1. Who this covers
This policy applies to clients of “The Lead Gents” (operated by WavePoint Web Design Inc.) and to visitors of our website and dashboard. It explains what data we collect, why, and what we do with it.
2. Data we collect from you directly
- Account: name, email, password hash. Required to sign in.
- Business info: business name, address or service area, phone, website, industry, city. Used to manage your GBP listing and build directory citations.
- Preferences: review auto-response settings, email cadence.
- Uploads: photos, background images, logos, and headshots you upload for use on your GBP. Some photo posts are assembled by overlaying a short title and your logo or headshot onto a background image you uploaded; we do not generate artificial or stock imagery.
3. Data we access on your behalf
Once you connect your Google account (or accept our manager invite) for Google Business Profile, we access:
- Your public GBP content (listing info, posts, photos, reviews, Q&A)
- Performance insights (impressions, clicks, calls, direction requests)
- Reviewer identifiers (first names / display names only; we don’t receive email addresses)
We request only the Google Business Profile management scope (and, for SEO clients, a read-only Search Console scope). We do not access Gmail, Google Drive, Google Ads, or any other Google product beyond the scope you grant us.
4. Data we generate
- AI-drafted content: post copy and review responses generated from your business info and tone preferences. You can edit or disable these.
- Composited images: post images assembled from your uploaded background photo plus your logo/headshot and a short title overlay.
- Audits and scores: we compute a profile score from your public GBP data for our own analysis and your dashboard.
5. How we use this data
- To run the service you’ve hired us for (post, reply, report)
- To send transactional email (monthly reports, review alerts, photo reminders)
- To improve our own tooling and internal benchmarks, never in a way that identifies your business to third parties
We do not sell your data, rent it, or use it for third-party advertising.
6. Third-party services
To run the service we share the minimum necessary data with:
- Supabase: database, auth, file storage
- Resend: transactional email delivery
- OpenAI, Anthropic, Perplexity, and Google (Gemini): AI drafting of post copy and review replies. We send these providers the prompt context needed to draft content; we do not authorise them to train on your data beyond their standard API terms.
- FireCrawl: public web scrape during trial audits
- Google Business Profile API (and, for SEO clients, Search Console): reading/writing your GBP
- Square: payment processing (we never see your full card number)
- Webflow: only if you’ve connected a blog
Each of these providers has their own privacy terms. We review them periodically and update this list as our providers change.
7. Cookies and tracking
Our dashboard uses a single authentication cookie from Supabase to keep you signed in. We do not use advertising trackers, third-party analytics, or marketing pixels inside the authenticated app.
8. Data retention
We retain your account and business data for as long as you have an account with us. Cancelling a paid plan reverts you to the free Starter plan rather than closing your account, so we keep your data so you can keep using Starter and re-upgrade later.
If you ask us to delete your account and data entirely (see §9), we will delete it within 30 days of confirming your request, except for records we are required to keep for legal, tax, or audit reasons (for example transactional and billing logs), which we retain only as long as needed for those purposes. Trial accounts that are never activated may be purged automatically after a period of inactivity.
9. Your rights
- Access / export: email us and we’ll send you a copy of your data.
- Correction: most fields are editable in your dashboard; email us for the rest.
- Deletion: you can permanently delete your account and data yourself at any time from the “Delete account” section of your Settings page — this takes effect immediately. You can also email us at the address below to request deletion; we’ll confirm and then delete within 30 days. Either way, deletion is subject to the legal-retention exceptions in §8.
- Unsubscribe: every marketing email has a one-click unsubscribe link; transactional emails (billing, review alerts) cannot be disabled without cancelling the service.
10. Security
We use HTTPS everywhere, row-level security on our database, and encrypted secrets storage for third-party API keys and connection tokens. We’re a small team; if we ever have a data incident that affects you, we’ll email you within 72 hours of discovery.
11. Children’s privacy
The Lead Gents is a B2B service for business owners. We don’t knowingly collect information from anyone under 16.
12. Changes to this policy
We may update this policy occasionally. Material changes will be emailed to active clients at least 14 days before they take effect.
13. Contact
Questions, access requests, or complaints: info@wavepointwebdesign.ca