Leadflow

Privacy Policy

Last updated: 6 August 2026

This Privacy Policy explains how WWV (“we”, “us”, the “Company”) collects, uses, and protects information in connection with our lead-management platform (the “Service”). We provide the Service to businesses (“Clients”) who use it to collect and manage enquiries from their own prospective customers (“Leads”).

Our two roles

As a processor — When our Clients use the Service to collect and manage their Leads, the Client is the “controller” of that Lead data and decides how it is used. We process it on the Client’s behalf under our agreement with them.
As a controller — For the accounts of our Clients and their team members (name, email, login, billing), and for our own website visitors, we are the controller. This policy covers both roles.

1. Information we collect

Category	Examples
Client account data	Name, email, password (hashed), role, business details, billing status.
Lead data (on behalf of Clients)	Name, phone, email, messages, enquiry details, and campaign/source metadata submitted by a Lead through a form, WhatsApp, Meta Lead Ads, or a booking page.
Usage & technical data	IP address, device/browser type, pages viewed, and actions taken in the Service, for security and to operate the product.
Cookies	Strictly-necessary cookies for authentication and security. We do not use advertising cookies.

2. How we use information

To provide, maintain, and secure the Service.
To route, qualify, and help Clients respond to their Leads (including automated qualification and follow-up features the Client enables).
To send transactional messages (e.g. login links, notifications, and — where the Client configures it — messages to Leads).
To prevent fraud and abuse, and to comply with legal obligations.

3. Legal bases

Where applicable law requires a legal basis, we rely on: performance of our contract with Clients; our legitimate interests in operating and securing the Service; consent (for example, consent a Lead gives a Client when submitting an enquiry); and compliance with legal obligations.

4. Sharing & sub-processors

We do not sell personal data. We share data only with service providers that help us run the Service, under confidentiality and data-protection terms:

Provider	Purpose
Supabase	Database, authentication, and hosting of application data.
Cloudflare	Front-end hosting, content delivery, and bot protection.
Twilio	WhatsApp/SMS messaging (where enabled by the Client).
Meta Platforms	Meta Lead Ads intake (where the Client connects a Facebook/Instagram page).
Brevo	Transactional and report emails.
Anthropic	AI-assisted lead qualification and drafting (where enabled by the Client).

We may also disclose information where required by law or to protect our rights and the safety of users.

5. International transfers

Our providers may process data in regions outside your country (for example, the European Union or the United States). Where required, we rely on appropriate safeguards such as standard contractual clauses.

6. Retention

We keep Client account data for as long as the account is active and as needed to comply with legal obligations. Lead data is retained on behalf of the Client and is deleted or returned in accordance with the Client’s instructions or on account closure. Clients can delete Lead records at any time from within the Service.

7. Security

We use industry-standard measures including encryption in transit, row-level access controls that isolate each Client’s data, hashed passwords, signature-verified webhooks, bot protection, and rate limiting. No system is perfectly secure, but we work continually to protect your information.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, or to object to or restrict certain processing. If you are a Lead, please contact the Client you interacted with (the controller of your data); we will assist that Client with your request. For account data we control, contact us using the details below.

9. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect their personal data.

10. Changes

We may update this policy from time to time. Material changes will be posted here with an updated date.

11. Contact

Questions or requests: ekamel0916@gmail.com.

This document is a starting template tailored to how the Service works. Please have it reviewed by qualified legal counsel and adapt the legal entity name, jurisdiction, and any local requirements (e.g. GDPR, Egypt PDPL, UAE PDPL) before relying on it in production.