Legal

Privacy Policy

Last updated: 10 September 2026

Robert Kaminski, a sole trader trading as LeadFlow Automations ("we", "us", "our"), is the controller of personal information submitted through this website. Our business correspondence address is Bartle House, 9 Oxford Court, Manchester, M2 3WQ. This is a correspondence address and does not represent a staffed LeadFlow office. This Privacy Policy explains how we collect, use, disclose and safeguard your personal information when you visit our website or contact us about our services.

Please read this policy carefully. If you do not agree with its terms, please discontinue use of our website.

1. Information We Collect

Information you provide directly

When you send a website question, purchase a package, begin onboarding or communicate with us, we may collect:

  • Full name and business name
  • Email address and phone number
  • Details about your business, website and requirements
  • Package, payment status, amount, currency and bounded Stripe identifiers needed to reconcile a purchase; LeadFlow does not receive your full card details
  • Any other information you choose to share

Our public website question form and purchase journey are for information about your own business. Please do not submit customer enquiries or personal data about your customers through them.

When you choose Talk to Anna

Anna is LeadFlow's optional AI sales and information guide for this website. Nothing starts on page load, while you scroll or until you deliberately press “Talk to Anna”, read the short notice and allow microphone access. If you do, your live speech and Anna's live responses are processed transiently so she can answer approved questions, understand what you need, compare the current routes and guide you around this website.

LeadFlow does not record the conversation or keep a transcript. This website chat cannot take notes, save messages or arrange callbacks. To contact LeadFlow, use Send LeadFlow a question; you must submit that written form yourself. Please do not tell Anna payment-card details, passwords, security codes, medical information or other sensitive personal information. You can mute, minimise or end the conversation at any time.

Photos in your Command Centre

Where photos are enabled for your account, authorised users can add still images to an existing enquiry. We process the image, its account and enquiry identifiers, upload and expiry times, size and access/deletion records. We resize and re-encode a copy as JPEG and remove embedded image metadata. Your original stays on your device. The retained copy is available through authenticated access, not a public gallery link. Images may still show personal information in their visible content; the agreed restrictions on customer data apply to photos too.

Information collected automatically

Our hosting provider may create security and access logs when you visit the website. Those logs may include:

  • IP address and browser type
  • Pages requested and request timestamps
  • Referring website or search engine
  • Device type and operating system

2. How We Use Your Information

We use the information we collect to:

  • Respond to your enquiries and provide requested services
  • Provide package purchasing, onboarding and the requested LeadFlow service
  • Provide the optional Anna website guide and direct visitors who want to contact us to the separate written question form
  • Take requested steps before a possible written service agreement
  • Keep the website secure and improve its reliability
  • Comply with legal obligations

3. Legal Basis for Processing

We match each purpose to an appropriate legal basis:

  • Contract and steps at your request before a contract — to provide package purchasing, onboarding and the requested service
  • Legitimate interests — to answer ordinary business questions, prevent abuse, secure the website and improve reliability; our interests are running a safe, responsive service and we consider the impact on you
  • Consent — only where we ask separately for an optional use, such as future electronic marketing; you may withdraw that consent at any time
  • Legal obligation — to comply with applicable laws

We do not use details submitted through the question form, purchase journey or onboarding for unrelated electronic marketing unless you have separately asked for it or another lawful route clearly applies.

4. Sharing Your Information

We do not sell, trade or rent your personal information to third parties. We use service providers only for the stated purpose and under appropriate contractual and security controls. These include:

  • Netlify (website hosting and, when enabled for publication, website-form handling)
  • Cloudflare Turnstile (a necessary anti-abuse check for Anna; it receives browser, IP and device-security signals, but we do not intentionally send your question or voice content to Turnstile)
  • Google Cloud Platform in London (the Cloud Run gateway that transiently transports Anna's live session; application logs are designed to contain operational codes, not audio or conversation content)
  • Google Gemini Developer API (paid Live API processing of transient speech, approved instructions and live responses; limited provider abuse-monitoring processing may apply)
  • Stripe (hosted checkout, subscriptions, billing-portal sessions and refunds; Stripe receives card and billing details while LeadFlow receives only bounded purchase identifiers, status, amount, currency and the customer email needed for reconciliation)
  • Resend (Growth sends only the exact email an owner reviews and approves; Resend processes the recipient, subject, approved message body, sending and reply addresses, plus delivery or bounce events)
  • Supabase (London-hosted authentication, database and private object-storage services for customer account access, Command Centre enquiries and resized photos, configuration data, operational and deletion evidence, approved Anna source configuration and previously confirmed follow-up records retained under the existing retention schedule; new public website Anna chats do not save contact details or messages)
  • Email service providers (for responding to enquiries)
  • Google Fonts (delivery of website fonts, which involves a request from your browser to Google)

See the current Website suppliers and subprocessors page for a concise description of each service and the information it handles. Twilio carries separately configured Pro telephone calls; it is not used for a website Anna conversation.

5. International Transfers

Some suppliers may process technical, contact or transient voice information outside the UK, including through support, security and abuse-monitoring operations. A London Cloud Run gateway does not mean every part of the provider chain is UK-only. Where a restricted transfer occurs, we rely on the supplier's UK data-processing terms and an appropriate UK transfer mechanism or other lawful safeguard. You may ask us for more information about the safeguard used for a particular supplier.

6. Data Retention

Website questions and previously saved Anna follow-up details that do not become a client relationship are scheduled for deletion within 90 days after the final response, unless a shorter period is requested or we need a longer period to establish, exercise or defend legal claims. LeadFlow does not retain Anna audio or a conversation transcript. We retain only bounded operational evidence, such as timestamps, outcome, duration and cost metadata, for reliability, security and allowance control. Provider security or abuse-monitoring retention may differ and is governed by the provider's terms. If you become a client, relevant correspondence and purchase records are retained for the period stated in the written service agreement and retention schedule. A separately approved customer schedule is required before any real customer-enquiry processing is activated.

Enquiry photos: the retained image follows the enquiry's expiry, normally 90 days from the enquiry's receipt or the shorter period agreed for that account. Adding a photo does not extend this date. Access is denied at expiry; scheduled cleanup removes the stored bytes. Deleting a photo or its enquiry also triggers byte removal. After confirmed removal, a restricted record of internal identifiers and deletion time is retained for 37 days to verify deletion. It contains no image, original filename or extracted image metadata. Database backups do not include stored photo bytes, and LeadFlow does not provide deleted-photo recovery. Download any copies you need before expiry or deletion.

7. Your Rights

Under applicable data protection laws, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion of your personal data
  • Restriction — request we limit how we use your data
  • Portability — receive your data in a machine-readable format
  • Object — object to processing based on legitimate interests

Your right to object: where we rely on legitimate interests, you may object to that processing. You may also withdraw consent at any time where consent is the basis. To exercise a right, contact hello@leadflowautomations.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

8. Cookies and Similar Technologies

No analytics, advertising or marketing cookies are currently active on this website. We do not intentionally store information on your device for marketing or analytics. Netlify may use strictly necessary security technology when serving or protecting the site. If you deliberately start Anna, Cloudflare Turnstile performs a necessary one-use anti-abuse check. If non-essential technology is added later, it will be blocked until an appropriate choice has been given and this notice will be updated.

9. Automated Decision-Making

Starter does not use AI to screen, prioritise, summarise or draft a reply to a customer enquiry. Every newly captured website enquiry is marked neutrally for human review. Growth may prepare an email under the business's agreed rules, but the owner sees the exact recipient, subject and editable message before deciding whether to approve it. Nothing sends without that approval. When approved, LeadFlow sends that exact version once, records delivery or bounce status and directs replies to the agreed business mailbox. The public website Anna may ask bounded context questions and explain and compare the current packages, but she cannot save or forward messages, arrange callbacks, recommend or choose a package, take card details or complete payment. To contact us, submit the separate written question form. Pro customers receive a separately configured telephone receptionist once their service has been set up and activated. We do not make solely automated decisions through the public website that have legal or similarly significant effects.

10. Third-Party Links

Our website may contain links to third-party websites. We have no control over the content or privacy practices of these sites and are not responsible for their privacy policies. We encourage you to review the privacy policy of any third-party site you visit.

11. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure or destruction. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last Updated" date at the top of this page. Your continued use of our website after changes are made constitutes your acceptance of the revised policy.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

← Back to homepage