1. Who is responsible
For account data of LeadToC customers, Xapp Digital Solutions is the controller.
For lead data — the people who fill in our customers' forms, open their status pages or book meetings — the business using LeadToC is the controller and we process that data on its behalf and on its instructions. If you are a prospect of one of our customers, please contact that business about your data; we will help them respond.
2. What we collect
| Data | Details |
|---|---|
| Account data | Name, email address, password (stored as a bcrypt hash), role, workspace details you enter during onboarding. |
| Lead data | Whatever a customer's forms collect (typically name, email, phone, company and message), qualification answers, notes, stage history, emails sent, meetings, and source details such as landing page, referrer and UTM parameters. |
| Technical data | IP address and browser user agent for sign-in sessions, form submissions and security logs; timestamps of activity. |
| Integration credentials | Email-provider API keys and Google Calendar refresh tokens that customers connect. These are encrypted at rest. |
3. How we use it
- To provide the service: capturing leads, sending the emails customers configure, showing status pages, booking meetings and running automations.
- To secure the service: authentication, rate limiting, abuse prevention and audit logs.
- To communicate with customers about their account, such as verification codes and service notices.
- AI features, when a customer uses them, send the relevant business and lead context to our AI provider to produce a draft. Drafts are not used to train models by us.
5. Service providers
| Provider | Purpose |
|---|---|
| Hetzner Online (Germany) | Hosting of servers and databases. |
| Amazon Web Services (SES) | Delivery of emails sent through LeadToC. |
| OpenAI | AI-assisted drafts and summaries, only when AI features are used. |
| Calendar availability and events, only for workspaces that connect Google Calendar. | |
| Let's Encrypt | SSL certificates for customer domains (domain names only). |
| Customer-chosen email providers | When a customer connects Mailgun, SendGrid, Postmark, Resend or their own Amazon SES account, their emails are sent through it. |
6. Retention
Account and lead data is kept while the workspace is active. Customers can delete leads at any time. Expired sessions, verification codes and password-reset links are removed automatically. When a workspace is closed, its data is deleted within 30 days, except where we must keep records for legal reasons.
7. Security
All traffic uses HTTPS. Workspaces are isolated so one customer can never access another's data. Public links use random tokens that are stored only as hashes, can expire and can be revoked. Integration credentials are encrypted, and access by our staff to customer data is limited to what is needed to operate and support the service.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to or restrict its processing. Account holders can update most details in the app. For anything else, contact info@xappdigital.com. Prospects of our customers should contact the business they reached out to.
9. Contact
Xapp Digital Solutions · info@xappdigital.com · Support: support@leadtoc.com