1. Who we are and when this applies
For data a business collects through LeadLock, that business decides how it's used and we follow its instructions.
LeadLock AI is operated by LeadLock AI Technologies LLC ("LeadLock," "we," "us"), based in Florida, United States.
When we decide how data is used
We are responsible for information about people who visit our website, request a demo, sign up, buy a plan, or contact us. This policy fully covers that information.
When we process data for a business
When a business (our "customer") uses LeadLock to talk to its own customers, manage its team or run its jobs, we act as that business's service provider (sometimes called a processor). The business decides why the information is collected and how long it is kept, and it is responsible for telling its customers and staff about it. We use that information only to provide LeadLock to the business, as described here and in our Terms of Service.
2. Information we collect
From business owners and their teams
- Name, email, phone number, business name, address, website, services offered and business hours.
- Login details, role and permissions, two-factor authentication settings, and the date you accepted our terms.
- Plan, billing contact, invoices and payment status (card details stay with Stripe).
- Settings you choose, such as greetings, booking rules, AI on or off, after-hours handling and automations.
- Support requests and bug reports you send us.
From the customers of businesses that use LeadLock
- Name, phone number, email, service address and the details of the job they need.
- Phone call details, speech transcripts, voicemails and AI call summaries (see section 3).
- Text messages, website chat conversations and form or booking submissions.
- Text message consent and opt-out records (see section 4).
- Appointments, quotes, invoices, payment status, reviews and referrals.
- Photos or files they upload, for example pictures of the problem to be fixed.
From technicians and staff
- Location while on an active job, job status updates, photos, notes and signatures (see section 6).
- Time clock, attendance and pay information the business enters.
- Messages in Crew Chat and other team tools.
Collected automatically
- IP address, browser and device type, pages viewed, and timestamps.
- Error and performance information that helps us keep the service working.
- Usage counts for billing, such as call minutes, text messages and AI credits.
3. Phone calls and Ava
Ava is an AI. What callers say is turned into text so Ava can answer, and the business sees a transcript and summary.
When a business turns on Ava, LeadLock's AI receptionist, calls to that business's LeadLock number are answered by Ava within the hours and rules the business sets. Ava tells callers at the start of the call that they are speaking with an AI assistant and that the call may be recorded and transcribed. If a caller asks whether Ava is a person, Ava answers truthfully.
During a call:
- Twilio carries the call and converts the caller's speech to text.
- The text, along with the business's services, hours and booking rules, is sent to an AI model (see section 9) to decide what Ava says next.
- Ava's replies are spoken using text-to-speech from Twilio or, where the business chooses natural voices, ElevenLabs.
- The transcript, a summary, the caller's number and any booking details are saved to the business's CRM.
If Ava is unavailable, or the caller chooses to leave a message, the caller hears a prompt and a beep before their voicemail is recorded. Voicemails are transcribed and saved to the CRM. Full-call audio recording is only on if a business turns it on where that feature is offered.
Some states, including Florida and California, require everyone on a call to agree before it is recorded. The disclosure at the start of each call is there for that reason, and businesses may not remove it.
If a business uses LeadLock's browser calling features, its staff can place and receive calls through Twilio from a computer. Call details are logged to the CRM in the same way.
4. Text messages
Texts go only to people who agreed to them. Reply STOP to opt out or HELP for help. Message and data rates may apply.
Businesses use LeadLock to text their customers about inquiries, appointments, technician arrival times, invoices and support. LeadLock checks for recorded consent before sending any automated text and blocks the message if consent is missing or the person has opted out. Blocked attempts are logged.
We keep a record of each consent, including:
- the phone number, date and time;
- where consent was given (web form, booking page, chat, phone call or a reply text);
- the exact wording and version of the consent statement shown; and
- any later opt-out or opt-back-in.
Reply STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) to any message to opt out, and HELP for help. You can also simply ask the business to stop texting you. Message frequency varies. Message and data rates may apply. Consent to texts is never a condition of buying anything.
LeadLock does not send marketing or promotional texts (such as referral offers) unless a separate marketing consent has been collected. Mobile phone numbers and text consent are never shared with third parties or affiliates for their own marketing. See our SMS terms for details.
5. AI features
AI helps answer calls, texts and chats and helps staff run the business. Providers can't train on your data.
LeadLock uses AI in these places:
- Ava, the phone receptionist described in section 3.
- The website assistant, a chat (and optional voice) widget a business can place on its website. If a visitor uses voice, their browser asks for microphone permission first.
- Text replies, which can answer customer texts within the consent rules in section 4.
- Nexus, an assistant inside the CRM that answers staff questions about their workspace, drafts messages and can take actions such as creating tasks or updating records.
- Summaries and suggestions, such as call summaries, lead scoring and suggested follow-ups.
To produce a reply, LeadLock sends the conversation and the business context needed to answer (for example services, prices and open appointment times) to an AI model provider, currently Anthropic or OpenAI. These providers process the data for LeadLock under agreements that prohibit them from using it to train their models. We don't use one business's data to train AI for another business.
Nexus only acts within the permissions of the staff member using it. By default, any action that contacts a customer, changes money, or deletes data waits for a person to approve it, and every action is logged.
AI can make mistakes. Businesses can review what AI said and did in the CRM. Our AI & voice disclaimer explains the limits.
6. Technicians, location and staff data
Technician location is collected only during an active job, and only after the phone grants permission.
When a technician uses the LeadLock Technician App, their phone shares its location only while they have an active job that is on the way, arrived or in progress, and only after the phone's location permission is granted. The location is used to show the dispatcher where the technician is, estimate arrival times and send the customer "on the way" updates. Location points are deleted after 48 hours by default (a business can choose up to 30 days).
LeadLock also stores job photos, notes, checklists and customer signatures a technician records, and time clock, attendance and pay information the business enters.
Crew Chat messages are visible to the people in the conversation. Workspace owners and admins may be able to review staff conversations for safety and compliance. Employers must give their staff any notice their state requires before turning on location or monitoring features.
7. Payments and finance data
Stripe handles card payments. LeadLock never receives full card numbers.
We use Stripe for LeadLock subscriptions, credit purchases and add-ons. When a business sends an invoice or payment link, its customer pays on a Stripe-hosted page, and payouts to the business go through Stripe Connect. Card numbers go directly to Stripe. LeadLock receives the payment amount, status, the last four digits and card brand so the invoice can be marked paid.
Please don't read or text a card number to Ava or a business's text line. Ava is instructed to send a secure payment link instead.
LedgerAI, LeadLock's finance area, stores invoices, payments, expenses and related records for the business. That data is visible only to the business's authorized users.
8. How we use information
We use information to:
- provide LeadLock: answer calls and messages, book and dispatch jobs, send invoices and run the features a business turns on;
- send account, security, billing and service messages;
- measure usage for billing and plan limits;
- keep LeadLock secure, prevent spam, fraud and abuse, and enforce our terms;
- fix problems and improve how LeadLock works, using usage and error information;
- send business owners product news by email, which they can unsubscribe from at any time; and
- meet legal obligations, such as tax records and responding to valid legal requests.
We don't use the customer data a business keeps in LeadLock to market our own products to that business's customers.
11. How long we keep it
We keep information only as long as needed for the purpose it was collected, then delete or de-identify it.
| Information | How long |
|---|---|
| Account, CRM, job and message records | While the workspace is active. After a workspace is closed we delete or de-identify them within 90 days, unless the law requires us to keep them longer. |
| Archived leads | Deleted automatically after the archive period the workspace owner chooses. |
| Call transcripts, voicemails and AI conversation logs | Kept with the related CRM record until the business deletes it or the workspace is closed. |
| Technician GPS location points | 48 hours by default. A workspace can choose up to 30 days. |
| SMS consent and opt-out records | At least 5 years, even if the contact is deleted, so the business and LeadLock can prove consent and honor opt-outs. |
| Billing and payment records | As long as tax and accounting law requires, usually 7 years. |
| Server and security logs | Short periods, generally 30 days or less, longer only while investigating an incident. |
Deleted data can remain in encrypted backups for a short time until those backups expire.
12. Security
We protect information with safeguards that include:
- encryption in transit (HTTPS) and encryption at rest by our hosting and database providers;
- separation between workspaces, so one business can't see another's data;
- role-based permissions inside each workspace, with technicians seeing only their assigned jobs;
- optional two-factor authentication for users, and required extra verification for LeadLock staff tools;
- signature checks on incoming Twilio and Stripe webhooks; and
- logging of sensitive actions by LeadLock staff.
No system is perfectly secure. If we learn of a breach affecting your information, we will notify affected businesses and people as the law requires. See Trust & Security for more.
13. Your privacy rights
Depending on where you live, you may have the right to know what information we have about you, get a copy, correct it, delete it, and opt out of its sale, sharing for advertising, or use for profiling. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states have these rights under state law.
To make a request, email privacy@leadlockai.ai. We will confirm your identity before acting, usually by checking the email or phone number on file, and respond within 45 days. You can use an authorized agent if you give them written permission. If we deny your request, you can appeal by replying to our decision, and we will explain the result of the appeal.
We won't treat you differently for using your privacy rights.
Business owners can export or delete their workspace data from Settings, or ask us to do it.
14. If you contacted a business that uses LeadLock
If you called, texted, chatted with or booked a business that uses LeadLock, that business controls your information. Please send privacy requests to the business directly. If you contact us instead, we will pass your request to the business and help it respond. To stop texts, reply STOP to any message.
15. Children
LeadLock is for businesses and is not directed at children under 16. We don't knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.
16. Where data is processed
LeadLock is built for businesses in the United States, and information is stored and processed in the United States. Some service providers may process data in other countries under contracts that protect it.
17. Changes to this policy
We update this policy when LeadLock or the law changes. We change the "Last updated" date at the top and, for significant changes, notify business owners by email or in the app before the change takes effect.
18. Contact us
LeadLock AI Technologies LLC
Privacy: privacy@leadlockai.ai
Support: support@leadlockai.ai
Website: www.leadlockai.ai