Privacy Policy

1. Information we handle

We handle information that you provide or generate while using AfterLeads, including:

• Account information: account, business and team information, such as names, email addresses, roles and account preferences.
• Opportunity information: opportunity and customer information that you enter or import, such as names, contact details, notes, values and follow-up information.
• Operational records: the records needed to schedule, supervise and record follow-up activity.
• Enquiries: details people send through a business’s AfterLeads enquiry page, as described in section 8.
• Follow-up check reports: the details you give if you ask for your follow up check report by email, as described in section 8.
• Usage and feedback: product-usage and feedback information used to provide requested guidance, understand meaningful adoption and improve the service.
• Sign-up source: bounded first-party distribution information associated with a new business account, such as campaign codes, referral or partner codes, the broad source you select and whether you used the public follow up check.
• Technical and security information: what we need to authenticate users, protect accounts, diagnose failures and operate the service.
• Connected providers: Google account and Gmail information (section 2) when you choose to connect Gmail, and WhatsApp Business connection, message and delivery information (section 3) when you choose to connect WhatsApp Business.
• Earlier launch records: launch-list and Early Access information from before the free launch, such as your email address, optional name and business name, application answers, invitation status, access-key redemption records and your separate choice about product updates.

2. Google account and Gmail data

Connecting Gmail is optional. When you connect it, AfterLeads requests only the Google permissions needed for the Gmail features you choose to use:

• Google account email address (userinfo.email) to identify the Google account connected to AfterLeads.
• Manage drafts and send email (gmail.compose) to create, update and send Gmail drafts through AfterLeads, including drafts you review and approve before sending.
• Read Gmail messages and settings (gmail.readonly) to check for customer replies, associate a reply with the relevant opportunity and stop or pause follow-up when a reply makes further automated contact unsafe.

What we read and keep

AfterLeads does not intentionally copy, index or build a searchable archive of your entire mailbox. Server-side Gmail synchronization may continue while your browser is closed. It uses Gmail history and message identifiers to find changed messages, then retrieves relevant message payloads when needed to determine direction, match an existing AfterLeads opportunity, detect a reply, reconcile a send or prevent unsafe duplicate follow-up.

For a relevant inbound message, AfterLeads may transiently process headers and message-body content and retain a plain-text excerpt of up to 3,000 characters, together with the subject, sender or recipient context, timestamps and Gmail message and thread identifiers. Quoted conversation text is trimmed where practicable.

AfterLeads retains message content that you deliberately create, import, approve or attach for an AfterLeads communication, together with delivery and operational records needed to provide and audit the service. Unlinked sent messages are not treated as confirmed opportunity contact merely because the recipient matches a customer.

3. WhatsApp Business data

Connecting native WhatsApp Business is optional and is available only when the integration is enabled for your account. If you connect it, AfterLeads may process your WhatsApp Business Account ID, Phone Number ID, business display number, connection status and the server-side credentials required to operate the connection. Usable credentials are kept in server-side secret storage and are not placed in browser storage, customer-facing history or public connection records.

Messages and delivery events

Meta may send AfterLeads signed webhook events for messages and message states such as sent, delivered, read or failed. AfterLeads verifies the callback before using it. For a known active business connection, AfterLeads may process the customer number, provider message identifiers, timestamps, message type, reply-to context and the relevant message content needed to match a response to an existing opportunity, stop unsafe follow-up, prepare a reply for review and reconcile delivery.

A bounded excerpt of a matched customer reply may become part of that opportunity’s business history. Unknown, disconnected or not-yet-active numbers are not attached to an opportunity, and their customer message content is not retained by the receipt foundation.

AfterLeads is not a general WhatsApp inbox, chat archive, broadcast-marketing tool or group-chat manager. Provider acceptance does not by itself prove delivery, and uncertain delivery or opportunity matching is kept separate from confirmed customer contact and may require user review.

4. How we use information

We use personal information to:

• provide, secure and support your AfterLeads account;
• keep opportunities in a valid follow-up state and show what should happen next;
• prepare, redraft, summarize, approve, send and reconcile follow-up communications according to your selected controls;
• detect customer replies and prevent inappropriate or duplicate follow-up;
• maintain history, reliability, security and audit records;
• provide business-scoped Analytics and user-requested report exports;
• measure aggregate distribution-to-activation cohorts and improve the service;
• respond to feedback and send optional product-guidance emails; and
• respond to support, privacy and deletion requests.

Automated language assistance

When you request a prepared message or related guidance, AfterLeads may use automated language assistance to process the minimum relevant opportunity context, communication history, timing, playbook instructions and user directions needed to provide that user-facing feature. Generated content is assistance, not proof that a customer acted, replied, received a message or accepted an outcome. AfterLeads keeps lifecycle state and delivery evidence separate from generated text.

This assistance is provided by OpenAI. When the next step is a reply to a customer, the context can include a short excerpt of that customer's latest message, which may come from Gmail or WhatsApp. Requests are sent with storage turned off, are used only to prepare the requested text, and are not used to train OpenAI's models. You always review the result before anything is sent.

What we never do with Google user data

We do not use Google user data for advertising, credit decisions, unrelated profiling, sale to data brokers or training generalized artificial-intelligence or machine-learning models. We do not transfer Google user data except as necessary to provide or secure the user-facing service, comply with law, or use infrastructure providers acting for AfterLeads under appropriate safeguards.

5. Google API Services User Data Policy

AfterLeads’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Human access to Google user data is prohibited except where the user gives affirmative permission for a specific support or security purpose, where access is necessary to investigate abuse or a security incident, where required by applicable law, or where data has first been aggregated and anonymized so that it cannot be read as an individual user’s Google data.

6. Storage and security

Gmail OAuth access and refresh tokens are stored encrypted on the server and are not placed in browser storage. WhatsApp Business credentials are kept in server-side secret storage and are not exposed to the browser.

AfterLeads accepts only server-validated Google authorization results, and the Google-verified mailbox identity, not an email address typed into AfterLeads, decides the connected Gmail account. WhatsApp callbacks must pass Meta signature verification before AfterLeads accepts them.

Access to protected account, opportunity and connected-provider data is restricted by authenticated ownership, business isolation and server-side authorization. We use service providers, including hosting, database and communication infrastructure providers, only as needed to operate AfterLeads.

No internet service can guarantee absolute security. We maintain safeguards appropriate to the information and service, and we investigate suspected unauthorized access or disclosure.

If there is a security incident

If we have reasonable grounds to believe that personal information we are responsible for has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 of the Protection of Personal Information Act requires. The notice will explain what happened, what it may mean for you, what we are doing about it and what you can do to protect yourself. Where we hold the information for a business that uses AfterLeads, we will tell that business without undue delay so it can notify its own customers.

Analytics exports are generated only when an authorized user requests them. The downloaded file is then stored wherever that user or their browser chooses, outside AfterLeads’ control. Users should protect, share and delete exported reports appropriately.

7. Sharing and service providers

We do not sell personal information. Infrastructure, communication and automated-language service providers may process only the information reasonably necessary to provide the relevant AfterLeads feature, under contractual, technical and organizational safeguards. We may disclose information:

• to infrastructure and service providers acting for AfterLeads where necessary to operate the service;
• when you direct or authorize the disclosure;
• to protect users, the service or legal rights; or
• when required by applicable law or a valid legal process.

Who is responsible for your information

AFTERLEADS is the responsible party for the information of people who use AfterLeads, sign up, take the follow up check or contact us. For the information a business keeps about its own customers and enquirers in AfterLeads, that business is the responsible party and AfterLeads acts as its operator: we process that information only to provide the service to that business, under the operator terms in section 3 of our Terms of Service. If you are a customer of a business that uses AfterLeads, please contact that business first about your information. We will help it answer your request, and you can also contact us.

Service providers we use

• Supabase: database, sign-in, file storage and backend functions. Your AfterLeads data is stored in the European Union (Stockholm, Sweden).
• Vercel: hosting for the website and app (global network).
• OpenAI: automated language assistance when you request a prepared message (United States).
• Resend: account, security and notification emails sent by AfterLeads (United States).
• Google: Gmail, only when you connect your own Gmail account.
• Meta: WhatsApp Business, only when you connect it.
• Cloudflare: bot protection on sign-in and public forms (global network).
• PayFast: payments, only once paid plans are switched on (South Africa).

Because these providers process information outside South Africa, transfers rely on their contractual data-protection commitments and the safeguards described in this policy, as permitted by section 72 of the Protection of Personal Information Act.

8. Retention and deletion

Account and operational information

We retain account and operational information for as long as needed to provide AfterLeads, preserve required business history, meet security or legal obligations and resolve disputes. Bounded operational and security records that do not contain usable provider credentials may remain where necessary to preserve legitimate history, prevent abuse or meet legal obligations.

Gmail

Gmail OAuth tokens are retained only while the connection is active and needed to provide the connected Gmail features. When Gmail is disconnected through AfterLeads, we disable the connection, attempt to revoke the Google grant and delete the encrypted provider credentials from the active service. Google may separately retain authorization or account records under its own policies.

You may disconnect Gmail in AfterLeads or revoke AfterLeads in your Google Account permissions at any time. Revocation at Google prevents future authorized access but does not automatically remove legitimate AfterLeads opportunity history created before revocation.

WhatsApp Business

WhatsApp Business credentials are retained only while the connection is active and needed to provide the connected features. Disconnecting WhatsApp Business disables the connection and removes usable credentials from the active integration. Meta may separately retain business-account, message, billing or authorization records under its own policies.

AfterLeads may retain bounded signed-callback hashes, provider message identifiers, delivery states, billing classifications and security records where needed to prevent duplicates, reconcile delivery, preserve legitimate business history, investigate failures or meet legal obligations. These technical records do not create a general copy of your WhatsApp inbox.

Analytics and sign-up source

Prospective Admin Analytics uses coalesced business-level records of meaningful product activity. These records do not contain customer identity or message content, have a 180-day retention period and are automatically deleted by a daily process once they are older than that period. This limited analytics retention does not delete your opportunities or their business History.

Business-level distribution attribution is retained with the account so AfterLeads can compare aggregate acquisition, activation and retention cohorts over time. It does not store raw landing-page queries, search terms, browsing history, customer details or message content, and it is removed when the associated business account is erased from the active service.

Enquiry pages

When someone sends an enquiry through a business’s AfterLeads enquiry page, we pass their name, contact details, company and message to that business and keep them in its workspace, where the business decides what to do with them. We act for that business when we handle these details. We also keep a short-lived, scrambled record of the sending network to stop spam, and delete it after 30 days.

Follow up check reports

The follow up check runs in your browser and saves nothing unless you ask for the report. If you ask for your report by email, we keep your email address, any name or business name you give, your latest answers and result, and whether you agreed to other emails. We use this to send the report, to prevent abuse and to keep a list of people who took the check. We only send you other emails if you ticked the box for them. You can ask us to remove you from this list at any time by emailing lebogang@afterleads.co.

Earlier launch records

Launch-list and Early Access application records from before the free launch are retained while they are needed to manage launch notices, invitations, abuse prevention, consent records or requests, and for a limited period afterwards where appropriate. A waitlist submission does not create an AfterLeads account. Early Access keys are stored as one-way hashes, and security audit records do not contain the original key.

Deleting an opportunity

When an authorized user permanently deletes an opportunity after the in-product confirmation, AfterLeads removes that opportunity and its dependent operational records from the active service. Deletion is final in the product; limited encrypted backups, security records or legally required records may persist for a bounded period before expiry.

Deleting your account

You may request account deletion from Account Settings after secure reauthentication. A newly accepted request has a server-controlled 30-day cancellation period. Account access and owner-controlled automated contact are suspended when the request is accepted. Cancelling within that period restores account access, but does not automatically restart cancelled outreach or renew a cancelled subscription.

If you are the sole owner of a business, finalization removes that business and its active-service opportunities, files, connected-account data and dependent records after required provider cleanup is verified. An owner cannot use self-service deletion while another active member remains in the business.

If you are a member of a shared business, deleting your account removes your identity and memberships while preserving the business and its records; required historical attribution is de-identified rather than deleting shared evidence. Limited encrypted backups, security records, provider records or legally required records may remain for a bounded period before expiry.

You may also request deletion of remaining Google-related data or exercise a privacy right by emailing lebogang@afterleads.co. We may need to verify your identity before completing a request. Some limited records may be retained where required for security, fraud prevention, legal compliance or the establishment, exercise or defence of legal claims.

9. Your choices and rights

You may choose not to connect Gmail or native WhatsApp Business, revoke access through the relevant provider, request disconnection, correct information in AfterLeads and request access to or deletion of personal information. Manual WhatsApp use through your own device remains separate from a native provider connection.

Optional product-guidance emails can be turned off in Account Settings; essential account, security and requested service communications are separate. If you opted in to product updates, including when you joined the launch waitlist or requested Early Access without agreeing to marketing, you may withdraw that choice at any time by using the unsubscribe method in the message or contacting us. You may also ask us to remove a waitlist or Early Access request.

Your rights under POPIA

Under South Africa’s Protection of Personal Information Act you have the right to:

• ask whether we hold personal information about you and get a copy of it;
• ask us to correct, update or delete information that is wrong, out of date, excessive or no longer needed;
• object to us using your information, including for direct marketing, at any time;
• withdraw consent you gave us, without affecting what we lawfully did before; and
• complain to the Information Regulator at inforegulator.org.za.

To use a right, email lebogang@afterleads.co. We may ask you to confirm your identity first. We aim to answer within 30 days and will tell you if we need longer or if the law lets us decline. Asking for a copy of your own personal information is free. Requests for other records follow our PAIA manual.

10. Children

AfterLeads is a business service and is not directed to children.

11. Changes to this policy

We may update this policy when the service or applicable requirements change. We will publish the updated date and provide additional notice where required.

12. Contact

Privacy questions and requests may be sent to:

Our Information Officer under the Protection of Personal Information Act is Lebogang Ribisi, reachable at the same address. Requests for access to records under the Promotion of Access to Information Act (PAIA) can also be sent there. Our PAIA manual explains how.