Privacy Policy

1. Introduction

CaptureLeads AI operates as a data processor on behalf of our Clients, who are the data controllers for information collected through their chatbots. We also act as a data controller for information we collect directly from Clients and visitors to our website (captureleads.ai).

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Information from Clients

2.2 Information from End Users (Chatbot Visitors)

2.3 Information from Website Visitors

When you visit captureleads.ai, we may collect standard web analytics data including IP address, browser type, pages viewed, time spent, and referring sources through cookies and similar technologies.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To operate, maintain, and provide the chatbot platform, including AI-powered conversation processing and lead capture functionality
• AI Processing: Chat messages are sent to our AI language model provider for generating contextually relevant responses in real time. Messages are processed transiently and are not used to train third-party AI models
• Lead Capture and Delivery: To collect lead information provided by End Users and deliver it to the appropriate Client via their configured channels (email, CRM, dashboard)
• Analytics and Reporting: To generate performance analytics, conversation metrics, and lead quality reports for Clients
• Billing and Payments: To process subscription payments and manage Client accounts
• Communication: To send Clients service-related notices, updates, security alerts, and support messages
• Service Improvement: To analyze usage patterns, identify issues, and improve the quality and reliability of the Service
• Legal Compliance: To comply with legal obligations, enforce our Terms of Service, and protect our rights

4. Third-Party Services

We share information with the following categories of third-party service providers, solely to the extent necessary to deliver and support the Service:

We do not sell, rent, or trade personal information to third parties for marketing purposes. We may disclose information if required by law, court order, or government request, or to protect the rights, property, or safety of CaptureLeads AI, our Clients, or others.

5. Data Retention and Deletion

• Client Account Data: Retained for the duration of the Client's active subscription plus 30 days following termination, after which it is permanently deleted unless retention is required by law.
• Chat Conversation Data: Retained for up to 12 months from the date of the conversation to support analytics and reporting. Clients may request earlier deletion.
• Lead Data: Retained until the Client deletes it from their dashboard or account, or until 30 days after account termination.
• Billing Records: Retained for up to 7 years as required by tax and financial regulations.
• Website Analytics: Retained for up to 26 months in aggregated form.

Clients may request deletion of their data at any time by contacting [email protected]. We will process deletion requests within 30 days, subject to legal retention requirements.

6. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for the Service to function properly, including session management and authentication. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website and the Service. These collect aggregated, anonymous data.
• Chatbot Session Cookies: Used to maintain conversation state during a chatbot session and to recognize returning visitors (if configured by the Client).

We do not use advertising or tracking cookies. You can control cookie preferences through your browser settings. Note that disabling essential cookies may impair Service functionality.

7. Client Responsibilities

As the data controller for information collected through their chatbot, each Client is responsible for:

• Privacy Disclosures: Providing clear and conspicuous privacy notices to their website visitors about the use of an AI chatbot and the types of data collected
• Consent: Obtaining any required consents from End Users before collecting personal information through the chatbot, in compliance with applicable data protection laws
• Data Protection Compliance: Ensuring their use of the Service complies with all applicable privacy and data protection laws, including GDPR, CCPA, and any industry-specific regulations
• Chatbot Configuration: Configuring the chatbot in a manner that does not collect sensitive personal data (e.g., health information, financial account numbers) unless appropriate safeguards and consents are in place
• Data Processing Agreements: Enterprise Clients may request a formal Data Processing Agreement (DPA). Contact your account manager or [email protected] to initiate.

8. Your Privacy Rights (CCPA / GDPR)

8.1 California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information, subject to certain exceptions
• Opt-out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

8.2 European Economic Area Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete personal data
• Erase your personal data ("right to be forgotten")
• Restrict processing of your personal data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent

Our legal bases for processing personal data include: performance of a contract, legitimate interests (service improvement, fraud prevention), consent, and compliance with legal obligations.

8.3 Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to verified requests within 30 days (or 45 days if an extension is necessary, with notice). End Users should contact the Client whose website they interacted with, as the Client is the data controller for that information.

9. Data Security

We implement appropriate technical and organizational measures to protect personal information, including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls with least-privilege principles
• Regular security audits and vulnerability assessments
• Secure development practices and code review processes
• Incident response procedures with Client notification protocols

While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such information promptly. If you believe a child has provided personal information through the Service, please contact us at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify active Clients via email at least 15 days before the changes take effect
• Post a prominent notice on our website

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

CaptureLeads AI — Privacy Team
Email: [email protected]

For data protection inquiries from the EEA, you may also contact your local data protection authority.