Privacy policy

In short

• Lead Magnet Oy makes the apps our clients use for their websites, leads, customer conversations and search visibility: LeadCore, LeadChat, LeadStudio, LeadSEO, LeadEdge, LeadStats, LeadMail, the Lead Magnet app and the MagnetID sign-in.
• We decide how your data is used (we are the controller) when you have an account in our apps, when your company pays us, and when we offer our services to you. Most of this policy is about that.
• When a business uses our apps with its own customers (a form you send on its website, a chat or an email you send it, your visit to its website), that business decides and we only process the data for it. Its own privacy notice applies, and you should contact it first. See section 3.
• We keep your data in the EU. Our servers and file storage are in Helsinki, Finland, our backups in Germany, and the AI models that work on our clients' data run in France. The few exceptions are listed in section 8.
• We don't sell personal data, we don't show ads, and we don't use your data to train AI models.
• You can ask to see, correct or delete your data, and you can object to how we use it. Write to privacy@leadmagnet.fi. If you have an account, you can also ask for its deletion in LeadCore (Profile → Delete my account).

---

1.Who we are

Lead Magnet Oy (Business ID 3466406-7, VAT FI34664067) Sturenkatu 26 LT 36, 00510 Helsinki, Finland General enquiries: info@leadmagnet.fi Privacy questions and requests: privacy@leadmagnet.fi We have not appointed a data protection officer. Write to privacy@leadmagnet.fi about anything to do with your data.

2.What this policy covers

This policy covers our apps and their public pages:

App	Address	What it does	Who uses it
LeadCore	leadm.app	the client portal: reports, leads, requests, documents, invoices, users and notification settings	our clients' staff and our staff
LeadChat	chat.leadm.app; the chat window from leadm.chat; email to in.leadm.chat	one inbox for a business's website chat and email, with an optional AI assistant	our clients' staff; the business's customers write to it
LeadStudio	studio.leadm.app; previews at preview.leadm.app; websites at leadm.site or the client's own domain	editing a client's website with AI help, private previews of changes, and hosting the finished website	our clients' staff and our staff
LeadSEO	seo.leadm.app	search visibility analysis and SEO reports	our staff; the reports go to the client
LeadEdge	edge.leadm.app	receives the forms on the websites we build and passes them to LeadCore	no client screens
LeadStats	stats.leadm.app, e.leadm.app	cookieless visitor statistics for the websites we build	our staff; the numbers appear in LeadCore
LeadMail	mail.leadm.app	sends the apps' emails	no client screens
MagnetID	login.leadm.app	the shared sign-in for all our apps	everyone with an account
The Lead Magnet app	iPhone and Android	LeadCore and LeadChat on a phone	our clients' staff

It does not cover:

• leadmagnet.fi, our marketing website, which has its own privacy notice (https://leadmagnet.fi/privacy/);
• our clients' own websites and services, even when we build or host them. The client's own privacy notice applies there (section 3);
• our own employees' data, which we handle as their employer.

3.When we work for a business (processor)

Much of what our apps do happens for a business, on its website or with its customers. The business decides what is collected and why: it is the controller, and we are its processor, bound by a data processing agreement (DPA) with it. This applies to:

• forms sent on the business's website (its leads), and sending them on to the email addresses, CRM or other systems the business chooses;
• chats and emails sent to the business through LeadChat, and its answers to the satisfaction question;
• emails our apps send on the business's behalf;
• visitor statistics for the business's website;
• the content of the business's website, such as the names and photos of its staff.

If you are a customer of such a business, or you visited its website:

• the business's own privacy notice tells you how your data is used;
• send your requests (to see, correct or delete your data) to the business. If you send them to us, we pass them on to the business and help it answer.

What our tools do on a business's website, for reference. The business's own notice is what governs.

Forms (LeadEdge)

• A form you send is held encrypted only until it reaches LeadCore, and for at most 72 hours if LeadCore can't be reached. A record that a form was delivered, with no form contents, is kept 90 days, and daily counts per form about 13 months.
• Spam protection (Altcha): your browser solves a small calculation before the form is sent. It runs on our own server; no third party (no Google reCAPTCHA) is involved, and nothing is stored in your browser.
• Your IP address is used only to limit repeated sending, for at most a day, and is not passed on or stored with the form. The form sets no cookies.
• In LeadCore, the business's leads are kept encrypted and deleted automatically 12 months after they arrive.
• If the form asks for your agreement (for example to be contacted), the text you agreed to and the time are kept with the lead, as the business's proof.

Where a business sends its leads (LeadCore)

• The business decides where its leads go: to its lead inbox in LeadCore and, if it chooses, as a copy to an email address, to its own CRM or another system through a webhook (also through tools such as Zapier, Make or n8n), or by letting its own system fetch them from LeadCore with an access key. These destinations are the business's own choice and its own recipients; their terms and privacy notices apply there.
• What is sent: your name, email, phone, company and job title, your message and the form's answers, the page and website the lead came from with its campaign tags and the referring page, the business's handling status and notes, and, if the form asked for your agreement, the text you agreed to and when. Your IP address and browser details are never sent. Links to a chat and its files are sent only if the business turns that on; the conversation and the files themselves stay in LeadChat.
• The business's admins are told every time a new destination or access key is added.
• How long: LeadCore keeps a log of each delivery (where, when, whether it arrived), without the lead's content, for 12 months. When a lead is deleted, on request or when its 12 months end, LeadCore tells the business's webhook destinations and lists the deletion for systems that fetch leads, so they can delete it too. What has already reached the business's own systems is kept and deleted by the business.

The chat window (LeadChat)

• Before you open it, the chat sends us nothing apart from loading the chat button from leadm.chat. It sets no cookie on the business's website.
• When you start a chat, the chat window (served from leadm.chat, a separate address from the business's website) keeps a session key in your browser's storage for that address, or only for the open tab where the browser doesn't allow it. The business's website keeps a small note (lc_has_chat, which holds no key) so the chat window can show replies when you come back. A chat window you opened but never wrote in is deleted after 30 days.
• The spam check is the same Altcha calculation as on forms. Your IP address is used only to limit abuse (for example, how many chats one address can start in a day); we don't look up your location.
• If you are signed in on the business's website, the website can tell the chat who you are (name and email), so you don't have to type them.
• Files you send are checked for viruses, and photos lose their location and other embedded data.
• If the chat becomes a lead: when the business's staff, or its AI assistant, mark a conversation as a lead, your name, email, phone, company and job title, the topic, the page you wrote from and the notice shown in the chat go to the business's leads in LeadCore, and on to wherever the business sends its leads (above). The conversation itself stays in LeadChat.
• The AI assistant: if the business has turned it on, an AI assistant may answer first. It says it is an AI, it answers from the business's own information, and a person takes over whenever you ask ("Talk to a person"). Your messages then go to AI models in France (section 6). The business sees the whole conversation.
• Translation: the business's staff can have your messages translated into their language. The translation is made by AI models in France and kept with the message.
• The satisfaction question: when a chat is marked done, the chat window may ask once how it went: a rating from 1 to 5 and an optional comment. The business sees your answer on the conversation, and its LeadCore reports show only totals (how many answered, the average).
• How long: conversations, the people in them and their answers are kept for the period the business has set (between 3 and 24 months, by default 12 months after the last activity), and deleted earlier if the business asks us to delete what concerns you. Files and translations go with their messages. When a business stops using LeadChat, its data there is deleted 30 days later.

Email to a business's LeadChat inbox

A business can bring its email into LeadChat in two ways:

• Forwarding: the business forwards its mailbox to its own LeadChat address at in.leadm.chat. Mail to that address arrives at our own mail relay in Helsinki, which checks it for spam and passes it to LeadChat. The relay doesn't keep the mail: it waits in its queue for at most 3 days if LeadChat can't be reached. Its logs keep the sender and recipient addresses for 14 days, and the spam check's results (no addresses) for 4 days. To recognise spam, the relay looks up the sending server's address and the domains in the mail in public spam blocklists (by DNS); no content leaves the relay.
• IMAP: the business connects its mailbox with its address and an app password. LeadChat then reads new mail in the inbox, and the headers (sender, recipients, subject) of new mail in its Sent folder, to find the replies its team sends from its own email program to a conversation in LeadChat. Only those replies are kept; the rest of the sent mail stays in the mailbox. Reading the Sent folder can be turned off for each inbox. The password is stored encrypted.

Either way, emails, their attachments and the original message are kept as conversations are (above). Replies the business's team writes in LeadChat are sent through LeadMail from the business's own address, or, until the business has set up its domain for sending, as "{business} via Lead Magnet" with replies going to the business's address (section 4, "Emails from the apps").

When the business removes an email inbox, we delete its stored password or sign-in at once. Its conversations stay until the business's retention period ends, unless its admin chooses to delete them at once.

Visitor statistics (LeadStats)

• No cookies, and nothing stored on your device. The statistics script stores nothing in your browser and reads nothing stored there, except one opt-out note a website can offer (below).
• What is recorded: the page you view (its address with only campaign tags kept, other query parts dropped, and anything that looks like an email address or a long code masked), the page you came from (without its query), the page title, the campaign, your browser, operating system, device type, screen size and language, and your country, region and city, estimated from your IP address. On the websites we build, it also records when you click a button, a phone or email link, a download or a link to another site, start or send a form, or open the chat, with the page, the language and the name of the form or element. Ad click identifiers are recorded only as "present".
• Your IP address is not stored. Together with your browser details and a random value that changes every month, it is turned, one way, into an id that recognises your visits to the same website during the same calendar month. At the end of the month the random value is deleted from the live database, so the next month's visits can't be linked to the earlier ones. Copies of it stay in our backups until they expire (section 8). A website can pass its own visitor id instead; the websites we build don't.
• How long: 26 months, then deleted.
• Opting out and deleting your visits: a website can offer a button that stops the statistics in your browser (it stores the note umami.disabled in your browser for that website). Each website can also link to a page where you can delete your visits to that website this month: the page finds them from your IP address and browser, so use it from the device and network you visited from.

Websites we build and host (LeadStudio)

• The websites we build run on our own servers in Helsinki. Their contact forms go through LeadEdge, their statistics through LeadStats and their chat through LeadChat, as above.
• Server logs: the hosting server's web server keeps a standard access log of the address requested, the time, the referring page and your browser details, for 14 days.
• Google tags and other tools: we add Google's tags (Analytics, Ads) to a client's website only with a consent tool that asks visitors first. Today no website gets Google tags through us.

4.When we decide (controller): what we collect, why, and for how long

Why	Whose data	What data	Legal basis	How long
Your account and sign-in	our clients' staff, our staff, affiliates	name, job title, email, phone, language, appearance (light or dark), profile picture, notification choices, your MagnetID user id; in MagnetID also a username, your password (stored only as a hash), your passkeys and your two-factor settings	performing a contract with you, or our legitimate interest in providing the service your organisation ordered	while you have an account. An invitation that is never accepted is deleted when it expires (7 days), together with the unused sign-in account. For deletion, see section 13
Access and roles	our clients' staff	which client and services you belong to, and your role	as above	while you are a member. LeadChat keeps its copy for 30 days after your last membership ends
Signing in between the apps	everyone who signs in	MagnetID's sign-in session (a cookie on login.leadm.app). When you open another of our apps, it asks MagnetID in the background whether you are already signed in, so you don't see a sign-in page again	as above	the MagnetID session ends after 7 days without use and after 30 days at most, and its cookie when you close the browser
Keeping the apps secure	everyone who signs in	your session's IP address and browser details; a record of each web sign-in; the phone sessions seen by our apps; a log of refused sign-ins and account re-links (ids only); MagnetID's sign-in and admin events; a log of when our staff open a client's LeadChat to help, and what they did there (ids and the action only); a record that you signed out everywhere; a record of who added a lead destination or access key, or changed where the company's leads go	our legitimate interest in protecting accounts and the service; our legal duty to keep data secure (GDPR Art. 32)	sessions end 120 minutes after your last activity, and the apps clear expired session records as they are used; web sign-in records 31 days; phone sessions 100 days after their last use; the refused sign-in log 12 months; MagnetID's events 90 days; LeadChat's support access log 24 months; staff actions in LeadChat as long as the request they belong to, or 12 months; the sign-out record 30 days after the other apps have acted on it, 100 days at most; the lead-sharing record 12 months
Logs	everyone who uses the apps, and visitors to websites where our tools run	the apps' error logs, which can hold data from the failed request; the mail relay's logs (section 3); the sign-in server's access log (IP address, browser details, the address requested without its query, the time)	our legitimate interest in running the services securely and fixing faults	the apps' logs 14 days; our app servers keep no access logs; the sign-in server's access log 14 days. We use no external error-tracking service
Billing and payments	the client's billing contact	company, Business ID, address, VAT number, billing email, billing contact's name and phone, e-invoice address, invoices and charges; for card payments the Stripe customer id, card brand and last four digits (the card itself is held by Stripe)	performing the contract; our legal duty to keep accounts	at least as long as the Finnish Accounting Act requires: invoices and other vouchers 6 years, the accounts themselves 10 years; the payment events Stripe and our invoicing service send us, 90 days
Contracts, acceptances and consents	our clients' staff who sign, accept or open documents	name, email, IP address, browser details, time and a fingerprint of the document signed; acceptance of terms (with the name and email address you had then); turning AI features on or off (who, when, which terms version, IP address, browser); when a document was first opened and each time its PDF was downloaded (who, IP address, browser), which your company's admins can see	performing the contract; our legitimate interest in being able to show what was agreed	while the agreement is in force, and after it as long as a claim about it can still be made; not deleted automatically
Using the services	our clients' staff and our staff	requests, comments and "Ask us" messages, files you attach and their names; your instructions in LeadStudio's editing chat, and before and after images of the pages changed; your name as the author of each change you make to a website, in the website's change history and in LeadCore's site activity log	performing the contract with your organisation	requests, comments, messages and their files while your organisation uses our services, not deleted automatically; LeadStudio's editing chats and page images, and LeadCore's site activity log, while the website is with us, not deleted automatically; LeadStudio's working copy of a website on our session server, 30 days after its last editing session; the website's change history for as long as the website exists (it can be handed to the client with the website); when a website is deleted, its history, editing chats and page images are archived until we delete them by hand
Notifications	app users	notifications in the apps; for push notifications, the phone's or browser's push address, an install id, the platform, the app's version and language, and whether previews are on	our legitimate interest in telling you about your organisation's leads, messages and requests	in-app notifications 90 days; push addresses until you sign out, remove the device or your account is deleted
Offering our services	people we sell to, and people referred to us	name, email, phone, company, job title and your message; for a 49 € website demo also country, VAT number and website; the public content of your company's website when we prepare a proposal or a demo	our legitimate interest in selling to businesses; performing the contract when you order a demo	an unpaid demo order is deleted after 24 hours; a demo site is taken offline after 14 days; if you never buy, your details are anonymised 120 days after you paid (the payment and invoice are kept for accounting); other sales records while we are in contact with you, not deleted automatically
Affiliate programme	affiliates	name, email, phone and payout invoices	performing the contract; our legal duty to keep accounts	uninvoiced earnings expire 12 months after they accrue; the affiliate's own record while you take part, not deleted automatically; payout invoices as for billing
SEO reports	the client's contacts who receive reports	name and email	our legitimate interest in sending the client the reports it ordered	while the client keeps you on its report list, not deleted automatically. Unsubscribing stops the emails at once
Emails from the apps	everyone our apps email	recipient, sender, subject and delivery status; the content	the same basis as the email's purpose; our legitimate interest in showing that an email was delivered	delivery records 90 days (a business's LeadChat email 30 days); checks that an address exists 30 days; the content at most 7 days; LeadCore's record of mail that couldn't be delivered 90 days
AI features	our clients' staff and our staff	what you type into an AI feature and the content it works on	performing the contract; AI features on a client's data run only after the client has turned them on	our AI gateway stores no prompts or answers (section 6). The apps keep their own: LeadStudio's editing chats (above), LeadSEO's analyses (24 months), LeadChat's AI records (ids and counts only, 13 months), and the conversations of LeadCore's staff assistant, which only our staff use (while the staff member has an account)
Profile pictures	app users	a picture you upload, re-encoded without its location and other embedded data and scaled down; without one, the picture from your MagnetID account, or your initials	our legitimate interest in showing who is who	while you have an account

Not deleted automatically. Where the table says so, no job deletes the data on a schedule. We delete it by hand when it is no longer needed: when you or your organisation ask us, or after your organisation's agreement with us has ended, as our General Terms describe (https://leadm.app/terms). Records that show what was agreed, and accounting records, are kept first for the periods above.

Legitimate interests. Where we rely on legitimate interests, you can ask us for the balancing test we made. You can also object: see "Your right to object" in section 13.

What you must give us. To give you an account we need your name and email address. To invoice your company we need the billing details the contract and accounting law require. Without them we can't give you access or invoice. Everything else is optional.

Automated decisions. We make no decisions about you that have legal or similarly significant effects based only on automated processing. LeadChat's AI can suggest that a conversation is a likely lead, so that the business's staff follow it up.

5.Where the data comes from

• From you, when you use the apps, sign, write to us or fill in a form.
• From your organisation. If an admin at your company invites you, they give us your name, email address and role. If your company names you as its billing contact or as a recipient of reports, it gives us your name and email address (and, for billing, your phone number). If this is how we got your details, this policy is our notice to you.
• From an affiliate or another person who refers your company to us through our referral form.
• From services you connect: Google Search Console (section 9); Stripe gives us the card brand and last four digits.
• From public sources: the public content of a company's website when we prepare a proposal or a demo, and public search data about websites and keywords (section 9).

6.Artificial intelligence

• AI on our clients' data runs only on AI models in France. Every AI feature goes through our own AI gateway (LeadLLM) to OVHcloud's AI models in France. A client's AI works only after the client has turned AI on in LeadCore, and only on the key we issue for that client.
• One exception: website demos. When we build a demo website for a prospect, the AI reads only the prospect's public website, and for design and structure we may use Anthropic's Claude models, which run in the USA. No personal data from our apps goes to them.
• The gateway does not store prompts or answers. It keeps usage records (which key, which model, how many tokens, the cost, and which client and site) for 548 days, and daily totals after that.
• OVHcloud keeps no submitted data and doesn't train on it.
• We don't use your data to train AI models.
• LeadChat: the AI assistant on a business's website, translation of messages, help writing replies, checking messages for abuse, sorting conversations by topic, and turning documents the business uploads into answers for the assistant run only when the business has turned AI on, and its staff see which messages the AI wrote. The assistant answers from what the business has given it (its own information and documents), never from another business's data.
• LeadStudio replaces email addresses, phone numbers, personal identity codes, bank account numbers and the names of the people we have recorded for the website with placeholders before the content goes to a model, and checks every request for them before it is sent. A name we haven't recorded is not replaced.
• LeadCore's reports: the summaries are written with AI from statistics and page-level figures (page addresses, referring sites, per-page Search Console figures and keywords). No contact details are sent.
• LeadCore's proposal drafts: when we prepare a proposal, the AI gets the prospect's company, city and country, the message they sent us, the public text of their website and our staff's brief.
• LeadCore's staff assistant: our staff can ask the AI about a client's reports, figures and alerts, only when the client has turned AI on.
• LeadSEO sends a website's public content, its Search Console figures and up to 50 of its top searches to the AI, to draft SEO advice and to pick the searches that are keywords for the business (section 9).

7.Who we share data with

• Service providers who process data for us (sub-processors). They are listed, with their location and safeguards, at https://leadm.app/subprocessors. Every provider that handles your data for us is bound by a written agreement to protect it at least as well as this policy describes. We tell our clients at least 14 days before we add or replace one.
• Our payment and invoicing services, for our own fees: Stripe charges a client's saved card for us (Stripe Payments Europe, Ireland; Stripe is also a controller in its own right for fraud prevention and its legal duties as a payment provider), and NoCFO Oy (Finland) sends our invoices and keeps our accounts. They handle the billing contact's details, not the data in our clients' services, so they are not on the sub-processor list.
• Extras for one client. When we set up an extra channel or integration for one client through our own account, that provider is listed on the client's own privacy page in LeadCore, not in the public list.
• People in your organisation. Admins in your company see your name, email and role, the requests and messages you write in your company's services, and when you opened or downloaded its documents.
• Services your organisation sets up, such as the email addresses and systems where it sends its leads and chats. These are your organisation's choices, not ours.
• Authorities, when the law requires it.

We don't sell or rent personal data, and we don't share it for advertising.

8.Where your data is kept

We keep and process your data in the EU:

• servers, databases and file storage: Hetzner, Helsinki, Finland;
• backups: Hetzner, Falkenstein, Germany. The nightly backups are encrypted and kept 57 days; a short-term copy of the databases, made every hour, is kept 2 days. Data we delete stays in a backup until that backup expires. A file deleted in LeadCore can also stay as an older version in our file storage for up to 30 days. LeadChat's files are not in any backup, so a deleted file is gone at once;
• AI models: OVHcloud, France.

The exceptions, where data can leave the EU:

Provider	What for	Where	Safeguard
Anthropic	AI for website demos, on the prospect's public website only (section 6)	USA	standard contractual clauses
Stripe	card payments	Stripe Payments Europe (Ireland), with onward transfer to Stripe, Inc. (USA)	EU–US Data Privacy Framework and standard contractual clauses
Google (Search Console)	reading the search data a client shares with LeadSEO	Google Ireland, with transfers to Google LLC (USA)	EU–US Data Privacy Framework
Your browser's push service (for example Google, Mozilla or Apple)	desktop notifications in LeadChat, if you turn them on	depends on your browser	the notification's content is encrypted so the push service can't read it; it sees only the push address
Google (Firebase Cloud Messaging) and Apple (Push Notification service)	push notifications to phones in the Lead Magnet app (section 10)	Google LLC and Apple Inc. (USA)	Google: EU–US Data Privacy Framework and standard contractual clauses; Apple: standard contractual clauses

You can ask us for a copy of the safeguards.

9.Google user data and search data (LeadSEO)

Google Search Console

• What we ask for: read-only access to Search Console (https://www.googleapis.com/auth/webmasters.readonly), and the email address of the Google account you connect with (openid, email), which we keep with your agreement to show which account is connected. We can't change anything in your Search Console.
• Your agreement first. Our staff send you a personal link. On that page you read what Lead Magnet will do with the data and agree to it; we record who agreed, when, in which language and the exact text you saw. Without an agreement in force, nothing is fetched, shown, used or sent on.
• Whose Google account: by default you connect with your own Google account. Alternatively you can give Lead Magnet's own Google account access to your Search Console property.
• What we read: the search performance of the website you allow: daily figures per search and per page (clicks, impressions, positions) and the searches themselves. When you connect, we fetch up to the last 16 months, then each night the latest days.
• Why: to show your website's search visibility, in LeadSEO and in the reports we prepare for you, and to suggest improvements. We use the data for nothing else.
• How we keep it: the permission Google gives us (a refresh token) is stored encrypted on our servers in Finland. The figures are kept for up to 24 months, then deleted. Up to 50 top searches go to our AI in France (section 6), which keeps those that are keywords for your business; at most 10 are stored as keyword candidates.
• Where the data goes: LeadSEO; your LeadCore portal and reports (per-page figures); LeadStudio, which uses the per-page figures to suggest content improvements; the AI (section 6); DataForSEO, but only for searches stored as keywords (to check their search volume and ranking).
• Who sees it: Lead Magnet's SEO specialists, the people in your organisation who see your LeadCore portal and reports, and the people you send reports to. A report email carries a private link to the report; anyone who has the link can open it, so treat it like the report itself. A recipient can unsubscribe from report emails.
• What we never do: sell the data, use it for advertising or credit decisions, pass it to others except to provide our service, or use it to train AI models.
• How to stop: use "Stop sharing" on the agreement page, ask us, or remove Lead Magnet's access in your Google Account at https://myaccount.google.com/permissions. When you stop, or the connection ends, we withdraw the permission at Google and delete the figures and the searches taken from Search Console, in LeadSEO, LeadCore and LeadStudio. What stays: reports already sent to you; text written about your website (page suggestions, drafts and site reports), which can quote a search until it is rewritten or the 24-month period removes it; and keywords our staff chose for your website that contain a search's words.

Limited Use. Lead Magnet's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keyword and ranking data (DataForSEO)

LeadSEO buys public search data from DataForSEO: how often keywords are searched, Google Ads' keyword ideas for a website, which websites rank for a search, and links between websites. What we send is website addresses (the client's and the competitors the client names) and keywords, including the client's services and areas and the searches stored as keywords from Search Console. A search can contain a person's name; that is why only searches the AI judged to be keywords for the business are stored and sent.

Gmail

LeadChat doesn't use Google sign-in to read Gmail. A business that uses Gmail connects it to LeadChat with an app password (IMAP) or forwards it; the messages are then handled like any other email in LeadChat (section 3) and are not data from Google's APIs.

10.The Lead Magnet app

• Sign-in: with MagnetID, in your phone's browser, never inside the app. The app keeps its sign-in key in your phone's secure storage, for that phone only.
• On your phone: the app keeps only your settings (language, theme, the last tab and company shown, the app lock and preview choices, and a random install id). Conversations, customers and searches are in memory only while the app runs. A document or photo you open is a temporary copy, deleted when you close it.
• What the app sends to us: what you do in it (replies, requests, approvals, signatures, searches); with every request, the app's version, your phone's system and version, and your language. We record when you open a document for the first time and when you download its PDF, with your IP address, as on the web (section 4).
• Photos you attach are re-encoded on the phone without their location and other embedded data. The app never asks for access to your photos' location.
• Push notifications go through Google (Firebase Cloud Messaging) and, on iPhones, Apple, only after you allow them. Message previews are off by default: a push then names the company and what happened, never a customer. If you turn previews on, a push can show a customer's first name and the first words of a message. A push that can't be delivered within an hour is dropped.
• Pictures in an email load from the sender's servers only when you tap "Show pictures"; the sender's servers then see your IP address and that the email was opened.
• AI: the app calls no AI service itself. Translation and writing help run through LeadChat on AI models in France (section 6), only when your organisation has turned AI on.
• No analytics, advertising or error-reporting tools, and no advertising id.
• Permissions: notifications (after you agree), photos or the camera (only when you attach a photo), Face ID or fingerprint (only if you turn the app lock on). No microphone, location or contacts.
• Deleting your account: ask for it in LeadCore (Profile → Delete my account) or by email; see section 13 and https://leadm.app/data-deletion.

11.Cookies and browser storage

In our apps we use only what the apps need to work. There are no analytics or advertising cookies, and no statistics script runs in the apps. These are strictly necessary, so we don't ask for consent.

Name	Where	Why	How long
session cookie	every app, and the public pages on leadm.app	keeps you signed in	until 120 minutes after your last activity
XSRF-TOKEN	the apps and their public pages	protects forms from cross-site request forgery	as the session
MagnetID's cookies (Keycloak's own, such as KEYCLOAK_SESSION, KEYCLOAK_IDENTITY, AUTH_SESSION_ID, KC_AUTH_SESSION_HASH, KC_RESTART and KEYCLOAK_LOCALE)	login.leadm.app	the sign-in, the shared session between the apps, and your language on the sign-in pages	the session ones until you close the browser (the sign-in itself ends after 7 days without use, 30 days at most); the sign-in step's ones for minutes
appearance (also in the browser's local storage)	LeadCore, LeadChat, LeadStudio, LeadSEO, LeadEdge	remembers light or dark mode	365 days
sidebar_state	LeadCore, LeadChat, LeadStudio, LeadSEO, LeadEdge	remembers whether the side menu is open	7 days
leadchat.sound (local storage)	LeadChat	whether new messages play a sound	until you change it
lm_preview	LeadStudio's preview addresses	lets you see a private preview of your site	12 hours
LeadStats' sign-in (local storage and a short sign-in cookie)	stats.leadm.app (our staff only)	keeps our staff signed in to the statistics	until they sign out; the sign-in step's cookie 10 minutes

On the websites of the businesses that use us our tools set no cookies (section 3). The chat window keeps its session key and your sound setting in the browser's storage for leadm.chat and a note (lc_has_chat) on the website, and remembers for the open tab whether you already answered the satisfaction question. The statistics store nothing, except the opt-out note umami.disabled if you choose it.

12.Security

• Sign-in: MagnetID offers passkeys, and a password with an optional authenticator-app code. Our staff must use a passkey or an authenticator-app code. You are told by email when your password, passkey or second factor changes.
• Encryption: every connection to our apps uses HTTPS, and the apps reach their databases over encrypted connections. Our backups are encrypted with a key kept offline. Sensitive data is also encrypted in our databases: leads, forms on their way to LeadCore, mailbox passwords and sign-in keys, push addresses, Google connection keys and LeadStudio's list of personal data behind placeholders.
• Files uploaded to LeadCore and LeadChat are checked for viruses, and photos lose their embedded data.
• Support access: when our staff open a client's LeadChat to help, the access lasts at most 30 days, is logged, and is visible to the client.
• Separation: each app has its own database user and can reach only its own data; each client's data is kept apart from the others'.

13.Your rights

You have the right to:

• see the data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• have data deleted, when we no longer need it or have no basis to keep it;
• restrict our use of it while a question about it is being settled;
• take your data with you in a common machine-readable format, where we use it on the basis of a contract or consent;
• withdraw consent at any time, as easily as you gave it, where we rely on consent. This doesn't affect what we did before.

How: write to privacy@leadmagnet.fi. We may ask you to confirm who you are. We answer within one month; if a request is complex we can take two more months, and we will tell you why. It is free.

Deleting your account: in LeadCore, go to Profile → Delete my account, or write to us. We confirm the request and finish it within one month; you can cancel it until then. If an admin at your organisation removes you, your access to that organisation ends, but your account stays until you or we delete it. When we delete an account:

• we delete your name, email address, phone and picture (the account becomes "Deleted user"), your memberships, phones and push addresses, notifications, sessions, open invitations and assistant conversations, your MagnetID account and your passkeys, and your membership in LeadChat and LeadStudio;
• we keep what the law or a contract requires, for the periods in section 4: invoices, signed documents and records of accepted terms (with your name and email address as they were when you signed), the security log (ids only), and your name in the change history of websites you edited;
• we keep a record of the deletion for 24 months: its reference, who asked and how, and a one-way fingerprint of the email address, so we can show it was done.

See also our data deletion page: https://leadm.app/data-deletion.

If a business is the controller (section 3), send your request to that business. If you write to us, we pass it on.

Your right to object

Where we use your data on the basis of our legitimate interests (section 4), you can object at any time, on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for a legal claim.

You can always object to direct marketing. We then stop using your data for it, without asking why.

To object, write to privacy@leadmagnet.fi, or reply to the message you received from us.

14.Complaints

You can contact us first, but you always have the right to complain to a data protection authority, in particular in the EU country where you live, where you work or where the problem happened.

• Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), PL 800, 00531 Helsinki; tietosuoja(at)om.fi; https://tietosuoja.fi/en/contact-information
• Sweden: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm; imy@imy.se; https://www.imy.se/en/about-us/contact-us/

15.Changes to this policy

Every version is dated. We tell our clients and users about material changes by email or in the apps before they take effect, and ask for your consent again where the law or a platform's rules require it. You can ask us for an earlier version.

Languages. This policy is published in English, Finnish and Swedish, and the three say the same. If they ever differ, the English version prevails.

16.Services being replaced

• The old mail service at mail.leadmagnet.dev still sends some email for us while everything moves to LeadMail. It keeps delivery records with no end date, and failed messages in full. Its admin screens load a font from Bunny Fonts (BunnyWay, Slovenia), which receives our staff's IP address.