Privacy policy
Version 2026-12-08-draft
Draft: for the owner's review (and a solicitor's) before launch. Anything in [square brackets] is still to be filled in.
Who is responsible for your data
[Company name] (company number [Company number]) is the controller of your personal data. We are registered with the UK Information Commissioner's Office, registration [ICO registration number]. Contact us at [Contact email], or write to [Registered address].
What we collect, why, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Account details: email, username, name, password (stored hashed), sign-in and security settings | To run your account, sign you in safely and contact you about it | Contract |
| Amazon seller data through Amazon's API: orders, fees, refunds, payouts, stock, shipments, listings | To show your sales, profit, stock and what Amazon owes you. We never request buyers' names, addresses or contact details. | Contract |
| Your Keepa key and Keepa data, if you add them | Sales history, seller tracking and lookups | Contract |
| Google Sheets and Gmail, if you connect them | Importing leads and costs, and reading order emails you choose to connect | Contract |
| Bank balance and transactions (read only), if you connect Monzo | Your cash flow forecast. We can never move money. | Contract |
| Payments: your plan, its status, payment dates and amounts, invoices (Stripe holds your card) | Your subscription, receipts, and telling you if a payment fails. Stripe takes your card on its own page; we never see card numbers. | Contract; legal obligation for invoices |
| Invitations and access requests: which private invite link you used, when you asked, and our decision | To give free access only to people we invited, and keep a record of who approved it | Legitimate interests |
| Support messages and technical logs (IP address, times, errors) | To answer you, keep LeadVault secure and stop abuse | Legitimate interests |
Who handles data for us
- Lovable Cloud / Supabase: Hosting and database
- Stripe: Payments and invoices
- Our email provider (sent through Lovable): Account and service emails
- The AI provider behind “Explain it to me”: Receives only the figures on screen when you press the button
- Companies House: Public company lookups you ask for
- Cloudflare: Security (the “not a robot” check)
- Amazon, Keepa, Google, Monzo: Only when you connect them, to fetch your own data
We never sell your data, and we never share one account's data with another.
How long we keep it
While you are subscribed, plus 30 days after your account ends (so you can come back or download it), then it is deleted. Invoices and payment records are kept as long as UK tax law requires (normally six years). Security logs are kept for a short time; sign-in codes expire after 10 minutes.
Your rights
You can see, download and delete your data yourself in Settings → Your data. You can also ask us to correct it, restrict or object to how we use it, or ask any question about it. If you are unhappy with how we handle your data you can complain to the ICO (ico.org.uk).
Cookies and browser storage
We only use what LeadVault needs to work: your sign-in session and your own preferences (theme, layout, wallpaper) stored in your browser, and Cloudflare's “not a robot” check on sign-in. No advertising or tracking cookies, so there is no cookie banner. The full list is in our cookie policy.
International transfers
Some providers above may process data outside the UK. When they do, we rely on the UK's adequacy regulations or the approved contract terms (the UK International Data Transfer Agreement or Addendum).
Changes
If we change this policy in a way that matters, we will email you and show it in the app before it applies. The version above tells you which one you are reading.