LeadIQ — Privacy Policy
Effective date: 2026-05-15 Last updated: 2026-05-15 Data Controller: Saabsoft Technologies, Office 86, 4th Floor, Rasis Business Tower, Al Barsha 1, Dubai, UAE
1. What we collect
LeadIQ collects only what's necessary to qualify and route leads inside your Bitrix24 CRM.
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Portal metadata | Bitrix24 domain, member_id, user list, field schema, deal stages | Your Bitrix24 portal (with your consent at install) | Operate the app inside your CRM |
| Lead PII | Name, phone, email, budget, property preferences, conversation history | Your CRM + lead replies via WhatsApp/SMS | AI qualification + scoring + distribution |
| Agent activity | Response rate, conversion rate, lead-handling time | Computed from your CRM events | Performance-weighted distribution |
| Account info | Company name, billing email, subscription plan, payment status | You provide at trial/signup | Billing + support |
| System logs | API request timestamps, error traces, AI token consumption | Generated automatically | Debugging, security, billing |
We do NOT collect: Bitrix24 admin passwords, social security numbers, government ID numbers, credit card details (Stripe handles that), or any data outside your Bitrix24 portal.
2. How we use it
- Operate LeadIQ — qualify, score, distribute, and monitor leads as described in our Terms of Service
- AI inference — lead conversations are sent to Anthropic models (Claude Haiku, Sonnet, Opus). Each call carries ONLY that lead's data; no cross-tenant data sharing
- Service quality — aggregate usage metrics, error monitoring, security audits
- Billing — Stripe processes payments; we store invoice records and subscription status only
We never sell personal data. We never train AI models on your data — Anthropic API requests are not used for model training under our enterprise agreement.
3. Data isolation
Each LeadIQ client gets a dedicated PostgreSQL schema (tenant_{slug}). One client's data is physically separated from another's at the database level. Application middleware enforces this on every query.
4. Subprocessors
LeadIQ uses these subprocessors:
| Vendor | What they do | Where data is processed |
|---|---|---|
| Amazon Web Services | Hosts our servers, database, storage | us-east-1 (USA) |
| Anthropic | AI inference for lead qualification | Anthropic-managed (USA) |
| Stripe | Subscription billing | Stripe-managed (USA, EU as needed) |
| Twilio | WhatsApp / SMS delivery — uses YOUR Twilio account, not ours | Per Twilio's terms |
You can request the full subprocessor list at any time via privacy@saabsoft.com.
5. Encryption
- At rest: AES-256 (AWS KMS for storage volumes, Fernet symmetric encryption for sensitive DB fields like Bitrix24 tokens, Twilio credentials, client secrets)
- In transit: TLS 1.3 (HTTPS only, HSTS with 2-year preload)
6. Your rights (GDPR + similar)
You have the right to: - Access — request a copy of all data we hold on you - Rectification — correct inaccurate data - Erasure — request deletion of your account + all associated data (we delete the entire tenant schema) - Portability — request a machine-readable export of your data - Restriction — pause our processing while a complaint is being resolved - Object — opt out of any processing we do under "legitimate interest"
Email privacy@saabsoft.com. We respond within 30 days.
7. Data retention
- Active accounts — retained for the life of your subscription
- Cancelled accounts — retained for 90 days after cancellation for billing dispute resolution, then permanently deleted
- Audit logs — 1 year minimum (security + regulatory)
- Billing records — 7 years (UAE tax law)
8. Lead PII handling
Leads created in your Bitrix24 CRM are your data under data-protection law. Saabsoft processes them on your behalf as a Data Processor. You are the Data Controller and must: - Have a lawful basis to process the lead's data (typically consent or legitimate interest) - Inform leads about your use of LeadIQ in your own privacy notice - Honor leads' data-subject requests (deletion, access, etc.)
Our Data Processing Agreement is at /legal/dpa.
9. Security
- Penetration tested annually
- AWS WAF blocks common attacks (OWASP CRS, rate limiting, IP reputation)
- Two-factor authentication on all Saabsoft admin accounts
- Incident response: we will notify you within 72 hours of any data breach affecting your data
10. International transfers
Your data is processed in us-east-1 (USA). If you're an EU/UK client we rely on Standard Contractual Clauses (SCCs) for data export. We can host you in EU regions on request (Enterprise tier).
11. Children
LeadIQ is a B2B product. Not intended for children under 16. We do not knowingly collect data from anyone under 16.
12. Changes
We'll post any material changes here and email all subscribers at least 30 days before they take effect.
13. Contact
| For | |
|---|---|
| Privacy questions / data-subject requests | privacy@saabsoft.com |
| Billing | billing@saabsoft.com |
| General support | support@saabsoft.com |
| Security disclosures | security@saabsoft.com |
| Legal | legal@saabsoft.com |