Privacy Policy

1. Who we are and roles

• Account / platform data: For information about account holders, billing contacts, visitors to our marketing site, and our own business operations, Leych is the controller (or “business” under CCPA/CPRA).
• Customer Data in workspaces: For content and personal data you store or process in your workspace (CRM contacts, leads, messages, files, website form submissions, employee data, hiring candidates, and similar), you are the controller/business and Leych acts as a processor/service provider on your instructions to provide the Service.
• Workspace-hosted SMS privacy/terms pages under /sms-program/… describe the customer’s messaging program; those pages are not Leych’s own consumer privacy notice for the platform.
• Not a HIPAA service by default: Leych is not a covered entity and does not become your business associate merely because you open an account. Do not submit protected health information (PHI) or use the Service as an EHR / clinical system of record unless you and Leych have signed a separate Business Associate Agreement. See our Terms of Service (Sensitive and regulated data).

2. Health and other regulated information

The Service is intended for ordinary business operations (tasks, CRM for non-PHI business contacts, marketing, social, websites, and similar). It is not offered as a HIPAA-compliant product unless covered by a separate written BAA. If you are a healthcare provider, clinic, med spa, dental practice, or similar organization:

• Do not enter diagnoses, treatment notes, prescriptions, insurance/member IDs, medical record numbers, clinical images, or other PHI into Leych workspaces, AI prompts, SMS/email agents, files, forms, or chat.
• Keep clinical and billing health records in your HIPAA-capable systems. Use Leych only for content and workflows that do not include PHI (for example public marketing copy, non-PHI operational tasks).
• If PHI is submitted contrary to the Terms, you remain the party responsible for HIPAA compliance with respect to that data; Leych may remove or restrict the data and is not obligated to treat an accidental upload as creating a BAA.

3. Information we collect

• Account and contact data: name, email, password (hashed by our auth provider), profile photo, workspace name/slug, role, invite details, and support correspondence.
• Customer Data / workspace content: tasks, boards, CRM contacts/companies/deals, chat and DMs, files, social posts and assets, brand kits, mind maps, website drafts and form leads, newsletter lists/campaigns, QR destinations, domain/DNS records you manage through us, SMS agent configuration and conversation logs, SEO keywords and reports, hiring and talent materials, time entries, and settings you choose to store.
• Connected accounts: OAuth tokens, account IDs, handles, pages/locations you select, and permissions you grant for networks such as Meta (Facebook / Instagram), LinkedIn, Google (including Local / Business Profile, YouTube, Search Console, Analytics when connected), TikTok, and similar. We request scopes needed for the features you use.
• Communications metadata: for email, SMS, and voice features you enable — phone numbers, delivery/status events, opt-out signals, call/SMS logs needed to operate and troubleshoot the feature, and registration details you submit for A2P / 10DLC.
• AI inputs and outputs: prompts, attached files or excerpts, generated text/images, and related safety or usage logs needed to run AI features.
• Usage and device data: IP address, browser/device type, approximate location derived from IP, pages or product areas viewed, referral URLs, diagnostic and error logs, and timestamps.
• Cookies and similar technologies: session and authentication cookies, preference cookies (for example theme), and any analytics or advertising tags we enable. See Section 8.
• Personal mode (when enabled): display name, bio, avatar, follows/blocks, posts, comments, likes, stories, DMs, polls, and related product analytics. Hiring/talent profiles in Work mode are separate from Personal social content.
• Payment and commercial data: if you purchase a plan, our payment processor collects payment details; we receive billing status, plan, and limited transaction metadata (we do not store full card numbers on Leych servers).

4. How we use information

• Provide, operate, maintain, and improve the Service and its features.
• Authenticate users, secure accounts, prevent abuse, fraud, and unauthorized access.
• Send service notices, security alerts, invoices, and (with consent or as allowed) product updates.
• Run AI features you request and enforce usage quotas and safety controls.
• Publish or schedule content and sync data when you connect third-party accounts.
• Provide support, investigate incidents, and create audit/activity records.
• Comply with law, enforce our Terms, and protect rights, safety, and property.
• Analyze product performance using aggregated or de-identified metrics where practical.

Where GDPR/UK GDPR applies to our role as controller, we rely on one or more of: performance of a contract, legitimate interests (securing and improving the Service, preventing abuse), consent (where required, such as certain cookies or marketing), and legal obligation.

5. AI processing

When you use AI features, relevant prompts and Customer Data may be sent to model providers (for example OpenAI, Anthropic, Google, or Groq) acting as our subprocessors so the feature can generate a response or asset. We configure providers for product use and do not sell your Customer Data. Do not send PHI or other data prohibited by our Terms, and avoid other sensitive data you are not authorized to process with AI. Model providers may process data in the United States or other countries where they operate, subject to their agreements with us.

6. How we share information

• Workspace members and invitees according to roles you configure.
• Service providers / subprocessors that host or help run the Service under contractual safeguards. Categories include: cloud hosting and edge (e.g. Vercel); database, auth, and storage (e.g. Supabase); email delivery (e.g. Resend); telephony/SMS (e.g. Twilio); DNS/registrar (e.g. Cloudflare); realtime media (e.g. LiveKit); AI model providers; SEO data providers (e.g. DataForSEO); stock imagery (e.g. Pexels); GIF providers (e.g. Tenor/Giphy); and code hosting used for customer websites (e.g. GitHub) when that feature is used.
• Connected platforms when you authorize publishing, analytics, review replies, or account sync.
• Professional advisors (legal, accounting) under confidentiality.
• Legal and safety: when required by law, legal process, or to protect Leych, users, or the public.
• Business transfers: in connection with a merger, financing, acquisition, or sale of assets, subject to continuing confidentiality commitments.

We do not sell personal information for money. The Meta Pixel is used for advertising measurement. You can opt out of Meta interest-based ads in your Meta account settings and through browser controls. If we add further cross-context advertising tools, we will update this Policy and provide a clear opt-out method.

7. Social and platform data

When you connect a social or local business account, we use tokens and data only to provide the features you request (scheduling, publishing, insights, review management, and related settings). We do not sell or rent LinkedIn or other platform data. You can disconnect accounts in workspace settings; we then stop new access and remove or disable tokens subject to backup and audit retention. Platform partners’ policies also apply to data obtained from them.

8. Cookies and tracking

We use strictly necessary cookies for authentication and session continuity, and preference cookies (such as theme). We may use first-party product analytics derived from authenticated usage. We use the Meta (Facebook) Pixel to measure ads and to record a Purchase when you subscribe to a plan after Checkout. Meta may receive your IP address, browser data, and the page you viewed, and may combine that with other data they hold. You can control this through browser settings and Meta’s ad settings. Blocking necessary cookies may break login.

Customer websites or newsletters you operate through Leych may set their own cookies or open-tracking pixels. Those are your responsibility as the site/campaign operator.

9. Retention

We retain personal data while your account is active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal, tax, and audit requirements. When you disconnect an integration, delete content, or delete a workspace, we remove or de-identify associated data within a commercially reasonable period, subject to backups, security logs, and legal holds. Messaging delivery logs and registration records may be kept longer when required by carriers or law.

10. Security

We use technical and organizational measures appropriate to the nature of the Service, including TLS in transit, access controls, role-based workspace permissions, encrypted storage of certain secrets (such as telephony credentials), and logging. No system is perfectly secure. Please use strong unique passwords and limit admin access. Report suspected incidents to support@leych.com.

11. International transfers

Leych operates from the United States. Personal data may be processed in the U.S. and in other countries where our providers operate. Where required, we use appropriate transfer mechanisms (such as standard contractual clauses) or rely on other lawful bases for cross-border transfers.

12. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information; to restrict or object to certain processing; to withdraw consent; and to appeal a decision we make about a request. California residents may also have rights under CCPA/CPRA to know, delete, correct, and opt out of sale/sharing (we do not sell personal information as described above), and not to be discriminated against for exercising rights.

To exercise rights regarding account/platform data we control, email support@leych.com. We may need to verify your identity. For Customer Data inside a workspace, contact the workspace admin first — they are the controller; we will assist them as a processor where appropriate.

EU/UK users may lodge a complaint with their local supervisory authority. You may also manage cookies in your browser and disconnect social accounts in settings.

13. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

14. Third-party links and customer properties

The Service may link to third-party sites or publish customer-controlled websites and campaigns. Their privacy practices are not covered by this Policy. End customers who submit forms on a customer’s Leych-built website are interacting with that customer; Leych processes submissions to deliver them to the workspace.

15. Changes

We may update this Privacy Policy to reflect operational, legal, or product changes. For material changes, we will provide reasonable notice. The “Last updated” date always reflects the current version.

16. Contact

Privacy questions and requests:
Leych Company
Houston, Texas, United States
support@leych.com