Privacy Policy

Effective Date: October 14, 2026

Lead Piranha builds and runs AI systems and websites for owner-run businesses. This Privacy Policy explains what personal information we collect when you use our website, read our newsletter or work with us, how we use it, who helps us process it, and how to reach us about it.

Quick Summary: We collect information to answer your inquiries, deliver the work our clients hire us for, send our newsletter to people who confirmed they want it, and comply with the law. You have rights to access, correct, and delete your data. We never sell your personal information. If you connect Facebook, Instagram or Meta ad accounts to our platform, section 16 explains what we access, why, and how to delete it.

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide when using our services:

Contact Information: Name, email address, phone number, mailing address
Business Details: What you tell us about your business and the work you want help with, through our application, contact and estimate forms
Account Information: Username, password, profile information if you create an account
Payment Information: Billing address and payment details (processed securely through third-party payment processors)
Communications: Messages you send through our platform, customer support inquiries, feedback

1.2 Information Collected Automatically

When you visit our website, we automatically collect certain information:

Device Information: IP address, browser type, operating system, device identifiers
Usage Data: Pages visited, time spent on pages, links clicked, referring website
Location Data: General location based on IP address (city/state level, not precise geolocation)
Cookies and Tracking: Information collected through cookies and similar technologies (see our Cookie Policy for details)
Bot Protection Signals: When you use one of our forms, Cloudflare Turnstile reads your IP address along with browser and device signals to confirm you are a person and not a bot. It runs invisibly, so there is nothing for you to solve. See section 4.2 and the Cloudflare Turnstile Privacy Addendum.

1.3 Information from Third Parties

We may receive information from:

Public Business Sources: Business names, contact details and license information that businesses publish themselves, such as state license filings and business listings. We use these only to write to a business one to one about our services, from our own team mailboxes. We never add these addresses to our newsletter. Any business can ask us to stop, and we keep its address on a do-not-contact list.
Analytics Providers: Google Analytics and similar services
Social Media: If you connect through social media platforms
Email Verification: Services that check a business email address is valid before we write to it

2. Legal Basis for Processing (GDPR)

For Users in the European Economic Area (EEA), UK, and Switzerland

We process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):

Processing Activity	Legal Basis	GDPR Article
Providing our services and answering inquiries	Performance of contract	Article 6(1)(b)
Marketing communications (with consent)	Consent	Article 6(1)(a)
Fraud prevention and security	Legitimate interests	Article 6(1)(f)
Legal compliance and record-keeping	Legal obligation	Article 6(1)(c)
Improving services and analytics	Legitimate interests	Article 6(1)(f)

Legitimate Interests: Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. Our legitimate interests include operating our business efficiently, preventing fraud, improving our services, and conducting marketing activities.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Primary Services

Answering inquiries and applications, and scheduling calls
Building, running and supporting the AI systems and websites we deliver for clients
Processing payments
Managing client portal accounts and providing support
Sending service-related emails, such as application receipts and appointment details

3.2 Business Operations

Analyzing usage patterns to improve our platform and services
Conducting market research and surveys
Detecting and preventing fraud, abuse, and security incidents
Enforcing our Terms and Conditions
Complying with legal obligations and responding to legal requests

3.3 Marketing and Communications

Sending our newsletter to people who signed up and confirmed (see section 3.5)
Writing to businesses one to one about our services, using public business contact details (see section 1.3). Every message says how to opt out, and we honor it.
Showing our ads to past website visitors, only after you accept marketing cookies

3.4 Automated Decision-Making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our application form uses automated scoring to suggest a next step, such as booking a call or a free resource. A person reviews any application that is held back, and you can always ask us for a call directly at privacy@leadpiranha.com.

Double opt-in: When you sign up on our website, we email you a link. You only join the list after you click it. If you don't, you won't get the newsletter.
Proof of consent: We keep a record of when and where you signed up and confirmed, including the page and your IP address, so we can show you asked for it.
Unsubscribe anytime: Every newsletter has a one-click unsubscribe link, and we stop sending right away.
No list sharing: We never sell, rent or share our subscriber list, and we never add purchased or scraped addresses to it.
Bounces and complaints: Addresses that bounce or mark our email as spam are removed automatically.
How it is sent: Subscribers are stored in our own marketing system (Mautic), and the newsletter is sent through Amazon Simple Email Service (see section 4.2).

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 With Your Consent

When you ask us to, for example to introduce you to a partner or to connect one of your tools to your client portal, we share only what that request needs.

4.2 Service Providers

We share information with trusted third-party service providers who help us operate our business:

Payment Processing: Stripe, Inc. processes all payments on our behalf. We do not store full card details. Stripe Privacy Policy.
Email Delivery: Amazon Web Services, Inc. (Amazon Simple Email Service) sends our newsletter and our system emails, such as signup confirmations and application receipts. AWS Privacy Notice.
Email Delivery: Resend, Inc. sends some of our system emails, such as purchase confirmations. Resend Privacy Policy.
Newsletter and Contact Records: Mautic, an open-source marketing system we run ourselves, stores newsletter subscribers, their consent records and inquiry follow-ups.
Team Email: Google LLC (Google Workspace) runs our team mailboxes, including the one-to-one emails we send businesses. Google Privacy Policy.
Platform Hosting: Railway Corp. hosts the system that runs our operations and our clients' portals. Railway Privacy Policy.
AI Processing: Anthropic, PBC provides AI models we use to draft and sort messages and content. Anthropic Privacy Policy.
Website Analytics: Google Analytics 4 (Google LLC) collects anonymized traffic and engagement data (pages visited, session duration, referral source). IP anonymization is enabled. Google Privacy Policy.
Session Replay & Heatmapping: Microsoft Clarity (Microsoft Corporation) records anonymized session replays, click maps, and scroll heatmaps to help us improve the website. Clarity may collect mouse movements, clicks, and scroll depth. No personally identifiable information is shared. Microsoft Privacy Statement.
Advertising & Conversion Tracking: Meta Platforms, Inc. (Facebook Pixel) tracks ad conversions and enables retargeting on Facebook and Instagram. Only activated after you consent to marketing cookies. Meta Privacy Policy.
Advertising & Conversion Tracking: TikTok Inc. (TikTok Pixel) tracks ad conversions and enables retargeting on TikTok. Only activated after you consent to marketing cookies. TikTok Privacy Policy.
Advertising & Conversion Tracking: Pinterest, Inc. (Pinterest Tag) tracks ad conversions and enables retargeting on Pinterest. Only activated after you consent to marketing cookies. Pinterest Privacy Policy.
Cloud Hosting: Vercel, Inc. hosts and serves this website. Vercel Privacy Policy.
Bot Protection: Cloudflare, Inc. (Turnstile) checks that the people submitting our forms are human, so we can keep spam and automated abuse off them. Turnstile runs invisibly and does not ask you to solve a puzzle. It reads your IP address, browser and device signals, and how the page behaves, and it does not use that data to build advertising profiles. See the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.
Internal Notifications: Telegram (Telegram FZ-LLC) is used internally to notify our team of new inquiries and purchases. Contact details are transmitted to a private, access-controlled channel and are not shared or stored beyond operational need.

4.3 Business Transfers

If Lead Piranha is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4.4 Legal Requirements

We may disclose information when required by law or to:

Comply with legal processes, court orders, or government requests
Enforce our Terms and Conditions
Protect our rights, property, or safety, or that of our users or the public
Detect, prevent, or address fraud, security, or technical issues

4.5 International Data Transfers

GDPR - Data Transfers Outside the EEA

Lead Piranha is based in the United States. When we transfer your data from the EEA to the US or other countries, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs): We use the European Commission's approved Standard Contractual Clauses with our service providers
Adequacy Decisions: Where available, we rely on adequacy decisions by the European Commission
Data Processing Agreements: All processors sign agreements committing to GDPR-level protection

You have the right to request a copy of the safeguards we use for international transfers by contacting privacy@leadpiranha.com

Australian Privacy Principles - Cross-Border Disclosure

Under APP 8, we take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the Australian Privacy Principles. We use Standard Contractual Clauses and conduct due diligence on all international service providers.

Countries where data may be transferred: United States, European Union member states, and any countries where our cloud services operate data centers.

5. Your Privacy Rights

5.1 Rights for All Users

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information (subject to legal obligations)
Opt-Out: Unsubscribe from marketing emails using the link in any email

5.2 US State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Utah, or Virginia, you have additional rights:

Right	Description
Right to Know	Request details about the personal information we collect, use, disclose, and sell
Right to Delete	Request deletion of your personal information, subject to certain exceptions
Right to Correct	Request correction of inaccurate personal information
Right to Opt-Out	Opt out of the sale of personal information or targeted advertising
Right to Non-Discrimination	We will not discriminate against you for exercising your privacy rights
Right to Limit	Limit use of sensitive personal information (where applicable)

How to Exercise Your Rights: Email us at privacy@leadpiranha.com or use our privacy request form. We will respond within 45 days (or 5 business days for certain states).

5.3 GDPR Rights (EEA, UK, Switzerland)

Under the GDPR, you have comprehensive data protection rights:

Right	Article	Description
Right to Access	Article 15	Obtain confirmation and a copy of your personal data
Right to Rectification	Article 16	Correct inaccurate or incomplete data
Right to Erasure	Article 17	Request deletion ("right to be forgotten")
Right to Restrict Processing	Article 18	Limit how we use your data in certain circumstances
Right to Data Portability	Article 20	Receive your data in a portable format
Right to Object	Article 21	Object to processing based on legitimate interests or for direct marketing
Rights Related to Automated Decision-Making	Article 22	Not be subject to solely automated decisions with legal/significant effects
Right to Withdraw Consent	Article 7(3)	Withdraw consent at any time where processing is based on consent

Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country if you believe we have violated your data protection rights. While we encourage you to contact us first, you can find your local supervisory authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Response Time: We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of the delay.

EU Representative: As we do not have an establishment in the EU but offer services to EU residents, we have appointed an EU representative as required under Article 27 of the GDPR. You can contact our EU representative at:

EU Representative Services
Email: eu-representative@leadpiranha.com
Note: EU representative will be appointed if we process data of significant numbers of EU residents. Until appointed, please direct all EU inquiries to privacy@leadpiranha.com

5.4 Australian Privacy Rights

Under the Privacy Act 1988 and Australian Privacy Principles (APPs), you have the right to:

Access Your Information (APP 12): Request access to the personal information we hold about you
Correct Your Information (APP 13): Request correction if information is inaccurate, out-of-date, incomplete, irrelevant, or misleading
Complain (APP 1): Make a complaint about how we handle your personal information
Anonymity (APP 2): Where practicable, interact with us anonymously or using a pseudonym

Access Requests: We will respond within 30 days. If we refuse access, we will provide written reasons and inform you of complaint mechanisms.

Correction Requests: If we refuse to correct your information, we will provide written reasons and you may request that we associate a statement with your information that you believe it is inaccurate.

Complaints Process:

Submit your complaint to privacy@leadpiranha.com
We will acknowledge receipt within 7 days
We will investigate and respond within 30 days
If you're unsatisfied, you may complain to the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Email: inquiries@oaic.gov.au

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

Technical Measures

Encryption of data in transit (TLS/SSL) and at rest
Secure data centers with physical access controls
Regular security assessments and penetration testing
Firewall protection and intrusion detection systems
Secure authentication and access controls

Organizational Measures

Employee training on data protection and security
Confidentiality agreements with all employees and contractors
Data minimization practices
Regular review and update of security policies
Incident response procedures

Important: No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Breach Notification

GDPR - Data Breach Notification (Articles 33-34)

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

To Supervisory Authority: We will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach
To You: If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay in clear and plain language

Notification Will Include:

Nature of the breach
Contact point for more information
Likely consequences of the breach
Measures taken or proposed to address the breach and mitigate potential adverse effects

Australian Notifiable Data Breaches (NDB) Scheme

Under the Privacy Act 1988, we must notify you and the Office of the Australian Information Commissioner (OAIC) if an eligible data breach occurs that is likely to result in serious harm.

Assessment Process:

We will complete our assessment within 30 days of becoming aware of a suspected breach
If the breach is likely to result in serious harm, we will notify affected individuals and the OAIC as soon as practicable

Notification Contents:

Identity and contact details of Lead Piranha
Description of the eligible data breach
Kinds of information concerned
Recommendations about steps individuals should take in response

All Jurisdictions

For any data breach, we will:

Investigate the breach promptly
Take immediate steps to contain and remediate the breach
Document the breach and our response
Review and strengthen security measures to prevent future breaches
Comply with all applicable breach notification laws

8. Data Retention

We retain your personal information only as long as necessary for the purposes described in this Privacy Policy or as required by law.

Data Category	Retention Period	Reason
Account information	Duration of account + 2 years	Service provision, legal claims
Transaction records	7 years	Tax, accounting, legal requirements
Newsletter subscription	Until you unsubscribe + 30 days	Legal compliance
Newsletter consent records	While subscribed + 3 years	Proof that you asked to subscribe
Do-not-contact list	Kept indefinitely	So we never contact you again after you ask us to stop
Support communications	3 years	Customer service, quality assurance
Analytics data	26 months	Business insights (Google Analytics default)
Cookies	See Cookie Policy	Varies by cookie type

When data is no longer needed, we securely delete or anonymize it. You may request earlier deletion by contacting us, subject to legal obligations to retain certain records.

9. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

GDPR (Article 8): For children under 16 in the EU (or younger if specified by member state law), parental consent is required for processing. We do not knowingly collect data from children under 16 without verifiable parental consent.

COPPA (US): We comply with the Children's Online Privacy Protection Act and do not knowingly collect information from children under 13.

If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@leadpiranha.com and we will promptly delete such information.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. For detailed information about the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

Cookie Consent: In accordance with the ePrivacy Directive and GDPR, we obtain your consent before placing non-essential cookies on your device. You can manage your cookie preferences through our cookie banner or browser settings.

11. Third-Party Links

Our website may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) signal. Currently, there is no industry standard for responding to DNT signals. We do not currently respond to DNT signals but will reassess as standards develop.

13. California "Shine the Light" Law

California residents may request information about personal information disclosed to third parties for their direct marketing purposes. As we do not share personal information with third parties for their direct marketing purposes, no disclosure is required under this law.

14. Nevada Privacy Rights

Nevada residents have the right to opt out of the sale of personal information. We do not sell personal information as defined under Nevada law. If you have questions, contact privacy@leadpiranha.com

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

We will post the updated policy on this page with a new "Effective Date"
For material changes, we will notify you by email or prominent notice on our website
Continued use of our services after changes indicates acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

16. Facebook, Instagram and Meta Ad Accounts You Connect

This section covers our app, Lead Piranha AIOS. If you're a Lead Piranha client, you can connect your Facebook Pages, your Instagram professional accounts and your Meta ad accounts to our platform. You do this with Facebook Login for Business. Nothing gets connected unless you sign in and give us permission, and you choose which Pages and accounts we can reach.

16.1 What We Access and Why

Page details: Your Page's name and ID, the Instagram account linked to it, and the access token Meta gives us. We need these to link your accounts to your Lead Piranha account and keep them connected.
Instagram and Facebook Page messages: We read the direct messages people send to your Instagram account or Facebook Page. We use them to show your messages in your portal, send the replies you write, and run the auto-replies you set up. We keep a short history of each conversation so replies make sense in context.
Instagram comments: We read the comments on your posts so you can see them, reply to them and hide the ones you don't want showing.
Lead Ads leads: When someone fills out one of your Lead Ads forms, we receive their answers, such as their name, email and phone number. We put each lead into your CRM and your portal so you can follow up quickly.
Ad account data and ad management: We read your campaigns, ad sets, ads and their results, such as spend, clicks and leads, so we can report how your ads are doing. When you ask us to, we also pause or restart ads, set budgets and create new ads for you.

16.2 How We Use and Share This Data

We use this data only to provide our service to you, the client who connected the account. We don't sell it, and we don't use it to train AI models that are shared with anyone else. We don't share it with other clients.

We share it only with the service providers we need to run the service:

Hosting: Railway, Vercel and SiteGround run the servers where our platform, your portal and your CRM live.
Email delivery: Brevo and Resend send the emails our service sends.
AI processing: When a message doesn't match one of your auto-reply keywords, an AI model from Anthropic reads it to pick the right auto-reply.

We may also share data when the law requires it, as described in section 4.4.

16.3 How Long We Keep It

We keep this data while your accounts are connected and you use our service. Leads we put into your CRM become part of your records there, and they stay until you or we delete them. When you disconnect your accounts or ask us to delete your data, we delete the data we got from Meta within 30 days.

16.4 How to Disconnect and Delete Your Data

Remove the app on Facebook: In your Facebook settings, open Business Integrations, find Lead Piranha AIOS and remove it. That ends our access to your accounts.
Ask for deletion through Facebook: When you remove the app, you can also ask for your data to be deleted. Meta sends that request to us, we delete the data, and you get a confirmation code and a link where you can check the status of your request.
Email us: Write to louie.v@leadpiranha.com and ask us to disconnect your accounts from your portal and delete your data. We'll confirm by email once it's done.

If you sent a message to a business that uses our service, you can ask us to delete your conversation history the same way, by email.

17. Contact Us

Privacy Questions and Requests

Lead Piranha
25 SE 2nd Ave Ste 550 PMB 980
Miami, FL 33131
Phone: +1 (786) 477-4203

General Privacy Inquiries:
Email: privacy@leadpiranha.com
Response Time: 5 business days for most requests

Data Subject Access Requests:
Submit requests through: privacy@leadpiranha.com
Or mail to: 25 SE 2nd Ave Ste 550 PMB 980, Miami, FL 33131

Data Protection Contact (GDPR):
Email: dpo@leadpiranha.com
Note: While we are not required to have a formal Data Protection Officer as a small US company, we have designated a privacy contact for GDPR matters.

EU Representative (GDPR Article 27):
Email: eu-representative@leadpiranha.com
[Physical address will be provided when representative is appointed]

Australian Privacy Matters:
Email: privacy@leadpiranha.com
Subject Line: "Australian Privacy Inquiry"

Security Concerns:
Email: security@leadpiranha.com
For reporting data breaches or security vulnerabilities

Connected Facebook and Instagram Accounts:
Email: louie.v@leadpiranha.com
For questions about Lead Piranha AIOS or to disconnect your accounts and delete your data

18. Jurisdiction-Specific Notices

For European Union Residents

This Privacy Policy complies with the General Data Protection Regulation (GDPR). Lead Piranha is the data controller for your personal information. We process data in accordance with GDPR requirements and have implemented appropriate safeguards for international transfers.

For Australian Residents

This Privacy Policy complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Lead Piranha is bound by the APPs when handling personal information of Australian residents.

For California Residents

This Privacy Policy provides the disclosures required by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). See Section 5.2 for your specific rights as a California resident.

For Other US States

Residents of Colorado, Connecticut, Utah, and Virginia have specific rights under their state privacy laws. See Section 5.2 for details about your rights and how to exercise them.

← Back to home