Privacy Policy

Last updated 5 September 2026

leed. (pronounced “lead”) is a lead follow-up and email tool operated by Allpoint Supply Group (“we”, “us”), ABN [ABN NUMBER]. This policy explains what information leed. accesses, how it’s used, and who it’s shared with. Questions or requests about your information: operations@allpointsupplygroup.com.

A couple of words used throughout

The Operator is the person or business who signs in to leed. and connects their own Gmail account to it. A Contact is a lead, customer, or anyone else the Operator adds to leed., or who emails the Operator’s connected inbox. A Contact isn’t leed.’s customer - the Operator is. For anything about their own information (correcting it, asking what’s held, requesting it be deleted), a Contact should start with the Operator directly, since the Operator is the one who can actually verify who’s asking and act on it day to day. If that’s not possible, we’ll handle a direct request ourselves once we’ve taken reasonable steps to confirm who’s asking.

What leed. does

leed. helps a business track sales leads, draft email replies and quotes with AI assistance, and follow up on time. An Operator connects their own Gmail account and enters or receives details about their own Contacts. Nothing is sent to a Contact without the Operator reviewing and approving it first.

Information we collect

• Account information: a username and password for signing in (stored as a one-way scrambled hash - we can’t see or recover an actual password). A signed, encrypted cookie keeps an Operator signed in between visits; it doesn’t contain readable personal information itself.
• Contact information: names, business names, email addresses, phone numbers, how they got in touch, and any notes the Operator writes about them (e.g. from a phone call).
• Email content: with Gmail connected, leed. reads incoming mail to the Operator’s inbox to spot a reply from a Contact and match it to the right record, and sends email (outreach, replies, follow-ups, quotes) through the Operator’s own Gmail account, only once the Operator has approved that message. A copy of each email’s text is stored against the relevant Contact, so the Operator has a record of the conversation inside the tool.
• Quotes and documents: quote line items and prices, a PDF generated from them, and whether a Contact has opened or accepted the quote’s online link.
• Activity log: a timestamped record of actions on a Contact’s record (a draft was generated, an email was sent, a quote was opened or accepted), kept for the Operator’s own record-keeping.
• Technical information: ordinary web server logs (IP address, browser type, timestamps) kept briefly by our hosting provider for security and troubleshooting, the same as almost any website.

We don’t collect information about a Contact from anywhere else - only what the Operator enters, or what a Contact sends by replying to the Operator’s email.

How we use Google user data

leed. asks for two things from Gmail: permission to send mail, and permission to read and organise mail (Google calls these the gmail.send and gmail.modify scopes). Google account data is used only to:

• spot a reply from a Contact and show it in the Operator’s thread view;
• send an email the Operator has written, edited, or explicitly approved - leed. never sends anything automatically or without that approval;
• set the right email headers so a reply stays correctly threaded in Gmail itself.

Google account data is never used to build advertising profiles, never sold, and never shown to anyone other than the Operator it belongs to. When leed. sends part of an email to Anthropic to draft a reply (see the next section), that text stays covered by the same restrictions: Anthropic may only use it to generate that draft, nothing else. leed.’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, for leed. and for anyone we share that data with.

AI-generated drafts

When the Operator asks leed. to generate a draft, the relevant email text (and quote details, for a quote) is sent to Anthropic (the company behind the Claude AI model) over an encrypted connection, solely to write that draft. Under Anthropic’s API terms, this text isn’t used to train their models. Anthropic’s exact data-handling and retention terms for API use are set out at anthropic.com/legal/commercial-terms. No AI-generated text is ever sent to a Contact automatically - the Operator always sees, and can edit or discard, every draft first.

Who we share information with

We don’t sell personal information, to anyone, ever. It’s shared only with:

• Google, to read and send email through the Operator’s own connected Gmail account;
• Anthropic, to generate AI draft text, as described above;
• Netlify and Neon, our hosting and database providers, who store leed.’s data on our behalf and don’t use it for their own purposes. Both are based in the United States, so information may be stored or processed there rather than in Australia.

We’ll also disclose information if the law requires it, or to protect the rights, property, or safety of Allpoint Supply Group, leed.’s users, or the public - never otherwise.

How long we keep information

Contact and email data is kept for as long as the Operator’s account is active, so their follow-up history stays intact. Clicking “Delete lead” hides that record from every normal screen straight away; we don’t currently run an automatic timer that erases it from our systems after that, so anyone wanting a record permanently and irreversibly deleted - Operator or Contact - needs to tell us directly, and we act on it manually. We aim to complete any deletion request, or a request for a copy of an Operator’s own data, within 30 days. Routine backups at our hosting provider may still hold a deleted copy for a short period afterwards before it cycles out on its own.

If something goes wrong

If we become aware of a data breach likely to cause serious harm, we’ll notify anyone affected and the Office of the Australian Information Commissioner, in line with Australia’s Notifiable Data Breaches scheme.

Security

Passwords are stored using industry-standard one-way hashing (bcrypt) - we can’t see or recover an actual password. Google account tokens are encrypted at rest before being stored. All traffic to and from leed. is encrypted in transit (HTTPS). Access to the underlying systems is restricted to Allpoint Supply Group. No method of storage or transmission is completely secure, but we take these steps to match the sensitivity of what leed. handles.

Your rights

Depending on where you’re located, you may have the right to access, correct, or request deletion of information we hold, object to certain uses of it, or lodge a complaint with a privacy regulator (in Australia, the Office of the Australian Information Commissioner, oaic.gov.au). To exercise any of these, or to ask for a copy of your own data, contact us below (Contacts: please go through the Operator first, as explained above).

Children

leed. is a business tool and isn’t directed at, or knowingly used by, children.

Changes to this policy

If this policy changes in a way that matters, we’ll update the date at the top of this page and, where practical, tell the Operator directly. Continuing to use leed. after a change means accepting the update.

Contact

Questions about this policy, or a request about your information: operations@allpointsupplygroup.com.