Privacy Policy

• Account data — name, email, password hash, organisation and workspace names, role.
• Billing data — plan, credit balance and transaction references. Card details are handled by our payment processor (Paystack); we never store full card numbers.
• Workspace content — contacts, deals, content, tasks, brand guidelines and generated assets you create or import.
• Enrichment data — when you use Discover, we retrieve business contact details from public sources and/or third-party providers (see §3).
• Usage data — log data, device/browser information and product events used to operate and improve the service.

We process personal data to provide and secure the service, authenticate you, meter credit usage, process payments, generate content and documents you request, send service and assignment emails, and comply with legal obligations. Our lawful bases are performance of a contract, our legitimate interests in operating the service, your consent (where required), and compliance with law.

Leo’s Discover feature helps you find business contacts for legitimate outreach. It gathers contact details that businesses have published publicly, and — when you choose the verified option — retrieves data from a third-party enrichment provider. We only collect business contact information and do not knowingly collect special-category data. If you are a contact who appears in a customer’s workspace and wish to exercise your rights, contact us and we will route your request to the relevant controller.

When you generate images, video, documents or use the assistant, your prompts and the relevant workspace context are sent to our AI providers (including OpenAI and Higgsfield) solely to produce your output. We do not use your workspace content to train our own models. AI output may contain inaccuracies; you are responsible for reviewing it before use.

We share data only with service providers who help us run Leo, under contract and confidentiality, including: Supabase (database & storage), Paystack (payments), Resend (email), OpenAI and Higgsfield (AI generation), and our enrichment provider. We do not sell personal data.

Some providers process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

We keep account and workspace data for as long as your account is active and as needed to provide the service, then delete or anonymise it within a reasonable period, subject to legal retention requirements.

We use encryption in transit, tenant-scoped access controls and the principle of least privilege. No system is perfectly secure; we work continually to protect your data.

Subject to your jurisdiction (including Kenya’s Data Protection Act 2019 and, where applicable, the GDPR), you may request access, correction, deletion, restriction, portability, or object to processing, and lodge a complaint with your data protection authority. To exercise these rights, email us at the address below.

We use strictly necessary cookies to keep you signed in and operate the service, and limited analytics to understand product usage. You can control cookies through your browser settings.

Leo is a business tool not directed to children, and we do not knowingly collect data from anyone under 18.

We may update this policy and will revise the date above. Questions or requests: privacy@leo.wallacemecha.com.