Legal
Privacy Policy
Last updated: [DATE PENDING LEGAL REVIEW]
Draft — Not yet in effect
This document is a placeholder pending legal review and is not yet in effect, except for Section 3 (Data Architecture), which is an accurate technical description of how the system works today. Do not rely on the remaining sections as a binding privacy statement.
1. What Data We Collect
When you start the free diagnostic assessment, we collect:
- —Work email address (required — used to deliver your report and for account management)
- —First name (optional)
- —Company name (optional)
- —Annual recurring revenue range (optional — used only to calculate an estimated dollar impact)
- —Sales team size range (optional)
- —Your 40 multiple-choice answers to the diagnostic questionnaire
When you connect a CRM, additional data is pulled read-only from that CRM. See Section 3 for exactly what is and is not stored.
[PLACEHOLDER — counsel should confirm scope, purpose, and legal basis for each data category under applicable law (GDPR, CCPA, etc.).]
2. How We Use Your Data
[PLACEHOLDER — describe: delivering the diagnostic report; generating the weekly brief; billing and account management; internal analytics and product improvement; what data is used for each purpose; whether any data is used for model training or shared with third parties for marketing.]
3. CRM Data Architecture and Data Handling
Note
This section describes the actual, current technical behaviour of the system. It is not a placeholder.
Read-only CRM Access
When you connect a CRM, access is granted via OAuth 2.0. We never write to, modify, or delete records in your CRM. The OAuth access token is encrypted at rest using AES-256-GCM before being stored in our database. You can revoke access at any time through your CRM's OAuth settings, which immediately invalidates all stored tokens.
HubSpot and Zoho CRM — we request explicitly read-only OAuth scopes (e.g. crm.objects.deals.read, ZohoCRM.modules.deals.READ). The OAuth grant itself is scoped to reads; write operations are rejected by the provider even if attempted.
Assessment submissions — Assessment contact details and your answers are saved as you go, even if you do not finish the assessment. We may follow up with you about your results.
Salesforce — Salesforce's OAuth model does not offer a scope-level read-only restriction. We request the api scope, which grants full REST API access at the token level. Read-only behavior is enforced at the application layer: all Salesforce operations use read-only SOQL queries, and a runtime guard in our pipeline code throws immediately if any write-method HTTP call (POST, PATCH, PUT, or DELETE) is ever attempted to Salesforce's API. This distinction is disclosed here because it is relevant to enterprise security reviews.
CRM Fields We Do Not Request
Leak does not request the following fields from your CRM. This exclusion applies to CRM ingestion, not to contact details, answers, or request information you choose to enter on this site:
- —Deal names and descriptions
- —Contact names, email addresses, and phone numbers
- —Account or company names from CRM records
- —Custom field values not listed under 'What Is Stored' below
- —Any free-text or narrative CRM field
Server-Side Identifier Tokenization
CRM record identifiers for a deal, contact, or owner are replaced on Leak's servers with account-scoped cryptographic tokens before they are stored. This process uses HMAC-SHA-256 keyed with a per-account random salt. The salt itself is stored encrypted. The result is that our database contains opaque token identifiers with no link back to the original CRM records without possession of both the salt and the original value.
What Is Stored
The following numeric and categorical fields are stored, keyed to token IDs:
- —Deal amount (numeric)
- —Pipeline stage name (categorical — the label you defined in your stage mapping, not raw CRM values)
- —Date the deal entered each stage
- —Expected and actual close dates
- —Activity count over the trailing 30-day window (numeric)
- —Last activity date
- —Number of associated contacts (numeric)
- —Discount percentage, if available (numeric)
- —Lead source (categorical)
- —Closed-lost reason, if available (categorical)
These fields are sufficient to run the diagnostic scoring and detector logic and no more. No field that names or identifies a person or company is stored.
Separation of Assessment and CRM Data
Your assessment email address (used for account management and report delivery) is stored separately from CRM data and is never associated with any tokenized CRM record. A given email address cannot be used to look up which deals or contacts are associated with a CRM account.
4. Data Retention
[PLACEHOLDER — describe: how long assessment data is retained; how long CRM data is retained after a connection is revoked or a subscription is cancelled; whether any data is archived vs. deleted; whether anonymised aggregate data is retained indefinitely.]
5. Third-Party Subprocessors
We use the following third-party services to operate the platform:
Stripe
Subscription billing and payment processing. We do not store payment card data.
Privacy policy ↗Replit / PostgreSQL
Infrastructure and database hosting. All data is stored within the provisioned PostgreSQL instance.
Privacy policy ↗[PLACEHOLDER — counsel should confirm this list is complete, confirm data processing agreements are in place with each subprocessor, and add geographic data residency information if required.]
6. Your Rights and Deletion Requests
[PLACEHOLDER — describe: right to access your data; right to deletion; right to portability; right to correction; how to submit a request; response timeline; any exemptions. Note that CRM data is tokenized and the company may be unable to fulfil deletion requests for specific CRM records without a mapping from the requester.]
7. Contact
[PLACEHOLDER — Insert: company legal name, mailing address, privacy contact email, and (if applicable) Data Protection Officer details and EU representative details.]