Privacy Policy

Leafine Labs (“we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, and protect personal information when you use our websites, applications, and related services (the “Services”).

By using the Services, you acknowledge this Policy and our Terms. For questions, write to privacy@leafine.com.

Effective Date: 27 July 2026

Account Information: Name, email, phone, company details, role, and billing contacts.

Usage Data: Logs, events, performance telemetry, product usage, and diagnostics to improve reliability.

Order & Communication Data: Messages, emails, and orders processed through Leafine or connected integrations (e.g., WhatsApp Business Platform, Messenger, Gmail).

Technical Data: IP address, device and browser type, OS, language, timestamps, and cookies/identifiers.

We use data to:

Provide, operate, and maintain the Services.

Secure accounts, prevent fraud, and investigate incidents.

Improve features, fix bugs, and enhance performance.

Personalize workflows and recommendations.

Comply with legal obligations and enforce our Terms.

We never sell personal data or use it for third-party advertising.

We process data on the following legal bases: (i) to perform our contract with you; (ii) our legitimate interests in running and improving the Services; (iii) your consent (where required, e.g., certain analytics or marketing); and (iv) compliance with legal obligations.

We do not sell personal data.

The following is our complete list of third-party sub-processors. For each, we state what data they receive.

OpenAI — receives message content (body, subject, sender name, and conversation history) from connected messaging and email integrations. Used to draft customer support replies and generate conversation titles and summaries for the merchant who connected the account. OpenAI is our only AI sub-processor.

MongoDB Atlas — database hosting. Stores account data and message content.

Hostinger — application and queue hosting.

Meta Platforms — receives message content only for WhatsApp and Messenger conversations, where necessary to deliver business messaging through their approved APIs.

PostHog — product analytics events only. Does not receive message content.

New Relic — application performance monitoring: request handler names and timing only. Does not receive message content.

We may also disclose data to legal authorities when required to comply with law, regulation, or valid legal process.

When you connect WhatsApp Business Platform or Messenger, we process messages and related metadata solely to deliver the conversation, provide support features, and prevent abuse. We do not use this content for ads or profiling unrelated to the Services.

Your use of these integrations must follow Meta’s terms and applicable consent and notice rules in your region.

When you connect a Google account, we request a single OAuth scope:

https://www.googleapis.com/auth/gmail.modify

We use it to read inbound customer emails and surface them in the merchant’s Leafine inbox, to send replies from the merchant’s own address, and to write limited state back to the mailbox: we remove the UNREAD label from a Gmail thread when a merchant opens that conversation in Leafine, and we apply a label to threads that have been answered through Leafine. These writes keep the merchant’s shared mailbox aligned with the work their team has done. We do not delete messages, create drafts, or change account settings.

Message content from connected Gmail accounts is processed by OpenAI, as described in Section 5, to draft replies and generate conversation titles and summaries. No other third-party AI provider receives Gmail data.

Google Workspace data is never used for advertising, never sold, and never used to train or improve any AI or machine learning model, including by our sub-processors.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Data may be processed in or transferred to countries outside your own (e.g., EU/UK ↔︎ US). We use appropriate safeguards such as Standard Contractual Clauses and technical measures to protect data during transfer.

We keep personal data only as long as needed for the purposes above or to meet legal obligations. Typical defaults: account data for the subscription term plus up to 24 months; system logs up to 12 months; support tickets up to 24 months; backups per rolling schedules.

You can request deletion or export at any time (see Section 12).

We apply defense-in-depth measures: encryption in transit and at rest, access controls, least-privilege, audit logging, and continuous monitoring. While no system is 100% secure, we work to prevent, detect, and respond to incidents quickly.

We use cookies and similar technologies for authentication, analytics, and product features. You may manage preferences in your browser; some features may not function without required cookies.

Depending on your jurisdiction (e.g., GDPR/UK GDPR), you may have rights to:

Access, correct, or delete your personal data.

Object to or restrict certain processing.

Request data portability.

Withdraw consent where processing is based on consent.

Lodge a complaint with your local data protection authority if you believe your rights are infringed.

To exercise rights, contact: privacy@leafine.com

Our Services are not directed to children and we do not knowingly collect personal data from anyone under the age required by local law.

We may update this Policy from time to time. Changes take effect when posted. The latest version will always display the current Effective Date.

Leafine Labs

Cercle des Bureaux Bloc B Bureau 1-1-2, Centre Urbain Nord, El Menzah, Tunis 1082, Tunisia

privacy@leafine.com · contact@leafine.com

For security disclosures, please include "Security" in your subject line.