Privacy Policy

What this covers

This policy covers leverkit.com and the LeverKit lead system, the app at leadsystem.projects.leverkit.com that LeverKit runs for the businesses we work with. The same app may also run at addresses our clients own and point to it (a subdomain of their own website, for example). Wherever it runs, it's the same LeverKit app, run by LeverKit under this policy.

What this site collects

leverkit.com is an informational website. It has no user accounts, it does not set cookies of its own, and it uses no advertising trackers. The personal information we receive (such as your name, email address, and phone number) comes only from what you provide when you book a call, submit a form, or email us. We do not sell personal information.

Analytics

We use PostHog, a product analytics service, to understand how the site performs: pageviews, clicks on booking buttons, and whether a booking was completed. It runs without cookies: it stores a randomly generated identifier in your browser's local storage, which may also decide which version of a page you see if we run content experiments. PostHog processes this data on our behalf and is not permitted to use it for its own purposes.

Booking a call

The booking buttons on this site open a scheduling widget provided by LeadConnector (HighLevel), served from our booking domain, links.leverkit.com. The widget sets its own cookies when it opens, as described in LeadConnector's privacy policy. Any information you submit there (such as your name, email address, phone number, and answers to booking questions) is collected by LeadConnector on our behalf and shared with us so we can prepare for and hold the call. We use that information only to communicate with you about your inquiry and our services. If you provide your phone number, appointment confirmations and reminders may come by text (see “SMS / text messaging” below).

Email

If you email us at contact@leverkit.com, we receive whatever information you choose to include. We use it to respond to you, keep it as long as reasonably needed for our correspondence and legal obligations, and do not sell it or share it with third parties except service providers that process email on our behalf.

The lead system

The lead system answers and follows up with a business's leads by text, email and phone, books their appointments and keeps the business's records of them. It handles two kinds of personal information.

About a business's customers and leads: name, phone number, email address, address (for a visit), what they asked for, the messages exchanged, written notes of calls with the system's assistant (a transcript and a summary; the system doesn't record call audio), appointments, and where the lead came from (the form, the page and the ad). We handle it on the business's behalf, to provide the service the business asked for. We don't sell it and don't use it for our own marketing. The business's own privacy policy says how the business uses it.

When a business stops. We delete its records within 30 days after its engagement ends. If it asks for an export first, we send it before we delete. We keep anything longer only where the law requires it.

About the people who use the system for a business (owners and staff): name, email address and phone number, to sign in, get alerts and take appointments.

Service providers run parts of the system for us: Vercel (hosting), Neon (the database), Twilio (calls and texts), Resend (email), and Anthropic and xAI (the AI models that read and write messages and talk on calls). They process the information only to provide their service to us. The AI providers' business terms bar them from training their models on it unless a customer opts in, and we don't.

Google and Microsoft calendar data

A person at a business can connect their own Google Calendar or Microsoft Outlook calendar to the lead system. When they do:

What it accesses. From Google: the free and busy times of the calendars they choose (start and end only, no titles, notes or guests), the list of their calendars so they can choose which count as busy, the events the system itself creates, and their email address. From Microsoft: the start, end and busy status of the events on their calendar, the events the system itself creates, and their email address. From iCloud or another calendar connected with an app password: the events in the window it checks (the next 15 days), read to work out when they're busy, and the events the system itself creates. From a private calendar link: the whole feed, read the same way. In both cases only the start and end times are kept; titles, notes and guests are never stored.

How it's used. To offer only times they're free. To put each booking on their calendar with the customer's details, and keep it in step when it's moved or cancelled. To notice when they move or delete one of those bookings on their calendar. And, when the business turns it on, to add a Google Meet or Microsoft Teams link to the booking. The system reads back only the events it created.

What's stored. Busy times for the next 15 days, replaced at least every five minutes; the ids of the events the system created; the account's email address and the calendars chosen; and the sign-in (a token, or the app password for iCloud and similar calendars). No details of any other event are stored.

How it's protected. Sign-ins (tokens and app passwords) are encrypted (AES-256-GCM) before they're stored. The database is encrypted at rest and takes only encrypted connections, and the system is served only over HTTPS. A business's records open only for the people that business allows.

Who sees it. The business's own users see their bookings and when people are free. The assistant that talks to customers is told only which times are open, never what's on a calendar. Beyond that, calendar data reaches only the providers that host the system (Vercel and Neon), and anyone the law requires. No one at LeverKit reads it unless you ask us to for support, to look into security or abuse, or when the law requires it.

What it's never used for. Selling it, advertising, or training AI models. Information from Google Workspace APIs, Google Calendar included, is not used to develop, improve or train non-personalized AI or machine learning models, and neither is Microsoft calendar data.

How to stop it and delete it. Disconnect on the Calendars screen at any time: the system deletes the stored sign-in, the account's email address, the busy times and the calendar list at once, and for Google it also revokes its access at Google. Microsoft and Apple give apps no way to revoke themselves, so remove LeverKit there too: your Microsoft account's app permissions, or the app password in your Apple Account. The steps for each are on the lead systems page. Bookings already on your calendar stay there as your events. To have the rest deleted too, email contact@leverkit.com; we delete it within 30 days.

Google user data

LeverKit's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements (see Google's Workspace API user data and developer policy).

Ad platforms

When a business connects its own Meta or Google Ads account, the system tells that account when a lead from its ads comes in (by a form, by phone, or through the ad platform's own lead form), books or becomes a job, so the business can see what its ads bring in. Email addresses, phone numbers, names and our own id for the contact go only as one-way hashes, with the ad click's or lead's identifiers, the page the lead came from, the values the business gives bookings and won jobs and, for a lead from a web page, the browser's IP address and type (to Meta). They go only to that business's own ad accounts. A business can also have its Meta events sent under Meta's Limited Data Use.

On the business's own website, the lead form also tells the business's Meta pixel and Google tag about each lead, with the email and phone hashed for Google. If your browser sends a Global Privacy Control signal, the form doesn't load the pixel or the tag at all.

Google Local Services leads. When a business turns it on, the system reads the leads in its own Google Local Services account: the customer's name and phone number (or a Google tracking number), the kind of lead and its status, whether it was charged, how long a call lasted, any message text, and a link to Google's recording of the call, which we don't download. It sends Google the business's feedback on each lead (booked, spam, wrong area and the like), with no personal data in it.

SMS / text messaging

LeverKit runs two text programs.

Staff alerts. An internal operational alert program for LeverKit staff and contractors, who opt in at leverkit.com/alerts. The terms on that page describe it in full.

Demo and lead texts. When you fill out a LeverKit form, or call a LeverKit phone line and agree to a text, LeverKit's system may text you about your request: confirmations, reminders, replies and follow-ups, including on our demo lines, which answer as sample businesses so you can try the product. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent is not a condition of purchase.

We collect phone numbers only when you provide them, through a form or a booking flow, and we will only contact you by SMS if you have opted in, for example by submitting a form that discloses you agree to be contacted about your request, including by automated technology. Message frequency varies, and message and data rates may apply.

You can opt out of SMS at any time by replying STOP, and get help by replying HELP. Opting out of SMS does not affect other communications you have requested from us. Mobile numbers and SMS consent are never sold or shared with third parties or affiliates for marketing or promotional purposes; we share them only with the service providers that send messages on our behalf.

Texts for businesses we work with. Texts the lead system sends for a business to that business's own customers go out under that business's text program and the consent its customers gave it; that business's privacy policy applies.

Hosting and server logs

This site is hosted by Vercel. Like most hosting providers, Vercel may process technical request data (such as IP address and browser user agent) in standard server logs for security and operational purposes. The lead system is hosted by Vercel, with its database at Neon, in the United States.

Your choices

You can request access to, correction of, or deletion of personal information we hold about you by emailing contact@leverkit.com. This site is not directed at children under 13, and we do not knowingly collect their information.

If a business that uses the lead system has your information, you can ask that business, or us at contact@leverkit.com, to see, correct or delete it. Reply STOP to any text to stop texts.

Changes

If our data practices change (for example, if we add analytics), we will update this page and its “last updated” date. If we ever use cookies or similar technologies, this policy will describe them before they are used.