Privacy Policy

We collect the following categories of information.

• Account information. When you register we collect your name, email address, password (stored only as a salted hash) and, if you sign in with Google, the profile information Google shares with us such as your name, email address and profile picture. We also record which team accounts you belong to and your role in each.
• Billing information. Paid plans are billed through Stripe. We receive your billing name, billing address, the last four digits and brand of your payment card, and your transaction history. Full card numbers are handled by Stripe and are never stored on our systems.
• Content you provide. This includes video, audio, images, documents, article drafts, brand assets, prompts, scripts, keywords, product links and any other material you upload, paste, link or send to the Service, including content sent to a Content Suite ingest email address. It also includes the outputs the Service generates from that material.
• Connected platform data. If you connect a third-party account such as YouTube, TikTok or another publishing destination, we store the access tokens needed to publish on your behalf together with the channel, page or account identifiers, and we receive performance and status information about the content we publish there.
• Research and audience data. Features such as Know and Radar collect information from public web pages, search engine results, business directories, maps listings and social platforms about the topics, competitors and markets you ask the Service to research. This data may include the names, business contact details and public statements of third parties. It is collected from public sources or licensed data providers and is used solely to produce research for your account.
• API keys and credentials you supply. If you choose to bring your own credentials for a third-party service (for example an AI model provider, a publishing platform or an affiliate program tag), we store them encrypted in a secrets vault and use them only to perform the actions you request.
• Compute node data. If you enrol a Leadio Compute Node on your own hardware, we collect the node’s name, software version, capabilities, status, job logs and the technical details needed to route work to it. Content processed by a node stays on that node except for the outputs and status the node reports back to the platform.
• Usage and device information. We automatically log the pages and features you use, the actions you take, timestamps, IP address, browser type, operating system, referring URLs and error reports. We use cookies and similar technologies as described in the Cookies section.
• Communications. If you contact us for support or otherwise, we keep the correspondence and any information you include in it.

We use the information we collect to:

• Provide, operate, secure and maintain the Service, including authenticating you, running production pipelines, generating outputs, storing your content and publishing to your connected channels.
• Process payments, manage subscriptions and send invoices and receipts.
• Send transactional messages such as sign-in links, review requests, job completion notices, billing notices and security alerts.
• Respond to support requests and communicate with you about the Service.
• Understand how the Service is used so that we can fix problems, improve features and plan capacity.
• Detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms of Service.
• Comply with legal obligations and enforce our agreements.
• With your consent, send you product news and marketing. You can opt out at any time using the link in any marketing email.

We do not use your content, your connected account data or your research data to train AI models of our own, and we contractually require our AI model providers not to train on it either (see Third-party processors below).

Many Content Suite features send your content and instructions to third-party AI models to transcribe, summarise, write, translate, generate images, generate speech or music, restyle video, or score and cluster research. When you run such a feature, the relevant portion of your content is transmitted to the model provider, processed, and the output is returned to your account. We select providers that offer zero-data-retention or no-training terms for API customers, and we do not send your content to a provider that does not offer at least a no-training commitment.

AI outputs may be inaccurate, incomplete or reflect biases in the underlying models. The Service places human review gates in front of publishing; you are responsible for reviewing outputs before they are published.

If you bring your own API key for a model provider, that provider’s privacy terms apply to the data processed under your key.

We share personal information only as follows:

• With your team. Information within a team account, including content, research and job history, is visible to the other members of that team according to their roles.
• With destinations you choose. When you publish content, the content and any metadata you set are sent to the platform you selected under that platform’s terms.
• With service providers who process data on our behalf and under contract, listed in Third-party processors below.
• With professional advisers, such as lawyers, accountants and insurers, where necessary.
• In connection with a merger, acquisition, financing or sale of all or part of our business, in which case we will notify you before your information becomes subject to a different privacy policy.
• When required by law, subpoena or court order, or when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud or abuse.
• With your consent or at your direction.

We do not sell personal information and we do not share it with third parties for their own marketing purposes.

We rely on the following categories of providers. The specific vendor for a category may change; this list reflects the providers in use on the effective date.

• Hosting and database: Supabase (PostgreSQL, authentication and file storage, hosted on Amazon Web Services in the United States, us-west-2), Vercel (application hosting and edge network) and Cloudflare (DNS, content delivery and hosting of generated microsites).
• Payments: Stripe.
• Authentication: Google (Google sign-in).
• Transactional email: Resend.
• AI model providers: OpenAI, Anthropic, Google (Gemini), ElevenLabs, fal.ai, Kie.ai and Replicate, used for text, image, audio, music and video generation and analysis.
• Research data providers: DataForSEO (search results and keyword data) and Apify (structured collection from public web and social pages).
• Publishing platforms you connect: for example YouTube (Google) and TikTok. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Analytics and error monitoring: first-party logging, and any monitoring provider disclosed in our cookie policy.

We use strictly necessary cookies to keep you signed in, protect against cross-site request forgery and remember preferences such as your theme. We may use analytics cookies to understand aggregate usage. We do not use third-party advertising cookies. Most browsers let you refuse or delete cookies; if you disable necessary cookies the Service will not work. See our Cookie Policy for details.

We keep your account information for as long as your account exists. Content, generated outputs, research data and job history are kept for as long as you keep them in your account, subject to storage limits of your plan. When you delete an item it is removed from active systems promptly and from backups within 30 days. When you delete your account or a team account, we delete or anonymise its data within 30 days, except that we retain billing records for as long as tax and accounting law require, and we may retain information needed to resolve disputes, enforce our agreements or comply with legal obligations.

Connected platform tokens are deleted when you disconnect the platform or delete the account that holds them. Logs are retained for up to 90 days unless needed for a security investigation.

We protect information using encryption in transit (TLS) and at rest, row-level access controls that enforce team boundaries at the database layer, encrypted vault storage for secrets and credentials, multi-factor authentication for administrative access, and least-privilege access for our staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information we will notify you and the appropriate authorities as required by law.

You can view and update your profile in account settings, export your content, disconnect connected platforms, delete individual items, and delete your personal account or (as an owner) your team account from within the Service.

Depending on where you live, you may have the right to request access to the personal information we hold about you, to have it corrected or deleted, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. Residents of California, Colorado, Connecticut, Virginia, Utah and other US states with comprehensive privacy laws may also have the right to opt out of the sale or sharing of personal information and of targeted advertising; we do neither. We will not discriminate against you for exercising your rights.

To exercise any of these rights, email us at the address at the end of this policy. We may need to verify your identity before acting on a request. If you are dissatisfied with our response you may lodge a complaint with your local data protection authority.

We are based in the United States and the Service is hosted there. If you use the Service from the European Economic Area, the United Kingdom, Switzerland or elsewhere, your information will be transferred to and processed in the United States and in any other country where our processors operate. Where required, we rely on standard contractual clauses or other approved transfer mechanisms with our processors. For users in the EEA and UK, Leadio LLC is the controller of your account information; for content and research data you bring to the platform, your organisation is typically the controller and we act as processor on its instructions.

You are responsible for having a lawful basis to upload content that includes other people’s personal information (for example interview footage or customer testimonials) and for using research data lawfully. Research features collect only information that is publicly available or licensed to us, and we do not use it to build profiles of individuals for our own purposes. If you are a person whose information appears in a customer’s research data and you would like it removed, contact us and we will work with the customer to address your request.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. If we make material changes we will notify you by email or by a notice in the Service before the change takes effect. The effective date at the top of the page shows when it was last revised. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

Questions, requests and complaints about this policy or our handling of your information can be sent to the email address or postal address below. Please include “Privacy” in the subject line.