Privacy Policy

Effective September 12, 2026 · Last updated September 12, 2026

This policy explains what personal information YGF Leads collects, why, who it is shared with, how long it is kept, and the choices you have. It is written to describe what the platform actually does. Where a feature is optional or not yet offered, it says so.

1. Who we are and who this covers

YGF Leads (“we”, “us”) is a customer-relationship-management and lead-management platform for home-services sales teams, operated by TODO: legal entity name. This policy covers four kinds of people:

Customers — the businesses and salespeople who hold accounts on the platform.
Contacts — the leads and customers that our customers manage in the platform (we process this information on our customers' behalf).
Marketplace leads — people who requested a home-services quote through a lead partner and whose request we help fulfil.
Website visitors — anyone reading ygfleads.com.

For a contact's information, the business that entered it decides why it is collected and how it is used; we act on that business's instructions. If you are a contact and have a question about a business's use of your information, contact that business; you may also contact us and we will pass the request on.

2. Information we collect

2.1 From customers (account holders)

Account details: name, email address, password (stored only as a salted hash), timezone, role, and the company you belong to.
Settings you choose: how you use the platform, review-request settings, availability windows for booking, automation rules.
Connected accounts you authorize (see §6 and §7): Gmail, Google Calendar, Zoom and, when offered, Microsoft Outlook and Google Business Profile.
Payment identifiers for lead purchases (see §6 — we never see or store card numbers).
Support and usage records: your last login time, and metadata about AI-assisted features you use (see §8).

2.2 About contacts (entered by customers)

Identity and contact details: name, email address, phone number, company, city, state, postal code, country, and where the record came from.
Business context: deals and their stages and values, notes, tasks, custom fields the customer defines, meetings booked, and an activity timeline.
Messages: the emails and texts sent to the contact through the platform and the replies received, including message text.
Consent records: whether the contact has agreed to be contacted, when, by what method, and which person recorded it (see §4).
Lead-capture forms: if a customer embeds a YGF Leads form on their website and you submit it, the fields you enter plus your IP address (kept to limit abuse of the form).

2.3 About marketplace leads

Name, phone number, email address, city, state and ZIP code as supplied by the lead partner.
The service requested, budget and timeline as you tell us in the text conversation, and the conversation itself.
Whether and when you asked us to stop, and which business the request was delivered to.

2.4 From website visitors

This website uses no analytics, advertising or tracking scripts and sets no cookies. Our hosting provider keeps standard server logs (IP address, pages requested, browser type) for security and operation.

2.5 Cookies and local storage in the application

The application stores your login token and display preferences (theme, sidebar state) in your browser so you stay signed in and your layout persists. These are strictly necessary; no third-party or advertising cookies are used.

3. How we use information

To provide the service: keep your contacts and deals, send the messages you approve from your own connected inbox, sync replies, book meetings, run the automations you configure, and request reviews after won deals.
To confirm and deliver service requests in the lead marketplace (see §9).
To draft and analyse messages with AI when you use those features (see §8).
To secure the platform: authenticate you, validate webhooks from providers, rate-limit public forms, and keep an audit trail of consent.
To operate the platform: measure aggregate usage and AI cost, and send transactional email (password resets, invitations, lead-delivery notices).
To meet legal obligations and enforce our Terms.

We do not sell personal information, and we do not use it for advertising.

Every contact in the platform starts as not consented. A customer records consent by attesting to it (for example, after a phone call or a signed form) or through a submitted lead-capture form. Each change is an append-only event that records the date, the method, and the name and email of the person who recorded it. The platform will not send an outbound message or a review request to a contact whose consent is not on record; this is enforced in the database itself, not only in the interface.

5. Text messages (SMS)

YGF Leads sends text messages for two purposes: to confirm and qualify a service request you made through one of our lead partners, and to send service notifications to platform customers who opt in. Texts are sent through Twilio from numbers registered to YGF Leads.

Consent. We text only people who requested a service or otherwise agreed to be contacted. Lead partners provide a written attestation of that consent for every list they supply, and we keep it. Consent to receive texts is not a condition of any purchase.
What you will receive. A confirmation of the service you asked for, one or more short questions about the job (service, budget, timing), and a notice when we have connected you with a business. Message frequency varies; typically a few messages per request.
Cost. Message and data rates may apply.
Opt out. Reply STOP to any message and we will stop texting you; your carrier processes STOP immediately, and our system also recognises plain-language requests to stop (“leave me alone”, “remove me”). Reply HELP for help, or email hebron.abel10@gmail.com.
Sharing of mobile information. Mobile information is never shared with third parties or affiliates for marketing or promotional purposes. Your phone number is used to send you the messages described here, is passed to Twilio to deliver them, and is delivered to the business that fulfils your request. It is not sold or rented.
Conversation records. The text conversation is kept so the business you are connected with can see what you asked for, and so we can resolve any dispute about the request (see §9).

6. Third-party services we use

Service	What it does for you	What it receives
Google (Gmail, Calendar, Business Profile)	Sends your outreach from your own Gmail, reads replies in those threads, checks your busy times and creates calendar events, and — when the feature is enabled — reads your business's own Google reviews.	Only what you authorize on Google's consent screen. See §7.
Microsoft (Outlook, Teams)	Configured as an alternative inbox and calendar; not yet offered to customers. Nothing is sent to Microsoft until it is.	—
Zoom	Creates a Zoom meeting for bookings when you connect your Zoom account.	Meeting title, time and attendee names for the meeting it creates.
Twilio	Delivers and receives the text messages described in §5.	Phone numbers and message text.
Stripe	Processes payments for lead purchases and saved payment methods for recurring purchases.	Your payment details, entered on Stripe's own checkout page. We store only Stripe's identifiers for your customer record, payment method and each checkout.
DeepSeek	The AI model behind drafting, reply analysis, lead scoring, the assistant and text-message qualification.	See §8.
Email delivery (SMTP)	Sends transactional email from YGF Leads itself: password resets, invitations, lead-delivery notices.	Your email address and the notice.
Cloudflare	Hosts this website.	Standard web-server logs.

Each connected account is yours: you connect it, you can disconnect it in Settings at any time, and disconnecting stops all further access. Access and refresh tokens for connected accounts are encrypted before they are stored and are never returned by the platform's interfaces.

7. Google user data and Limited Use

When you connect Google services, we request only the scopes each feature needs: gmail.send and gmail.readonly to send messages from your Gmail and to read replies in the threads the platform started; calendar.events to read busy times and create meeting events; and, when review monitoring is enabled, business.manage to read your business's reviews. We use this data only to provide those features to you.

YGF Leads' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, we do not sell it, humans do not read it except with your consent, for security purposes, or to comply with law, and we do not transfer it except to provide the feature you asked for, with your consent, for security, or as required by law. We do not use Google user data to develop, improve or train AI or machine-learning models. The text of a reply you receive is sent to our AI provider only when you use a feature that analyses or drafts a response to that reply (see §8).

8. AI processing

Several features use an AI language model provided by DeepSeek: drafting outreach and follow-up emails, analysing a lead's reply, scoring a lead, the Sales Buddy assistant, and the text-message qualification conversation in the marketplace. To do this, the platform sends the model the relevant message text, conversation history, and facts about the contact or lead (for example first name, the service requested, deal stage). Human-assist mode is the default for outreach: AI-drafted messages are shown to you and sent only when you approve them.

We keep a metadata record of each AI call — which feature, which model, token counts, estimated cost and outcome — for cost accounting. We do not store the prompts or responses in that record. Under our agreement with DeepSeek, submitted content is processed to return a response and is subject to DeepSeek's own terms and privacy policy.

9. The lead marketplace

Businesses on the platform may buy leads: people who asked for a home-services quote through a third-party lead partner. Here is what happens with a lead's information:

We import the partner's list along with the partner's written attestation that the people on it consented to be contacted. A list cannot be used for messaging until the platform operator has reviewed that attestation and cleared the list to send.
We de-duplicate by phone number across all partners so the same person is not sold twice.
We text the lead to confirm the service, budget and timing (see §5). If the lead asks us to stop, or no business on the platform offers the service, we say so and stop.
A qualified lead is delivered to one purchasing business and becomes a contact in that business's account, not consented until that business records consent under its own responsibility.
A business may dispute a delivered lead within seven days of its first outreach. If it does, the platform operator may read the delivery record and, only if the business consents to disclosing it, the text conversation, to decide the dispute.

With the service providers in §6, each receiving only what its function needs.
Within your company: colleagues in the same company see the contacts and deals shared under that company's account according to their role; your personal automations, tasks, notifications, review settings and connected accounts are visible only to you.
With purchasing businesses, for marketplace leads, as described in §9.
With the platform operator: the operator sees aggregate metrics, AI usage and marketplace records, and never a company's contacts, deals or messages; that boundary is enforced in the platform's code.
For legal reasons: to comply with law, enforce our Terms, or protect the rights and safety of people on the platform.
In a business transfer: if YGF Leads is acquired or merged, information may transfer with it under this policy.

We do not sell or rent personal information, and we do not share it for third-party marketing.

11. How long we keep information

Account and company data: for as long as the account or company exists. Deleting your account removes it; the contacts and deals you owned stay with your company as unassigned records, and the company's administrators are notified.
Consent events: kept as an audit trail for as long as the contact record exists, with the recording person's name and email retained even if that person's account is later deleted.
Messages and conversation records: for as long as the contact or lead record exists.
Weekly contact exports: stored for the company's administrators to download; retained with the company's data.
Marketplace lead records: retained by the platform operator as the record of the sale, independent of what the purchasing business later does with its copy.
Google Business Profile review data, when that feature is enabled: cached copies kept no longer than 30 calendar days.
AI usage metadata: retained for cost accounting even after the related account is deleted; it contains no message content.
Website and server logs: per our hosting provider's standard retention.

A company owner can ask us to delete the company's data entirely by emailing the address in §16.

12. Security

Passwords are stored only as salted hashes (Argon2 or bcrypt).
Tokens for connected accounts are encrypted at rest and never exposed through the application's interfaces.
Each company's data is isolated by company at every application boundary; incoming webhooks from providers are signature-verified.
Consent is enforced at the database level, so a bug in one screen cannot message a non-consented contact.
Traffic to the platform and this website is encrypted with HTTPS.

No system is perfectly secure. If we learn of a breach affecting your information, we will notify affected users as the law requires.

13. Your choices and rights

Access and export. Customers can view and export their contacts and deals from the application (CSV export and weekly exports).
Correction. Customers can edit their account details and any record in the application.
Disconnect. Any connected Google, Zoom or other account can be disconnected in Settings at any time.
Delete your account. Available in Settings; see §11 for what happens to company records.
Text messages. Reply STOP at any time; see §5.
Contacts and marketplace leads. If a business holds your information on the platform, you may ask that business, or email us, to access, correct or delete it. We will pass the request to the business and delete what we hold ourselves where the law requires.
US state privacy rights. Depending on where you live, you may have the right to know what personal information we hold, to have it deleted or corrected, and to be free from discrimination for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising. To exercise a right, email hebron.abel10@gmail.com; we will verify your request and respond within the time the applicable law allows.

14. Children

The platform and this website are for businesses and are not directed at children under 16. We do not knowingly collect information from children; if you believe we have, email us and we will delete it.

15. Changes to this policy

When the platform changes in a way that changes how information is handled, we will update this page and the effective date at the top. Material changes will be announced to account holders by email or in the application.

16. Contact

TODO: legal entity name
TODO: mailing address
Email: hebron.abel10@gmail.com