Privacy Policy

1. Introduction

LeadChuck ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

By using LeadChuck, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, and password when you create an account
• Profile Information: Business name, trade categories, service areas, bio, and profile photo
• Payment Information: Bank account details and tax information for receiving payouts (collected and stored by Stripe)
• Lead Information: Client names, contact information, project descriptions, and notes you share through leads
• Communications: Any messages or correspondence you send to us

2.2 Information Collected Automatically

When you use our Platform, we automatically collect certain information:

• Device Information: Device type, operating system, and browser type
• Usage Information: Pages viewed, features used, and actions taken on the Platform
• Log Information: IP address, access times, and referring URLs
• Cookies: We use cookies and similar technologies to enhance your experience

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform
• Process transactions and send related information
• Create and manage your account
• Facilitate lead sharing between contractors
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and customer service requests
• Communicate with you about products, services, and events
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience
• Comply with legal obligations

4. Third-Party Services

We share information with the following third-party service providers who assist us in operating the Platform:

4.1 Twilio (SMS)

SMS Communications: When you opt in to SMS notifications, we collect and store your phone number and SMS consent status. We use Twilio as our SMS provider, and your phone number is shared with Twilio solely to deliver these text messages. Message types include account verification codes, lead and referral notifications, and reward confirmations. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to unsubscribe at any time. We do not sell or share your mobile phone number or SMS opt-in information with third parties or affiliates for their own marketing or promotional purposes.

4.2 Clerk (Authentication)

We use Clerk for user authentication and account management. Clerk processes your email address, name, and authentication credentials. For more information, see Clerk's Privacy Policy.

4.3 Stripe (Payments)

We use Stripe to process payments and manage payouts. Stripe collects and processes your payment information, including bank account details and identity verification documents. This information is stored securely by Stripe and is not accessible to LeadChuck staff. For more information, see Stripe's Privacy Policy.

4.4 Resend (Email)

We use Resend to send transactional emails such as lead notifications and account updates. Resend processes your email address to deliver these communications. For more information, see Resend's Privacy Policy.

4.5 YouTube API Services

LeadChuck's standalone Mac uploader uses YouTube API Services to upload videos that an authorized LeadChuck operator selects for LeadChuck's own YouTube channel. The uploader requests only the youtube.upload authorization scope. It sends the operator-selected video and operator-approved upload information directly from the Mac to YouTube. While the API project is unaudited, API uploads are enforced as private; any later visibility change is made separately by the operator in YouTube Studio.

The uploader stores the Google OAuth authorization credential only in protected local application data on the operator's Mac. LeadChuck does not send that credential to a LeadChuck server. During an upload, the localhost utility creates a protected temporary copy of the selected video on the same Mac and deletes it after success, failure, or cancellation. The uploader does not persist a separate video copy, video metadata, YouTube video ID, API request or response body, or upload log. It does not access YouTube watch history, subscriptions, comments, analytics, or unrelated channels.

The selected video, title, description, category, audience designation, synthetic-media designation, and visibility setting are shared with Google and YouTube only to perform the upload requested by the operator. LeadChuck does not sell this information or share it with advertisers or unrelated third parties. Google's handling of information is described in the Google Privacy Policy.

An operator can disconnect the uploader at any time. Disconnecting revokes the Google authorization grant and deletes the local authorized-user credential. Access can also be revoked from Google Security Settings. Disconnecting stops future uploads but does not delete videos already stored on YouTube. The operator can review or delete those videos in YouTube Studio. Privacy questions or deletion requests may be sent to privacy-20020277@leadchuck.com.

4.6 AI service providers (TypeSafe and OpenAI)

We use TypeSafe's Jev model to group customers on contractors' lists into general home-project interests, so the deals emails show more relevant offers. We send only a random identifier, an approximate area (state or a partial ZIP code), the types of past jobs and roughly when they happened. We never send names, email addresses, phone numbers, street addresses, notes or tags. TypeSafe does not keep this data or use it to train its models.

We also use OpenAI to help us review disputes and scout sign-ups and activity, to read documents uploaded for verification (such as insurance certificates, license documents and proof-of-address bills), and to help draft newsletter and marketing content. For disputes we send the job details (category, city, ZIP code and description) and the parties' written statements, but never the homeowner's name, email address, phone number or street address. Uploaded documents are sent in full so they can be read.

5. Information Sharing

We may share your information in the following circumstances:

• With Other Users: When you send a lead, the recipient sees your business name, profile information, and the lead details you provide
• With Service Providers: As described above, with third-party services that help us operate the Platform
• For Legal Reasons: When required by law or to protect rights, safety, or property
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you direct us to share your information

We do not sell your personal information to third parties.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. We also retain information as necessary to:

• Comply with legal obligations (e.g., tax records for 7 years)
• Resolve disputes
• Enforce our agreements
• Maintain business records

Lead data is retained for 3 years after the lead is created to support potential disputes and provide historical records. After 3 years, the homeowner's contact details on the lead (name, phone, email, address and the project description the homeowner wrote) are erased automatically. A lead with a dispute that is still open is kept until the dispute closes. Payment, payout and tax records are not part of this and are kept for 7 years as described in this section.

If you do not have an account, you can ask us to delete the contact details we hold about you with the privacy request form. You can close your account and delete your data yourself at any time in Settings, under Privacy & account. Your account is closed right away and stays recoverable for 30 days. After that it is erased automatically, and we email you before and after. We keep only what the law requires: money and tax records (7 years), fraud and security records, signed agreements, the do-not-contact list, and records of your privacy request (24 months). Anything tied to an open dispute is kept until the dispute closes, then erased.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
• Encryption at rest: Our database is hosted on Render with encryption at rest enabled at the infrastructure level
• Authentication: User authentication is handled by Clerk, a dedicated identity provider with enterprise-grade security
• Payment data: All financial and payment data is handled by Stripe (PCI DSS compliant) and never touches our servers
• Access controls limiting who can view your data
• Regular security assessments

Note: We do not perform application-level encryption of personal data fields stored in our database. Personal information such as names, email addresses, and business details are stored in our database protected by infrastructure-level encryption at rest and strict access controls, but are not individually encrypted at the application layer.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable format
• Opt-out: Opt out of marketing communications at any time

You can download your data or delete it yourself in Settings, under Privacy & account. You will be asked to sign in again to confirm it is you. These choices are available to everyone, whatever state you live in. Without an account, the privacy request form does the same. We respond within 45 days.

9. Cookies and Tracking

We use cookies and similar tracking technologies to collect and track information and to improve and analyze our Platform. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, some features of the Platform may not function properly.

We use Microsoft Clarity to record anonymized sessions (clicks, scrolling and page views) on only three places: the account setup screens (/onboarding), your main dashboard page (/dashboard) and the profile edit page (/profile/edit), so we can find and fix confusing screens. Phone, street address and license number fields are masked and are not captured. Clarity is not loaded anywhere else, including the bank and payments pages and every other page of your account.

We use Google Analytics to understand how visitors find LeadChuck (for example, which search or ad brought them) and which public pages they read. It runs only on our public website pages and the sign-up page. It never runs inside your account (dashboard, leads, payments, bank or settings pages), and we strip personal links and codes from page addresses before anything is sent to Google.

10. Children's Privacy

LeadChuck is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

13. California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) regarding your personal information. These include:

• The right to know what personal information is collected
• The right to know whether personal information is sold or disclosed
• The right to say no to the sale of personal information
• The right to access your personal information
• The right to equal service and price

To exercise your CCPA rights, open Settings, then Privacy & account, to download or delete your data. If you do not have an account (for example, a contractor entered your details), use the privacy request form or email privacy-20020277@leadchuck.com. We confirm the request is yours by sending a one-time link to the email address it came from, and respond within 45 days.

An authorized agent may make a request for you, but the person it is about must confirm it from their own email address or account. If we deny a request, or can only part-fulfil it, the email tells you why and includes a link to ask for one automatic re-check. The re-check runs once and its result is final; you may also contact your state Attorney General.