Privacy Policy

LeadCore AI is an AI-powered lead capture and qualification platform. It provides a chat widget that businesses ("Account Holders") add to their own websites to talk with their visitors and capture leads. LeadCore AI operates the platform from Pakistan. You can contact us at any time at daniyal@agenticcore.tech.

• Account Holders — people who sign up for a LeadCore AI account to manage leads. This policy describes how we handle your data.
• Visitors — people who chat with the widget on an Account Holder's website. For that data, the Account Holder is the controller and we act as their processor. We handle it on their behalf and under their instructions, plus as described here.

Account information you give us when signing up or using the dashboard:

• Your name and email address.
• An optional notification email you choose to receive lead alerts.
• Your password, which is stored only in encrypted (hashed) form by our authentication provider — we never see or store it in plain text.
• Settings you configure, such as your chat widget branding, greeting, and business context.

Lead and conversation data captured through the widget on an Account Holder's site. Visitors may share, and we store:

• Contact details a visitor provides in the chat, such as name, email, phone number, and company.
• Details about their enquiry, such as budget and project scope.
• The messages exchanged in the chat conversation.

Technical and security information collected automatically to keep accounts safe:

• Your IP address and browser/device information at sign-up and sign-in, used to detect fraud and abusive or duplicate accounts.
• Sign-in events (successful and failed) used for security monitoring.
• A session token stored in your browser so you stay signed in.

• To provide the core service: capturing, storing, scoring, and displaying leads in your dashboard.
• To use AI to automatically score leads and generate short summaries. Conversation and lead data is sent to our AI processing provider only to produce these results. We do not train AI models on your data, and our AI provider processes it under their enterprise API terms and does not use it to train their publicly available models.
• To send you transactional emails, such as your sign-up verification code, hot-lead alerts, and (if you opt in) periodic lead digests.
• To secure the platform: rate limiting, bot protection, detecting duplicate or fraudulent accounts, and preventing abuse.
• To respond to your support requests and to comply with legal obligations.

Each account's data is isolated. Account Holders can only see leads and settings belonging to their own workspace; database-level access controls enforce this on the server, not just in the interface.

Platform administrator access. Our authorised platform administrators may access account data, including captured leads, only when necessary to provide support, maintain and secure the platform, prevent abuse, or comply with the law. We do not browse account data for any other reason, and we never sell it.

• Data is transmitted over encrypted (HTTPS) connections.
• Passwords are stored only as secure hashes by our authentication provider.
• Strict database-level access rules keep each workspace's data separate.
• Rate limiting and automated abuse detection help block attacks and fraudulent accounts.

No online service can promise perfect security, but we take reasonable, industry-standard measures to protect your information and continuously improve them.

We do not sell your personal data. We share it only with trusted service providers that help us run the platform, and only to the extent needed to deliver the service. Our current subprocessors are:

• Supabase — managed database, authentication, and backend hosting (data storage).
• Lovable — application hosting, AI gateway used for lead scoring/summaries, and transactional email delivery.
• Cloudflare — content delivery, DDoS protection, and bot-verification (Turnstile) at sign-in and sign-up.

These providers act on our instructions under written data-protection terms and are bound to protect the data. Some of them process data on servers located outside your country; where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses. We may also disclose information if required by law, or to protect the rights, safety, and security of our users and the platform. If we add or change a subprocessor, we will update this list.

If you use LeadCore AI to process personal data of individuals in the EU/UK (or other regions requiring a written data-processing agreement), we offer a DPA on request. Email daniyal@agenticcore.tech to receive a copy.

We keep account and lead data for as long as your account is active so the service works. When you delete your account, your profile, workspace, leads, chat conversations, and settings are deleted from our primary database within 30 days. Limited security records (such as sign-in event logs, abuse-detection records, and email suppression entries) may be retained for up to 90 days for legal, security, and fraud-prevention purposes, and encrypted infrastructure backups may retain data for up to 30 days before rotating out.

• Access and update your account information from your dashboard settings.
• Request a copy of your data, or ask us to correct or delete it, by emailing us — we respond within 30 days.
• Delete your account, which removes your associated data as described above.
• Opt out of non-essential emails such as lead digests at any time in your settings, or via the unsubscribe link in the email.

Visitors who chatted with a widget should contact the relevant Account Holder (the business whose website they used), since that business controls their data. We will assist the Account Holder in responding to such requests.

We use only essential browser storage needed to run the service — specifically: your authentication session (kept by our auth provider), your saved theme preference (light / dark), a record that you accepted the current Terms & Privacy version, and a short-lived bot-verification token from Cloudflare Turnstile at sign-in / sign-up. We do not use third-party advertising or cross-site tracking cookies, and we do not run analytics that profile you across other websites.

Our infrastructure providers may store and process data on servers located in different countries, including outside your country of residence. Wherever data is processed, this policy and reasonable safeguards continue to apply. For transfers of personal data out of the EU/UK, we rely on our subprocessors' Standard Contractual Clauses and equivalent approved transfer mechanisms.

If we become aware of a confirmed security breach affecting your personal data, we will notify affected Account Holders without undue delay — and in any event within 72 hours of confirmation where feasible — by email to the address on file, describing what we know, what data was affected, and the steps we are taking. Account Holders remain responsible for notifying their own end users / visitors where the law requires it.

LeadCore AI is a business tool and is not directed to children. We do not knowingly create accounts for individuals under 18. If you believe a minor has provided us information, contact us and we will remove it.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you. Continuing to use the Service after changes take effect means you accept the updated policy.

For any privacy question or request, email daniyal@agenticcore.tech. We operate under the laws of Pakistan.