Privacy Policy

LeadPipe AI Inc. ("LeadPipe", "we", "us", or "our") is a Canadian B2B SaaS company that delivers exclusive homeowner leads to home service contractors across Canada. We are committed to protecting the privacy of our contractors, our homeowner contacts, and any other individuals whose personal information comes into our custody.

This Privacy Policy describes what personal information we collect, why we collect it, how we use it, with whom we share it, how long we retain it, and the choices and rights you have. It applies to the LeadPipe AI website, dashboard, API, and email communications (collectively, the "Service").

This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), and with substantially similar provincial private-sector privacy legislation in Quebec (Law 25), British Columbia (PIPA), and Alberta (PIPA) where applicable to your business. Our PIPEDA Compliance Statement is available at /pipeda.

Account information: When you register an account, we collect your name, business email address, and a password stored as a one-way bcrypt hash. We never store passwords in plaintext. We also collect a verified phone number for account recovery and lead delivery notifications.

Business information: We collect your legal business name, operating name (if different), service category (plumbing, HVAC, electrical, roofing, painting, landscaping, or general), service area (postal code(s) or city/region), and business address. We use this to match you with relevant leads and to verify your trade licensing where required by your province or municipality.

Usage and security information: We collect lead delivery records, login timestamps, IP addresses, user-agent strings, and aggregated usage metrics. This information is used for security, fraud prevention, abuse detection, and service improvement. We do not collect precise geolocation from contractors unless you explicitly enter your service area.

We use your personal information to: (a) deliver qualified, exclusive homeowner leads to your account; (b) process subscription payments and issue receipts; (c) communicate with you about your account, leads, billing, and service updates; (d) prevent fraud, abuse, and unauthorized access; and (e) comply with our legal obligations under Canadian federal and provincial law, including tax and anti-spam (CASL) regulations.

We also use de-identified, aggregated usage data to improve lead quality, plan market expansion, and develop new features. Aggregated data is not linked to your individual identity and cannot reasonably be used to re-identify you.

We do not sell your personal information to third parties under any circumstances. We do not use your personal information to train third-party artificial intelligence models. Where we use AI-assisted tools internally, the data remains within our own infrastructure and vendor relationships described in this policy.

Under PIPEDA, we collect, use, and disclose your personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we obtain your consent at the time of collection. The principal legal bases for our processing activities are:

(a) Performance of a contract: We process your business information to set up your account and deliver leads as agreed under our Terms of Service. (b) Legitimate business interest: We process usage and security data to protect the integrity of the Service and other contractors. (c) Consent: We collect optional information (such as a phone number for SMS notifications) based on your explicit opt-in consent, which you may withdraw at any time.

Where consent is required, you may withhold or withdraw consent subject to reasonable legal and contractual restrictions. Withdrawing consent may limit our ability to continue providing certain features of the Service.

We share personal information only with service providers who need it to deliver components of the Service on our behalf, and who are bound by written agreements requiring confidentiality and compliance with PIPEDA. Our current providers include:

Stripe (payment processing, PCI-DSS compliant) — receives payment method details and billing information. Resend (transactional email delivery) — receives email addresses and message content necessary to deliver your lead notifications and account communications. Turso (database hosting on AWS us-east-1) and Vercel (application hosting, global edge network) — receive the data necessary to operate the platform.

We do not share personal information with contractors other than the recipient of a specific lead. We do not sell personal information. We may disclose personal information where required by law, court order, or legitimate request from Canadian law enforcement or regulatory authorities, or to protect the rights, property, or safety of LeadPipe AI, our contractors, or the public.

Account data: We retain your account information, business profile, and subscription records for the duration of your active account, plus a period of ninety (90) days after account closure. This grace period allows for recovery in case of accidental cancellation and supports final billing reconciliation and dispute resolution.

Lead data: We retain homeowner lead records, including contact information and delivery status, for seven (7) years after the lead is delivered. This retention supports tax and audit compliance for contractors who claim lead acquisition costs as business expenses, and supports fraud and abuse investigations across longer time horizons. Leads are not used for any new marketing purpose during the retention period.

Security logs: IP addresses, login timestamps, and security event logs are retained for ninety (90) days. Aggregated, de-identified analytics data may be retained indefinitely. You may request earlier deletion of your account data (subject to the legal retention periods above) by emailing privacy@leadpipe.me.

We implement industry-standard administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction. Specific safeguards include:

Passwords are hashed using bcrypt with a work factor appropriate to current hardware. All network traffic between your browser and our platform is encrypted using HTTPS (TLS 1.2 or higher). We apply rate limiting and anomaly detection to authentication endpoints. Environment variables and secrets are stored as encrypted values on Vercel and are never committed to source control or exposed in client-side bundles. Access to production systems is restricted by role and reviewed quarterly.

Despite these safeguards, no system can be guaranteed to be perfectly secure. In the event of a confirmed breach affecting your personal information, we will notify affected contractors and the Office of the Privacy Commissioner of Canada as required by PIPEDA breach notification obligations, and as soon as feasible after containment.

Under PIPEDA and applicable provincial privacy laws, you have the right to: (a) access the personal information we hold about you; (b) correct inaccurate or incomplete information; (c) request deletion of your personal information, subject to legal retention obligations described in Section 6; and (d) withdraw consent for processing that is based on consent, subject to reasonable legal or contractual restrictions.

To exercise any of these rights, email privacy@leadpipe.me from the email address associated with your account. We will verify your identity before disclosing or modifying account information, and we will respond to verified requests within thirty (30) days, as required by PIPEDA.

If you believe we have not resolved your concern satisfactorily, you may complain to the Office of the Privacy Commissioner of Canada (opc.gc.ca) or, where applicable, the provincial privacy commissioner in your jurisdiction.

We use a minimal set of cookies. The Service relies on a single first-party session cookie required for authentication and dashboard access. We do not deploy third-party advertising, analytics, or tracking cookies. We do not embed advertising pixels on the platform.

When you visit our public marketing pages, we may use Vercel Web Analytics, which uses aggregated, privacy-preserving metrics without setting cross-site tracking identifiers or cookies. You may clear cookies at any time through your browser settings; doing so will sign you out of the dashboard.

CASL (Canada's Anti-Spam Legislation) compliance: We send commercial electronic messages only to contractors who have explicitly subscribed to a LeadPipe AI plan or who have otherwise provided express or implied consent. Every commercial email we send includes a working unsubscribe link, and we honour unsubscribe requests within ten (10) business days.

The Service is intended exclusively for use by businesses and individuals eighteen (18) years of age or older. We do not knowingly collect personal information from anyone under the age of eighteen, and contractors using the Service represent that they are of legal age to form a binding contract in Ontario.

Homeowner leads we receive may occasionally include information about minors (for example, when a parent requests emergency plumbing service on behalf of a household). We do not knowingly market to minors, and we do not retain minor-specific data beyond the standard lead retention period described in Section 6.

If you believe we have inadvertently collected personal information from a minor, please contact privacy@leadpipe.me and we will promptly delete it.

LeadPipe AI Inc. is a Canadian company, but our infrastructure is distributed for performance and reliability. Application hosting is provided by Vercel on its global edge network, and database hosting is provided by Turso on AWS in the us-east-1 (Northern Virginia) region. Email delivery is provided by Resend, which may process data in the United States.

As a result, your personal information may transit or be stored in the United States. We rely on the substantially similar provisions of PIPEDA and the standard contractual safeguards in our vendor agreements to ensure that personal information transferred outside Canada receives a comparable level of protection.

We do not transfer personal information to jurisdictions that lack adequate privacy protection. If our infrastructure footprint changes materially, we will update this section and notify affected contractors by email where required.

If you have any questions about this Privacy Policy, our handling of your personal information, or to exercise any of your privacy rights, please contact our privacy team at:

LeadPipe AI Inc. Calgary, Alberta, Canada Email: privacy@leadpipe.me Phone: (403) 671-2828

A designated privacy officer is responsible for overseeing our compliance with PIPEDA and applicable provincial privacy legislation. We aim to respond to all privacy inquiries within ten (10) Canadian business days. For broader account questions, contact support@leadpipe.me; for abuse reports, contact abuse@leadpipe.me.