Lead360 Privacy Policy

Scope and privacy roles

This Privacy Policy applies to Lead360 websites, applications, support, account administration, billing, sales, security, Ask360, Sales360, developer services, and other services operated by Lead 360 Marketing LTD. It does not replace the privacy policy of a Lead360 customer for that customer own contacts, employees, website visitors, patients, clients, or other end users.

When Lead360 is a controller or business

Lead360 determines the purposes of processing for website visitors, account owners, billing contacts, support communications, product analytics, security, fraud prevention, service administration, direct sales, and public-source Sales360 research and suppression. For these activities, Lead360 is generally the business, organization, or controller.

When Lead360 is a processor or service provider

A customer usually determines why and how its CRM records, forms, messages, recordings, calendars, automations, websites, customer-app records, and configured Ask360 content are processed. For these activities, Lead360 generally acts as a processor or service provider under the customer instructions and the Data Processing Addendum. Privacy requests about Customer Data should normally be directed first to that customer.

Information we collect

Sources of information

• Directly from account owners, users, visitors, and people who contact Lead360.
• From customers that upload, create, sync, import, or collect information through the service.
• From connected providers such as telecommunications, payment, calendar, social, automation, and authentication services.
• From cookies, browser storage, logs, security tools, and use of the service.
• From publicly available websites, directories, business records, and professional sources used for Sales360 research.
• From partners or service providers where the disclosure is authorized and lawful.

Why we process information

Where consent is the basis, it may be withdrawn subject to legal and contractual limits. Withdrawal does not affect processing already completed lawfully.

Customer Data and end users

Customers control the business purposes for most Customer Data. They are responsible for providing notices, obtaining consent, responding to end-user requests, and giving Lead360 lawful instructions. Lead360 processes Customer Data to provide the service, secure it, prevent abuse, provide support, and comply with law.

If an individual contacts Lead360 about data held by a customer, we may refer the request to that customer and assist as required by the Data Processing Addendum. We may need the customer name, account, message, phone number, email, or other information to identify the correct data controller.

Sales360 public-source data and profiling

Sales360 may collect business information from public sources, preserve source references, and generate inferences such as fit scores, likely business needs, pain points, or suggested outreach. Public availability does not remove every privacy or source restriction. Lead360 and customers must respect applicable source terms, marketing laws, access restrictions, and privacy rights.

A person may object to Lead360-controlled Sales360 profiling or request suppression by emailing [email protected] with enough information to identify the record. Lead360 may retain a minimal suppression record so the person is not re-added. Customers are independently responsible for suppressing the person in their own systems and connected providers.

AI, models, memory, and tracing

Requested AI features may process prompts, selected Customer Data, retrieved knowledge, website content, instructions, outputs, feedback, and diagnostic information through locally hosted models or approved service providers. Current configured providers may include Cerebras for inference and LangSmith for observability and tracing. The exact route may depend on the feature and configuration.

Memory retrieval settings control what Ask360 can retrieve for a response, but a retrieval window such as memory_days does not by itself prove that the underlying database record, vector, trace, export, or provider copy has been erased. Use the verified deletion process for an erasure request. Do not submit sensitive personal information, credentials, or regulated health information to AI features unless the account has been specifically approved for that use.

Communications and recordings

Lead360 can transmit and store email, SMS, voice, chat, social messages, and recordings at a customer direction. Communications may pass through telecommunications, email, social, or connected providers. Customers must provide required sender identification and notices and must obtain consent for marketing, automated messages, and recording where required.

Because customer-built automations and external providers may maintain separate contact and suppression records, an unsubscribe action in one channel or integration may not automatically update every other system. Customers must verify and enforce the request globally.

How information is disclosed

• To service providers and subprocessors that host, secure, transmit, analyze, support, or process the service.
• To connected applications and providers selected or authorized by the customer.
• Within the customer account according to roles, permissions, and configured workflows.
• To professional advisers, auditors, insurers, and transaction participants subject to appropriate duties.
• To authorities or other parties where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish legal claims.
• In connection with a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice requirements.

Lead360 does not sell personal information for money. Lead360 does not knowingly share personal information for cross-context behavioural advertising as that term is used under California law. A customer may independently connect advertising or social tools, and that customer is responsible for its own disclosure and opt-out duties.

International processing

Lead360 is based in Canada and uses infrastructure and providers that may process information in Canada, the United States, and other countries. Those countries may have different privacy laws and lawful-access rules. Where required, Lead360 will use an applicable contractual or legal transfer mechanism. Customers must configure connected services and data locations appropriate to their obligations.

Retention and deletion

We retain information for the account term and as reasonably necessary to provide the service, maintain security and continuity, comply with law, resolve disputes, enforce agreements, and honour suppression requests. Disabled sub-accounts generally have a 90-day restoration window before becoming eligible for permanent deletion. Eligibility does not mean every record is erased at the exact end of the window.

Deletion may take time to propagate through active databases, object storage, vectors, exports, backups, logs, and providers. Some linked records may need to be retained for billing, tax, fraud prevention, consent evidence, legal claims, security, or suppression. More detail is available in the Data Retention and Deletion Policy.

Safeguards

Lead360 uses technical, organizational, and administrative measures designed to protect information, including transport encryption, authentication, role-based access, tenant controls, logging, backups, credential protections, and incident procedures. No system is completely secure. We do not represent that every stored dataset, export, recording, vector, or backup is encrypted at rest unless that control has been specifically verified for the applicable service.

Privacy rights and requests

Depending on location and context, an individual may have rights to know, access, correct, delete, restrict, object, withdraw consent, receive a portable copy, limit certain sensitive-data uses, or complain to a regulator. California residents may also have rights to know categories and specific pieces, delete, correct, opt out of sale or sharing, limit certain sensitive-information uses, and receive equal service. Lead360 will not discriminate for exercising a privacy right.

1. Email [email protected] with the subject Privacy Request.
2. Identify whether the request concerns a Lead360 account, a Lead360 customer, Sales360, a communication, or a public website.
3. Provide only the information reasonably needed to locate records and verify identity or authority.
4. Lead360 or the relevant customer will confirm scope, request clarification if needed, and respond within the period required by applicable law.

Authorized agents may submit requests where permitted, but Lead360 may require proof of authority and identity. A request may be limited or denied where law permits, including for security, legal privilege, fraud prevention, another person rights, or records that must be retained.

Children and regulated data

Lead360 is a business service and is not directed to children. Customers must not knowingly use the service to collect personal information from children without the notices, consent, and safeguards required by law. Standard accounts must not contain PHI or similarly regulated health information. See the Health Data Program for the written approval requirements.

Contact and complaints

Lead 360 Marketing LTD. is responsible for this policy. Privacy questions, requests, and complaints may be sent to [email protected]. We will investigate privacy complaints and explain available escalation options. Individuals in Canada may contact the Office of the Privacy Commissioner of Canada or an applicable provincial regulator. Individuals elsewhere may contact their local supervisory authority.

Policy changes

We may update this policy as the service, vendors, laws, or practices change. The updated date appears at the top. Material changes will be communicated through the service, account email, or another reasonable channel before they take effect where required.