Privacy Policy

1. Introduction

Leafine Labs (“we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, and protect personal information when you use our websites, applications, and related services (the “Services”).

By using the Services, you acknowledge this Policy and our Terms. For questions, write to hello@leafine.com.

Effective Date: 27 July 2026

2. Information We Collect

Account Information: Name, email, phone, company details, role, and billing contacts.

Usage Data: Logs, events, performance telemetry, product usage, and diagnostics to improve reliability.

Order & Communication Data: Messages, emails, and orders processed through Leafine or connected integrations (e.g., WhatsApp Business Platform, Messenger, Gmail).

Technical Data: IP address, device and browser type, OS, language, timestamps, and cookies/identifiers.

3. How We Use the Information

We use data to:

Provide, operate, and maintain the Services.
Secure accounts, prevent fraud, and investigate incidents.
Improve features, fix bugs, and enhance performance.
Personalize workflows and recommendations.
Comply with legal obligations and enforce our Terms.

We never sell personal data or use it for third-party advertising.

We process data on the following legal bases: (i) to perform our contract with you; (ii) our legitimate interests in running and improving the Services; (iii) your consent (where required, e.g., certain analytics or marketing); and (iv) compliance with legal obligations.

5. Service Providers and Sub-Processors

We do not sell personal data.

The following is our complete list of third-party sub-processors. For each, we state what data they receive.

OpenAI — receives message content (body, subject, sender name, and conversation history) from connected messaging and email integrations. Used to draft customer support replies and generate conversation titles and summaries for the merchant who connected the account. OpenAI is our only AI sub-processor.
MongoDB Atlas — database hosting. Stores account data and message content.
Hostinger — application and queue hosting.
Meta Platforms — receives message content only for WhatsApp and Messenger conversations, where necessary to deliver business messaging through their approved APIs.
PostHog EU Cloud — consented product analytics, session replay, diagnostics, error and AI performance metadata. Chat prompts and responses are excluded. When you submit a contact or newsletter form, PostHog also stores the details you provide to deliver that request and manage newsletter consent.
Cloudflare Turnstile — abuse prevention for public forms; receives technical request and challenge data.
Slack — private internal notifications containing submitted contact-request details.
New Relic — application performance monitoring: request handler names and timing only. Does not receive message content.

We may also disclose data to legal authorities when required to comply with law, regulation, or valid legal process.

6. Meta & Third-Party Messaging

When you connect WhatsApp Business Platform or Messenger, we process messages and related metadata solely to deliver the conversation, provide support features, and prevent abuse. We do not use this content for ads or profiling unrelated to the Services.

Your use of these integrations must follow Meta’s terms and applicable consent and notice rules in your region.

7. Google Workspace Data

When you connect a Google account, we request a single OAuth scope:

https://www.googleapis.com/auth/gmail.modify

We use it to read inbound customer emails and surface them in the merchant’s Leafine inbox, to send replies from the merchant’s own address, and to write limited state back to the mailbox: we remove the UNREAD label from a Gmail thread when a merchant opens that conversation in Leafine, and we apply a label to threads that have been answered through Leafine. These writes keep the merchant’s shared mailbox aligned with the work their team has done. We do not delete messages, create drafts, or change account settings.

Message content from connected Gmail accounts is processed by OpenAI, as described in Section 5, to draft replies and generate conversation titles and summaries. No other third-party AI provider receives Gmail data.

Google Workspace data is never used for advertising, never sold, and never used to train or improve any AI or machine learning model, including by our sub-processors.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

8. International Transfers

Data may be processed in or transferred to countries outside your own (e.g., EU/UK ↔︎ US). We use appropriate safeguards such as Standard Contractual Clauses and technical measures to protect data during transfer.

9. Data Retention

We keep personal data only as long as needed for the purposes above or to meet legal obligations. Typical defaults: account data for the subscription term plus up to 24 months; system logs up to 12 months; support tickets up to 24 months; backups per rolling schedules.

You can request deletion or export at any time (see Section 12).

10. Security

We apply defense-in-depth measures: encryption in transit and at rest, access controls, least-privilege, audit logging, and continuous monitoring. While no system is 100% secure, we work to prevent, detect, and respond to incidents quickly.

Our Security Overview provides a dedicated description of our security posture and operational safeguards.

11. Cookies & Preferences

We use cookies and similar technologies for authentication, analytics, and product features. You may manage preferences in your browser; some features may not function without required cookies.

See our Cookie Policy for the current cookie categories, purposes, and available controls.

12. Your Rights

Depending on your jurisdiction (e.g., GDPR/UK GDPR), you may have rights to:

Access, correct, or delete your personal data.
Object to or restrict certain processing.
Request data portability.
Withdraw consent where processing is based on consent.
Lodge a complaint with your local data protection authority if you believe your rights are infringed.

To exercise rights, contact: hello@leafine.com

hello@leafine.com · hello@leafine.com

For security disclosures, please include "Security" in your subject line.