Privacy Policy

LeadTime ("LeadTime", "we", "our", or "us") operates a notification platform that enables businesses to send automated notifications to their clients and contacts via email, SMS, and WhatsApp. We are committed to protecting your personal information and handling it responsibly in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and all other applicable South African data protection laws.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights as a data subject. By using LeadTime, you agree to the practices described in this policy.

This Privacy Policy applies to:

• Registered users of the LeadTime platform ("Users") who create accounts and use our services to send notifications.
• Recipients of notifications sent via the LeadTime platform on behalf of our Users.
• Visitors to our website and related digital properties.

3.1 Account and Registration Information

When you register for a LeadTime account, we collect:

• Email address
• Referral code (optional) — if provided at registration, we record which authorised sales partner referred you. This is used solely for internal attribution purposes and is not shared publicly.

3.2 Business Profile Information

Your account includes one business profile by default; Premium and Premium+ subscribers may create additional business profiles. For each business profile you create, we collect:

• Business name
• Phone number
• Email address
• Where configured, connected messaging credentials for that profile (such as a WhatsApp Business phone number/access token or a linked email sending domain), used solely to send messages on your behalf via that profile.

3.3 Recipient Contact Information

In the course of using the LeadTime platform to send notifications, we collect and temporarily store contact information for your notification recipients. This is limited to:

• Email address – only when you choose to send notifications via email.
• Phone number – only when you choose to send notifications via SMS or WhatsApp.

3.4 WhatsApp Templates and Inbound Messages

Where you send a WhatsApp message using an approved Message Template, the variable values you supply (for example, a customer's name, order number, or estimated delivery date) are transmitted to Meta to populate that template and are not separately stored by LeadTime beyond the request needed to send the message. Where the Service provides an inbound WhatsApp inbox for your connected WhatsApp Business Account, we receive and store, for each conversation: the customer's WhatsApp number and profile name, the content of messages sent and received, message type, delivery status, and timestamps. Unlike the 30-day recipient data described above, this conversation history is retained for as long as your account and the relevant business profile exist, so you can refer back to past customer conversations, and is permanently deleted if you delete your account or the business profile it belongs to.

3.5 Scheduled Messages

If you are subscribed to the Premium tier or above and use message scheduling, we store the recipient's contact detail, the message content, and your chosen send date and time until the message is dispatched. Once a scheduled message has been sent (or cancelled by you), this record is retained only as part of your standard message history, in line with Section 7.

3.6 Uploaded Images

If you use the Uploads feature to send a photo attachment (for example, via WhatsApp), the image you upload is stored in our cloud storage provider (Supabase Storage), in a private location accessible only to your account — it is never made publicly browsable. When you use the image, we generate a temporary link that expires after 24 hours for delivering it. Depending on what you choose to upload, this may include sensitive personal information such as photographs of ID documents; you are responsible for only uploading images you have the right and any necessary consent to share. Uploaded images are retained until you delete your account, at which point they — along with all other account data — are permanently deleted (see Section 7).

3.7 Security and Authentication

We do not store passwords in plain text. All passwords are encrypted using industry-standard hashing algorithms before being stored in our database.

3.8 Payment Information

Payments for LeadTime subscriptions are processed by PayPal. We do not store your credit card or banking details on our systems. All payment data is handled directly by PayPal in accordance with their own privacy policy and applicable financial regulations. If you cancel your subscription to take effect at the end of your billing period, we record that end date so your access continues correctly until then.

We use the information we collect for the following purposes:

• To create and manage your LeadTime account.
• To provide, operate, and improve the LeadTime notification platform.
• To send transactional communications related to your account, including billing notifications and service updates, via email.
• To process subscription payments via PayPal.
• To deliver notifications to your specified recipients on your behalf.
• To comply with our legal obligations under South African law.
• To investigate and resolve disputes or security incidents.

We process your personal information on the following legal bases under POPIA:

• Contractual necessity: Processing is required to provide you with the services described in our Terms of Service.
• Legitimate interest: Processing is necessary for the administration, security, and improvement of our platform.
• Legal obligation: Processing is required to comply with South African law.
• Consent: Where we rely on consent, you may withdraw it at any time by contacting us.

Your data is stored and processed on the following infrastructure:

• Application servers: Google Cloud Run (europe-west1 – Belgium).
• Database: Supabase hosted on AWS eu-central-1 (Frankfurt, Germany).
• File storage: Supabase Storage, on the same infrastructure, for images you upload via the Uploads feature.

While our servers are located outside South Africa, we take reasonable steps to ensure that your information is protected with appropriate contractual and technical safeguards equivalent to the standards required by POPIA. By using LeadTime, you acknowledge and consent to your data being processed in these locations.

We retain your personal information for as long as your account is active and as required to provide you with our services. Specifically:

• Account information (email, business profile details, phone numbers): Retained for the duration of your account and a reasonable period thereafter for legal and administrative purposes.
• Recipient contact information: Automatically and permanently deleted 30 days after it is collected.
• WhatsApp inbox conversations: Retained for as long as your account and the relevant business profile exist — not subject to the 30-day recipient data window, since this is an ongoing conversation history rather than a one-off send. Deleted immediately if you delete your account or the business profile it belongs to.
• Uploaded images: Retained until you delete your account, at which point they are permanently deleted along with your other account data.
• Scheduled messages: Retained until sent or cancelled; if your account is deleted before a scheduled message is sent, it is removed immediately along with your other account data.
• Payment records: Retained as required by applicable South African tax and financial laws.

You may delete your account and all associated personal information at any time directly from the Account Settings page within the platform, provided you do not have an active subscription. Upon deletion, all data listed above — with the exception of payment records required by law — is permanently and immediately removed from our systems. This action cannot be undone.

Payment records may be retained beyond account deletion as required by applicable South African tax and financial laws.

We do not sell your personal information. We share your information only with the following third-party service providers, strictly for the purposes of delivering our service:

• Mailgun – Email delivery service provider.
• Twilio – SMS delivery service provider.
• Meta (WhatsApp Business Platform) – WhatsApp message delivery, using the WhatsApp credentials configured on your business profile. Where you have an inbound WhatsApp inbox enabled, Meta also relays messages your customers send to your connected WhatsApp number to us via webhook.
• PayPal – Payment processing.
• Google Cloud – Application hosting infrastructure.
• Supabase – Database hosting.

Each of these providers is bound by their own privacy policies and applicable data protection laws. We may also disclose your information where required to do so by law, court order, or regulatory authority.

As a data subject under POPIA, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to our legal obligations.
• Object to the processing of your personal information.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise the right to deletion, you may use the self-service account deletion option in Account Settings, or contact us directly — see our Data Deletion Instructions for the full process. For all other rights, or if you require assistance, please contact us at the details in Section 12. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, or disclosure. These measures include password hashing, access controls, and the use of reputable cloud infrastructure providers. However, no system is completely secure, and we cannot guarantee the absolute security of your information.

We may update this Privacy Policy from time to time. When we do, we will notify you by email and update the effective date at the top of this document. Continued use of the LeadTime platform after such notification constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us at: