Privacy Policy

1. Introduction

SmartLeads LLC ("SmartLeads," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered lead qualification platform, including our SMS outreach and automation features.

Website: https://smrtleads.org

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these practices, do not use the Service.

Our services are operated from the United States. By using the Service, you understand and agree that your information may be transferred to, processed, and stored in the United States and other countries where our service providers operate. These jurisdictions may have data protection laws that differ from those in your country of residence.

2. Information We Collect

2.1 Information You Provide

• Account information (name, email address, company name, phone number)
• Payment information (processed securely through third-party payment processors; we do not store raw card numbers)
• Lead and contact data you upload, import, or input into the platform
• SMS message content, conversation transcripts, and campaign data
• Consent records and opt-out logs you maintain through the platform
• Profile and preference settings

2.2 Information Automatically Collected

• Usage data and analytics (features used, time spent, actions taken)
• Device information (browser type, operating system, IP address)
• Log data (access times, pages viewed, API calls, errors encountered)
• Cookies and similar tracking technologies

2.3 Information From Third Parties

We may receive information about you from our SMS carrier partners (such as delivery receipts and opt-out signals), payment processors, and analytics providers. We use this data solely to operate and improve the Service.

3. SMS Messaging & TCPA Compliance

3.1 TCPA and Applicable Law

SmartLeads facilitates the sending of SMS messages on your behalf. As the business initiating those messages, you are the party responsible for compliance with the Telephone Consumer Protection Act (TCPA), any applicable state telemarketing laws, and regulations issued by the Federal Communications Commission (FCC). SmartLeads provides tools to help you comply but does not assume legal responsibility for the messages you send.

3.2 10DLC Registration

Effective commercial SMS messaging in the United States requires registration under The Campaign Registry (TCR) 10-digit long code (10DLC) framework. When you provision a phone number through SmartLeads:

• We collect your business information (legal name, EIN/Tax ID, address, website) to complete brand registration with TCR on your behalf.
• We register your messaging use-case ("campaign") with TCR and your carrier, including campaign type, message samples, and opt-in/opt-out language.
• This registration data is shared with TCR and participating wireless carriers as required by industry standards.
• You are responsible for ensuring that the use-case you register accurately reflects how you will use the platform.

3.3 Consent & Opt-In

You must obtain prior express written consent from any individual before sending them marketing SMS messages through SmartLeads. SmartLeads can store opt-in timestamps, consent records, and consent source information when those records are supplied by you or collected through SmartLeads features. You remain solely responsible for obtaining, documenting, maintaining, and honoring legally sufficient consent in accordance with the TCPA and any applicable state laws.

3.4 Opt-Out Processing

SmartLeads automatically processes standard opt-out keywords (STOP, QUIT, CANCEL, UNSUBSCRIBE, END, HELP) and removes contacts from active campaigns immediately upon receipt of such a message. We retain opt-out records for compliance purposes. You may not re-message a contact who has opted out without obtaining fresh explicit consent.

3.5 Message Content

All outbound messages sent through our platform must comply with carrier guidelines and applicable law. You agree not to send messages that contain prohibited content (adult content, illegal substances, illegal activities, hate speech, or anything that violates carrier policies). SmartLeads reserves the right to suspend accounts that send non-compliant messages.

3.6 Data Associated With SMS

SMS conversation data — including inbound replies, delivery receipts, and AI-generated responses — is stored and processed to provide the Service. This data may be reviewed by our team for quality assurance, compliance investigation, or product improvement, subject to appropriate confidentiality protections.

4. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our lead qualification and SMS outreach services
• Process and analyze SMS conversations using AI and natural language processing
• Generate lead scores, engagement insights, and campaign analytics
• Register your brand and messaging campaigns with TCR and carriers (10DLC)
• Process payments and manage your subscription
• Send service-related notifications, billing alerts, and product updates
• Improve our platform, AI models, and carrier delivery rates
• Detect and prevent fraud, spam, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

4.1 Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information under one or more of the following legal bases:

• Performance of a contract
• Compliance with legal obligations
• Our legitimate business interests
• Your consent where required by applicable law

5. Data Sharing and Disclosure

We do not sell your personal information to third parties for marketing purposes. We may share your information only in the following circumstances:

• SMS Carriers & Telnyx: Our SMS infrastructure provider (Telnyx) and participating wireless carriers receive message content, phone numbers, and delivery metadata necessary to route SMS messages.
• The Campaign Registry (TCR): Your brand and campaign registration information is shared as required for 10DLC compliance.
• Payment Processors: Billing information is shared with payment processors such as Stripe. We do not store raw payment card information.
• Cloud Infrastructure: We use cloud hosting providers, including Supabase/PostgreSQL, under appropriate data processing agreements.
• AI Services: Conversation data may be processed by third-party AI service providers solely to provide SmartLeads features, including AI-generated responses, lead qualification, summarization, analytics, and related functionality. Where supported, we configure these providers so Customer Data is not used to train publicly available AI models. These providers process information under contractual confidentiality and security obligations.
• Business Transfers: Information may be transferred as part of a merger, acquisition, or sale of assets.
• Legal Requirements: We may disclose information when required by law or to protect our legal rights.

5.1 Service Providers (Subprocessors)

To operate SmartLeads, we use trusted third-party service providers that process information on our behalf. These may include:

• Telnyx (SMS messaging)
• Stripe (payment processing)
• Supabase (database hosting)
• OpenAI (AI processing)
• Resend (transactional email)
• Cloudflare (security and content delivery)

We may update our service providers from time to time. Each provider processes information only as necessary to deliver services on our behalf and is subject to contractual confidentiality and security obligations.

California Privacy Notice

SmartLeads does not sell or share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

6. Data Security

We implement industry-standard security measures, including:

• Encryption of data in transit (TLS 1.2+)
• Encryption of data at rest (AES-256)
• JWT-based authentication
• Row-level security and tenant isolation
• Regular security assessments
• Restricted production access on a need-to-know basis

No method of electronic transmission or storage is completely secure. While we implement strong safeguards, we cannot guarantee absolute security. If a data breach affecting your rights occurs, we will notify affected users as required by applicable law.

7. Data Retention

We retain information as follows:

• Account information: Active account plus 24 months
• SMS conversations and lead data: 24 months or longer if required by law
• Opt-out records: Indefinitely
• 10DLC registration records: As required by TCR and carrier agreements
• Transaction records: 7 years
• Log data: 90 days

Deleted information may remain in encrypted backup systems for a limited period before being permanently removed according to our backup retention schedule.

You may request deletion of your account or personal information through your account settings (where available) or by contacting info@smrtleads.org. Verified deletion requests are subject to legal retention obligations and will not affect opt-out records maintained for compliance purposes.

8. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access
• Correction
• Deletion
• Data portability
• Restriction of processing
• Objection to processing
• Opt out of marketing emails
• Manage cookies through your browser

Additional Privacy Rights

Residents of California, the European Economic Area, the United Kingdom, and other jurisdictions with applicable privacy laws may have additional rights under local law. SmartLeads will honor applicable rights in accordance with those laws.

To exercise your rights, contact info@smrtleads.org. We will respond within 30 days where required by law and may verify your identity before fulfilling your request.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain your login session
• Remember preferences
• Analyze platform usage

Cookie categories include:

• Essential Cookies
• Analytics Cookies
• Preference Cookies

You may manage cookies through your browser settings. Disabling essential cookies may prevent you from accessing portions of the Service.

10. Children's Privacy

Our Service is intended for businesses and individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that such information has been collected, we will promptly delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, legal obligations, or business practices. Material changes will be posted on our website with an updated Last Updated date. Where required, we may also notify you by email. Continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Data Processing Addendum (DPA)

Business customers requiring a Data Processing Addendum (DPA) for compliance with applicable privacy laws may request one by contacting info@smrtleads.org.