, for example to report a conversion in its own advertising account. That is the business’s decision, made under its own privacy policy.

If any of this changes in future, we’ll update this section and date the change.

8. Cookies and tracking on customer sites

The Lead Source tracking script uses cookies on the customer’s website. They hold a visitor identifier and the source of your first visit, so that an enquiry you make later can be connected to the visit that started it. The script also reads URL parameters and the referrer.

The website you visited may use its own cookies (analytics, marketing, functional). Those are governed by that website’s privacy and cookie policies, not ours.

9. How to exercise your rights as a website visitor

You have rights over the personal data captured by Lead Source on a customer’s website. Because we are the processor and not the controller, the right way to exercise them depends on what you want:

• To access, correct, or delete your data: contact the website you submitted the form to. They control the data and they have the customer-facing tools to act on your request. If you can’t reach them or they don’t respond, contact us through our contact page and we will help facilitate.
• To stop your form submission being captured by Lead Source on a specific site: tell that site you don’t want them to capture your data, or don’t submit the form.
• To opt out of all Lead Source tracking on all sites that use us: we honour the Global Privacy Control (GPC) signal. If your browser sends GPC, our script treats the submission as opt-out for any tracking that requires consent under the visitor’s applicable law.
• To complain: first to the customer (the controller). If unresolved, you can complain to the data protection authority in your country. In Australia, the OAIC; in the EU, your national supervisory authority; in the UK, the ICO; in California, the CPPA; etc.

9A. WhatsApp enquiries and Meta business integrations

This section applies if you sent a WhatsApp message to a business that uses Lead Source WhatsApp Attribution, or if you passed through a Lead Source WhatsApp page, tracked link or QR code on the way to that chat. It applies whether or not you ever visited that business’s website.

What WhatsApp Attribution does

A business that uses Lead Source can connect one or more of its WhatsApp business numbers. When someone sends a WhatsApp message to a connected number, Lead Source records the enquiry as a lead for that business. Where it has reliable evidence, it also connects the enquiry to the marketing that started it: the ad, search result, link, QR code or web page the person came through. The business uses this to see which of its marketing brings real enquiries.

A business does not need a website to use it. It can send people from an ad, a link or a QR code to a page hosted by Lead Source, with one button that opens a WhatsApp chat with the business. Someone who arrives that way may never visit the business’s own website, and this section still applies to them.

Who controls the data

The business you messaged is our customer. It decides to connect its WhatsApp number to Lead Source, and it controls the enquiry data. That business is the controller; we are the processor acting on its instructions, as with form submissions in the rest of Track B. You do not need a Lead Source account, and messaging the business does not make you a Lead Source customer.

How a business connects WhatsApp

The connection runs through Meta’s WhatsApp Business Platform. The business authorises Lead Source, through Meta, to receive the messages sent to the WhatsApp business numbers it chooses, together with the information Meta supplies with them. Lead Source can only access what that authorisation covers. Lead Source is independent of Meta and WhatsApp and does not control either of them.

The business can remove the authorisation at any time, in its Meta business settings or by asking us. Removing it stops Lead Source receiving new WhatsApp data through that connection. It does not delete enquiries already recorded: those stay subject to the normal retention and deletion rules in section 13.

What we record before the chat

When someone opens a Lead Source WhatsApp page, tracked link or QR code, Lead Source may record:

• The visit. Which page, link or QR code was used, when, and the source and campaign the business labelled it with.
• Marketing details in the link. Campaign parameters (UTM source, medium, campaign, term, content) and ad click identifiers such as a Google Ads click ID, where the link carries them.
• Referrer. The page that linked to it, where available.

If you reached WhatsApp from the business’s own website, sections 6 to 8 also apply to that visit, including the pages you read there before opening the chat.

What we record from a WhatsApp message

When a WhatsApp message reaches a connected number, Meta delivers it to Lead Source. Lead Source records:

• The sender. Your WhatsApp phone number and the name on your WhatsApp profile.
• The business number. Which of the business’s WhatsApp numbers received the message.
• The time. When the message was sent.
• Ad details from Meta. If you started the chat from a Facebook or Instagram ad that opens WhatsApp, the details Meta provides about that ad, such as the ad and campaign.
• The link to the visit. Where Lead Source can make it reliably, the connection between your message and the visit, link, QR code or ad that started it, with that visit’s source, campaign and landing page.

Every person who messages a connected number is recorded as an enquiry for that business, including people who did not arrive through any tracked marketing. Tapping a WhatsApp button, opening a chat without sending anything, read receipts and the business’s own replies do not create an enquiry. Several messages in a row from the same person count as one enquiry.

Message content

Meta delivers each message to Lead Source, including its text, so that Lead Source can process the incoming enquiry. Lead Source uses what it needs from the message to identify the sender and to connect the enquiry to the visit, link or ad that started it. The text of your message is not kept as part of the lead or attribution record, and it does not appear in the business’s Lead Source account. The conversation itself stays in WhatsApp, between you and the business.

How an enquiry is connected to its marketing

Lead Source records the visit before you open WhatsApp. When your message arrives, Lead Source connects the two only when it has reliable evidence that they belong together, such as a reference from the Lead Source page, link or QR code you used, or ad details supplied by Meta. Without that evidence, for example because you saved the number months ago or a friend passed it on, the enquiry is still recorded but marked Unattributed. Lead Source does not guess.

How we use it

We use WhatsApp enquiry data only to provide Lead Source to the business you messaged: to show your enquiry as a lead with its marketing source, to include it in that business’s reports, and to let the business export it. Phone numbers are encrypted when stored. We do not sell this data, we do not share it between Lead Source customers, and the commitments in section 5 and section 15 apply to WhatsApp enquiries exactly as they apply to form submissions: we never market Lead Source to you, and we never use your data to train AI models.

Meta and WhatsApp

WhatsApp and Meta process your messages under their own terms and privacy policies, which Lead Source does not control. See the WhatsApp Privacy Policy and the Meta Privacy Policy. Meta does not appear in our sub-processor list in section 11, because the business chose WhatsApp for its own messaging and connects it to Lead Source itself.

Access and deletion requests for WhatsApp enquiries

• To access, correct or delete an enquiry recorded about you: contact the business you messaged. It controls the record and can delete it from its Lead Source account. If you can’t reach the business or it doesn’t respond, contact us through our contact page with the WhatsApp number you messaged from and the business you contacted, and we will help.
• To avoid being recorded: a message to a connected number is recorded as an enquiry for that business, whichever route you took to send it. If you would rather it wasn’t, contact the business another way, or ask the business or us to delete the record.
• Everything else: the rights in section 17 and section 18 apply to WhatsApp enquiries in full.

10. Tracking on leadsource.co itself

On our marketing website at leadsource.co (the site you’re reading right now), we use the following:

• Google Tag Manager. To manage other tags on the site
• Google Analytics 4. To understand which pages are read, where visitors come from, what features they explore
• Google Ads. For remarketing to people who have visited leadsource.co, and conversion tracking on signups
• Lead Source. We use our own product on our own site (we eat our own cooking)

These tools may set cookies or similar identifiers when you visit leadsource.co. See our Cookie Policy for the full list, what each one does, and how to opt out. The tracking we do on our own website is separate from the tracking script our customers install on their websites.

11. Sub-processors

To run Lead Source, we use third-party services that process data on our behalf, under contractual obligations that require them to keep it confidential and only use it as we direct. Our current sub-processors:

Sub-processor	Purpose	Location
Supabase	Database, authentication, file storage	United States (US East / N. Virginia)
Vercel	Application hosting and edge network	United States (primary), global edge
Amazon Web Services	Underlying cloud infrastructure for Supabase and Vercel	United States (US East / N. Virginia)
Stripe	Subscription billing and payment processing (we never see your card)	United States
Twilio SendGrid	Transactional email (notifications, password resets, account emails)	United States
Unipile	Mailbox connectivity for outbound sending tiers (OAuth to Google Workspace / Microsoft 365, send and, on the AI tier, read of email)	France (EU)
Anthropic	AI inference for AI-tier outbound reply drafting (processes inbound reply content, lead metadata, and conversation history; contractually prohibited from using customer data for model training)	United States
GitHub	Source-code hosting (no production customer data)	United States

The authoritative, versioned list of sub-processors is maintained in Annex III of our DPA. We’ll give existing customers at least 30 days’ notice of changes that materially affect data processing, and customers may object on reasonable data-protection grounds.

12. International transfers

Lead Source serves customers globally. Our primary infrastructure is hosted in the United States (US East / N. Virginia), on Supabase (managed Postgres on AWS) and Vercel. Other sub-processors operate from:

• United States for Stripe (billing), Twilio SendGrid (transactional email), Anthropic (AI inference on the AI tier), and GitHub (source-code hosting)
• France (EU) for Unipile (mailbox connectivity on outbound sending tiers); on the AI tier, mailbox content is read from EU servers and then transferred to the US for AI inference and to the customer’s account in the US-hosted primary infrastructure

Where data crosses a border that requires safeguards (most commonly: EEA/UK/Swiss data leaving for the US or other third countries), we rely on:

• Standard Contractual Clauses (Module 2, controller-to-processor) issued by the European Commission, with the UK International Data Transfer Addendum where required for UK transfers. These are incorporated into our DPA at Annex V and take effect automatically when you accept our agreement.
• Adequacy decisions where they exist
• Supplementary technical measures: encryption in transit (TLS 1.2+) and at rest (AES-256)

For Australian customers, transfers to overseas sub-processors are subject to APP 8 and we take reasonable steps to ensure each overseas recipient handles the data in a manner consistent with the Australian Privacy Principles.

You can request copies of the relevant transfer mechanisms through our contact page.

13. How long we keep data

Customer account data: we keep account data for as long as your account is active. If you cancel, we delete account data within 30 days (with backup copies removed in our ordinary backup-rotation cycle within a further 30 days), except where retention is legally required (billing records for tax purposes, typically 7 years in Australia).

Lead data captured for a customer, from forms and from WhatsApp: we keep this for the duration of the customer’s plan retention window. Customers can export their data any time and delete individual leads or all leads from the dashboard. WhatsApp message text is not kept as part of the lead record (see section 9A).

Marketing data on prospects: we keep prospect contact data for as long as it’s reasonable to expect a marketing relationship. We delete on request, and we delete automatically after a period of inactivity.

Logs: server logs are kept for security and debugging purposes for 90 days, then deleted or anonymised.

14. Security and breach notification

We use industry-standard security measures: TLS encryption in transit, encryption at rest for customer and visitor data, hashed passwords (we cannot read your password), access controls limited to a small number of authorised staff, regular security review, and audit logging of administrative actions.

No system is perfectly secure. If we discover a personal data breach affecting your data, we will notify you and the relevant authority as required by applicable law:

• Australia: under the Notifiable Data Breaches scheme of the Privacy Act 1988, if the breach is likely to result in serious harm
• EEA / UK: under GDPR Article 33-34, within 72 hours where required
• Other jurisdictions: per local breach-notification rules

15. AI features, automated decisions, and profiling

AI inference for the outbound sending feature. On our paid tiers that include outbound sending, customers may connect a mailbox and send first-touch emails from it. On our top (AI) tier, the service additionally reads inbound replies received in that mailbox and uses an AI sub-processor, currently Anthropic, PBC, to draft and send further outbound replies on the customer’s behalf, directed toward a goal the customer configures (for example, booking a meeting).

Personal data processed through this AI flow, including inbound reply content, lead metadata, and conversation history, passes through Anthropic in the United States under contractual terms that prohibit Anthropic from using it to train its general-purpose models. AI-tier customers are responsible for disclosing this AI processing in their own privacy notices and (where the law requires it) for capturing consent or another valid legal basis from the lead before the AI processing begins. We provide a customer-facing template notice that customers may adapt.

AI disclosure. Where applicable law requires disclosure that a message was generated by AI (including, from 2 August 2026, the EU AI Act Article 50 for recipients in the EU), the service injects a configurable AI-disclosure element into AI-generated outbound messages by default. Customers cannot disable this disclosure for recipients in jurisdictions where the law requires it.

No training on customer or lead data. We do not use customer data, website visitor data, lead data, or inbound reply content to train machine-learning or AI models. Our AI sub-processors are contractually prohibited from doing so on our behalf. We use service-generated data (see section 15A) for model evaluation, but only in aggregated and de-identified form.

Automated decisions. We do not make automated decisions that produce legal or similarly significant effects on individuals. The AI drafts and sends marketing emails on a customer’s behalf; it does not make legal commitments, set prices, agree to contracts, or make decisions about credit, eligibility, or any similar matter. The AI is configured to escalate (rather than respond autonomously) on threads involving pricing changes, contractual offers, regulated-product representations, complaints, disputes, or messages indicating recipient distress or vulnerability.

Volunteered sensitive data. The AI is not designed to solicit special category (sensitive) data. Where a recipient nevertheless volunteers such data in a reply, the service operates detection and quarantine measures to pause AI processing and flag the thread for human handoff. See DPA section 4C for the full treatment.

Logging. For each AI-generated message we log the source lead, the lead’s permission-basis metadata, the thread classification, the prompt inputs, the model output, any human approval or edits, the sent message, delivery / bounce / unsubscribe status, and subsequent deletion status. These logs are used for abuse detection, deliverability monitoring, model evaluation, customer audit, and incident response. Retention follows the schedule in section 13.

15A. Service-generated data

Separate from the customer data and visitor data described above, we generate aggregated, de-identified data from operating Lead Source across our customer base. This includes performance metrics, abuse-detection signals, capacity-planning data, and aggregated benchmarks.

Before any data is used as service-generated data, we remove direct identifiers (IP addresses, email addresses, names, free-text fields are stripped or replaced with non-reversible hashes) and we aggregate to a minimum group size of five, no metric is published or used outside production operations where the underlying group has fewer than five distinct contributing customers or data subjects.

We use service-generated data to: operate, secure, and improve the service; develop new features; produce aggregated industry benchmarks; and detect abuse. We do not sell service-generated data, and we do not disclose it to third parties in a form that identifies, or could reasonably be used to identify, any customer, data subject, or website. Customers can opt their account out of contributing to certain service-generated data uses via the toggle in the application.

The full terms governing service-generated data are in section 4A of our DPA.

16. Children

Lead Source is a B2B product. We do not knowingly collect data from anyone under 16, and we do not direct our service to children. If you are a customer, you must not install our script on websites, or connect WhatsApp numbers, primarily directed at children, and you are responsible for compliance with children’s privacy laws (COPPA in the US, Article 8 GDPR in the EU, similar provisions elsewhere).

If you believe we hold data about a child, contact us through our contact page and we will delete it.

17. Your rights, anywhere in the world

We extend the following rights to everyone whose data we process, regardless of where you live:

• Access. Ask what personal data we hold about you
• Correction. Ask us to fix data that’s wrong
• Deletion. Ask us to delete your data (subject to legal retention requirements)
• Portability. Ask us to export your data in a machine-readable format
• Objection. Ask us to stop processing your data for certain purposes
• Withdrawal of consent. Where we rely on consent, withdraw it any time
• Complaint. Complain to a data protection authority in your country

To exercise any of these rights, contact us through our contact page or, if you’re a customer, use the controls in your account settings. We respond within 30 days, often faster, and we don’t charge for reasonable requests.

If you contact us about an enquiry captured for a customer (Track B), whether a form submission or a WhatsApp message, we will route your request to the customer where appropriate, or facilitate directly if the customer is unresponsive.

18. Regional rights

The rights above are the universal floor. Some regions add specific extra rights or formalities:

European Economic Area, United Kingdom, and Switzerland

Under GDPR, UK GDPR, and the Swiss FADP, you have all the rights listed above plus the right to restrict processing in some circumstances and the right not to be subject to solely automated decisions with legal effect (we don’t make any). You can complain to your national supervisory authority. For example, the ICO in the UK, CNIL in France, the Datenschutzbeauftragte in Germany, the FDPIC in Switzerland.

California (CCPA / CPRA)

You have the right to know, correct, delete, and obtain a portable copy of your personal information. You can opt out of the “sale” or “sharing” of your personal information. We do not sell or share personal information as defined under CCPA, but if our practices change we’ll update this section. You can also limit our use of sensitive personal information (we don’t collect any). We honour the Global Privacy Control browser signal as a valid opt-out request. You may designate an authorised agent to make a request on your behalf.

Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you have rights similar to those in California. To exercise any of them, contact us through our contact page.

Australia

We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles. You have the right to access, correct, and complain about how we handle your personal information. If we’ve declined a request and you’re not satisfied with the response, you can complain to the Office of the Australian Information Commissioner (OAIC).

New Zealand

We comply with the Privacy Act 2020. Complaints can be made to the Office of the Privacy Commissioner.

Canada

We comply with PIPEDA. Complaints can be made to the Office of the Privacy Commissioner of Canada or to the relevant provincial commissioner.

Brazil

Under the LGPD, you have rights similar to those under GDPR. Complaints can be made to the ANPD (Autoridade Nacional de Proteção de Dados).

South Africa

We comply with POPIA. Complaints can be made to the Information Regulator of South Africa.

Other countries

If your country’s law gives you privacy rights not specifically named above, we extend them in good faith. Email us and we’ll handle the request.

19. Changes

We’ll update this policy when our practices change or the law requires it. The “last updated” date at the top of this page shows when. For material changes affecting how we use existing customer data, we’ll notify customers by email or in-app before the change takes effect.

20. Contact