Privacy policy

LeadFlow is operated by HYPERCAT STUDIO LLC. Registered address: 11807 Westheimer Road, Suite 550, Houston, TX 77077. Country: United States of America.

What LeadFlow does

Agencies send clients a link to choose which Meta and Google accounts to share. We use platform data only to identify the accounts the client chooses, grant access to the named agency, and report the result. We do not use it for advertising, sell it, or use it for a secondary purpose.

Data we access

We store agency account names, email addresses, password hashes, settings, client contact details supplied by the agency, access requests, selected account IDs and names, permission levels, grant results, and security activity. Security activity may include IP addresses and browser information. We never ask for a client's Meta or Google password.

Meta: Facebook and Instagram

• business_management: business portfolio IDs, names and asset relationships, to add the agency's business as a partner.
• ads_management: ad account and pixel IDs, names and sharing permissions, to share the selected assets. We do not create advertisements or manage campaigns.
• pages_show_list and pages_read_engagement: Page IDs, names and information needed to list and identify Pages the client can share. We do not use Page content or engagement for analytics or advertising.
• pages_manage_metadata: access needed to grant the agency permissions on the selected Pages.
• instagram_basic: linked Instagram account IDs and names, to identify the selected accounts and arrange access.

Google

• openid, email and profile: Google user ID, name and email, to identify the person connecting.
• https://www.googleapis.com/auth/adwords: Google Ads customer IDs, names and manager-link information, to link the client's selected account to the agency's manager account.
• https://www.googleapis.com/auth/analytics.readonly: Analytics account and GA4 property IDs and names, to list the properties the client can choose.
• https://www.googleapis.com/auth/analytics.manage.users: existing GA4 access bindings and permission roles, to add or update the chosen agency user's access.
• https://www.googleapis.com/auth/tagmanager.readonly: Tag Manager account and container IDs and names, to list the client's accounts.
• https://www.googleapis.com/auth/tagmanager.manage.users: Tag Manager user permission records, to grant the agency the chosen access.

LeadFlow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing and service providers

The agency receives access only to the accounts the client selects. Meta and Google process the login and permission changes. Cloudflare hosts the application, handles queues, security checks with Turnstile, and email delivery; Neon hosts the database. We do not permit secondary use, advertising, or sale of platform data. Human access is limited to support requested by you, security, legal requirements, or other access allowed by the applicable platform policy.

When paid subscriptions open, Whop will process checkout, recurring payments and subscription management. LeadFlow stores subscription identifiers, the selected plan, payment-access status and renewal dates. Card details are handled by Whop and are not stored by LeadFlow. Whop may retain payment records under its own privacy policy and legal obligations.

Retention and security

OAuth tokens are encrypted at rest. Client tokens are revoked where possible and wiped once grant processing settles; tokens remaining in an unfinished flow have a maximum 24-hour deadline, with a purge check every 15 minutes. Failed revocation does not prevent local erasure. Agency tokens are retained until the agency disconnects or its account is deleted. Agency disconnection or account deletion can be requested through the contact below.

Request records and activity remain while needed to provide the agency's service, resolve disputes, and meet legal obligations. On an approved deletion request we erase or anonymise applicable platform records. Backup retention and any required legal retention must be confirmed by the operator before this draft is published.

Your choices and deletion

You may decline login, choose fewer accounts, revoke LeadFlow in Meta or Google settings, or request deletion. Removing LeadFlow does not automatically remove access already granted to an agency; manage that access in the relevant platform. See data deletion instructions.

Privacy and deletion requests: privacy@getleadflow.dev. Support: support@getleadflow.dev.