This policy explains what LeadWing does with personal data: the data about you as an agent using the service, and the data you keep about your own clients. It follows the GDPR and the Spanish data protection law (LOPDGDD), in plain language.
1. Who is responsible
LeadWing is operated by:
- Name
- [Legal name]
- Tax ID (NIF)
- [NIF]
- Address
- [Street, postcode, city, Spain]
- [contact email]
For the data about your account we are the controller. For the data you keep about your clients we act on your instructions as a processor (section 4). We have not appointed a data protection officer; write to the email above for anything to do with personal data.
2. The short version
| Controller | [Legal name], [contact email] |
|---|---|
| Purposes | Run your account and the CRM; bill Pro subscriptions; keep the service secure; answer support; measure use of the public website. |
| Lawful basis | Our contract with you; our legal obligations (tax and accounting); our legitimate interest in security and in understanding how the service is used; your consent where we ask for it. |
| Recipients | The providers that host and run the service (section 6); authorities when the law requires it. Nobody else. |
| Rights | Access, rectification, erasure, restriction, portability and objection, by email; complaint to the Spanish Data Protection Agency (section 9). |
| More | Sections 3 to 13 below. |
3. Data about you
What we collect
- Account: your email address; your name, if you sign in with Google or add it; your interface language; and the sign-in method you use (Google, or a one-time code by email). When you sign in with Google, Google gives us your email address and name, which we use only to create and recognise your account. We never see or store a password.
- Billing, on Pro only: the details Stripe collects at checkout, such as name, billing address, VAT number and payment method, and the status of your subscription. Card numbers go straight to Stripe and never touch our servers.
- Referrals: your invite code, who invited you and whom you invited, and the credits earned.
- Use of the service: the clients, properties, viewings, offers, appointments, templates, calculator analyses and documents you create, and when you did so.
- Technical data: IP address, browser and device type in short-lived server logs, and aggregated, cookie-free statistics about the public website (section 8).
- Support: what you write to us by email.
Why, and on what basis
- To provide the service, sign you in, remember your language and send the emails the service needs (sign-in codes, the reminders you set, billing notices): performance of our contract with you (art. 6(1)(b) GDPR).
- To bill Pro subscriptions, issue invoices and keep accounting records: our contract, and our legal obligations under Spanish tax and commercial law (art. 6(1)(c)).
- To keep the service secure, prevent abuse and fix problems: our legitimate interest in running a reliable service (art. 6(1)(f)).
- To understand how the public website is used: our legitimate interest, using statistics that do not identify you.
- To run the referral programme you take part in: our contract with you.
- To send you news about LeadWing: only if you ask us to, and you can opt out at any time (consent, art. 6(1)(a)). We send no marketing email today.
An email address is necessary to open an account; without it we cannot provide the service. We make no automated decisions with legal effects about you, and we do not profile you.
4. Data about your clients
When you add a buyer or seller to LeadWing, you decide what to store: name, phone, email, language, nationality, budget and preferences, notes, the properties they view, offers, reservation dates, appointments, and any documents you upload, such as contracts or identity documents.
For this data you are the controller and we are your processor. In plain terms:
- We process it only to provide the service to you and on your instructions, under the data processing agreement in our Terms of Service.
- You are responsible for having a lawful basis to keep it, for telling your clients how their data is used (arts. 13 and 14 GDPR), for keeping it accurate, and for any retention rule that applies to you, such as anti-money-laundering obligations for estate agents.
- Only you can see it. Every agent’s data is isolated by row-level security in the database; other agents, including colleagues at the same agency, cannot reach your book. We access it ourselves only when you ask for support or when it is strictly needed to operate the service.
- If one of your clients contacts us about their data, we will refer them to you and help you respond.
5. AI features
Two features use a third-party language model: pasting a portal enquiry to create a lead, and drafting messages or emails to a client. They run only when you press the button.
- What is sent: for lead capture, the text you paste. For drafts, the client’s name, whether they buy or sell, their pipeline stage and agency tag, budget and preferences, their most recent viewing or offer, reservation dates, and any draft or instruction you type.
- Who receives it: OpenRouter, Inc. (United States), which routes the request to OpenAI’s models. Under their business terms the content is not used to train models and is kept, if at all, only briefly for abuse monitoring.
- What comes back is a suggestion. Nothing reaches your client until you read it and send it yourself, and the model sees nothing beyond the request.
If you would rather not send client data to an AI provider, do not use these two features; the rest of the service works without them.
6. Who we share data with
We do not sell personal data and we do not share it for advertising. The service runs on these providers, each bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | [Supabase project region, e.g. eu-west-1 (Ireland)] |
| Vercel, Inc. | Hosting, content delivery and cookie-free website statistics | United States (EU-US Data Privacy Framework, with standard contractual clauses as fallback), with edge servers worldwide |
| Stripe Payments Europe, Ltd. | Payments, invoices and VAT for Pro | Ireland and United States (Data Privacy Framework) |
| Google LLC | Sign in with Google; Google Calendar, if you subscribe to your calendar feed | United States (Data Privacy Framework) |
| OpenRouter, Inc. and OpenAI | AI drafting and lead capture (section 5) | United States (standard contractual clauses) |
| Resend (Plus Five Five, Inc.) | Sending sign-in codes and service emails | United States (Data Privacy Framework) |
We may also disclose data when the law requires it, to defend our rights, or to a successor if the business changes hands, in which case this policy continues to apply.
7. International transfers
Your database and files are stored in the European Union. Some providers above process data in the United States. Where they do, the transfer relies on their certification under the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses, as noted in the table. You can ask us for a copy of the safeguards.
8. Cookies and storage on your device
LeadWing uses only the cookies it needs to work and to remember your choices, so it shows no cookie banner. Nothing on this site tracks you across other websites.
| Name | Purpose | Duration |
|---|---|---|
| sb-… (Supabase) | Keeps you signed in | Refreshed while you use the service; up to 400 days |
| NEXT_LOCALE | Remembers your language | One year |
| sidebar_state | Remembers whether the sidebar is open | Seven days |
| lw_ref | Remembers the invite link you arrived from, so the referral is credited | 30 minutes |
When you install LeadWing on your phone, the browser also keeps a copy of recently opened pages so they stay readable offline. You can remove all of this at any time by clearing the site’s data in your browser or uninstalling the app.
Website statistics come from Vercel Web Analytics, which sets no cookies and stores nothing on your device: it counts page views with a hashed identifier that is discarded within a day.
9. Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw any consent you have given. Write to [contact email]. We may ask you to confirm your identity, and we answer within one month.
You can delete clients, documents and analyses yourself at any time. To close your account, email us: we delete your data within 30 days, except what we must keep by law (section 10).
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the supervisory authority where you live.
10. How long we keep data
- Your account and everything in it: while your account is open, and for up to 30 days after you ask us to close it. Downgrading from Pro to Free deletes nothing.
- Invoices and payment records: six years, as Spanish commercial and tax law requires, blocked and used for nothing else.
- Server logs: up to 30 days.
- Backups: overwritten on our provider’s normal cycle, within 30 days of deletion.
11. Security
Data travels encrypted (TLS) and is stored encrypted at rest. Each agent’s data is separated by row-level security in the database; server-side keys never reach the browser; card details are handled entirely by Stripe. Access to production is limited to what running the service requires. No system is perfectly secure: if a breach affects you we will tell you, and the Spanish Data Protection Agency, as the law requires.
12. Minors
LeadWing is a professional tool for adults. We do not knowingly hold accounts for anyone under 18.
13. Changes
We will post any new version here with its date. If a change affects you materially we will email you before it takes effect.