LeadHaus ("we," "us," or "our"), operated by LEAD HAUS LLC, an Arizona limited liability company, is committed to protecting the privacy of its users. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have regarding your data. LEAD HAUS LLC is responsible for (the controller of) information about you as a LeadHaus account holder; for the client and contact data you store in the Service, we act as your service provider (see Section 7a). You can reach us about privacy at privacy@leadhauscrm.com.
LeadHaus is a CRM platform for mortgage loan officers, realtors, and their teams. Accounts are created by self-registration (with a verified email address) or by invitation from an account administrator.
Subscription payments are processed by Stripe, Inc. We store your subscription status, plan, and billing dates, but never your full card number — payment credentials are held by Stripe under its own privacy policy.
We collect information in three ways: information you provide directly, information generated by your use of the Service, and information from third-party integrations you choose to connect.
Information you provide:
| Category | Examples |
|---|---|
| Account data | Name, email address, phone number, company name, professional title |
| Contact records | Names, phone numbers, email addresses, and financial details of your leads, borrowers, and partner contacts that you enter into the CRM |
| Communications | Emails and SMS messages sent through the Service, call log notes, tasks, and document checklists |
| Business data | Loan amounts, estimated commissions, pipeline stages, lead sources, and referral partners |
| Drip campaigns | Email and SMS templates and automation sequences you create |
Information generated automatically:
| Category | Examples |
|---|---|
| Email engagement | Open and click events on emails you send through the Service (tracked via pixel and link rewriting) |
| Usage data | Which features you use, timestamps of actions, and rate-limit counters to prevent abuse |
| Audit logs | Records of administrative actions (inviting users, removing users, editing sponsor listings) |
| Call recordings and transcripts | Audio recordings of calls placed or received through LeadHaus-connected phone numbers, their transcripts, and AI-generated call summaries (see “Call recording” below) |
| AI-generated content | Message drafts, summaries, and other content generated when you use AI features |
| Location (weather widget) | Your precise browser location, only if you use a weather feature in the Service and allow your browser to share your location. Your browser sends it directly to the weather and map providers listed in Section 4 to show local weather; it is not stored in your account. |
Call recording. Calls placed or received through LeadHaus-connected phone numbers are recorded by default. Each recording is transcribed by OpenAI and summarized by Anthropic, and the transcript and summary are stored in your call history for the life of your account. The audio recording itself is held in your own Twilio account and remains there after you close your LeadHaus account. You control this setting in Settings, under Phone System → Call recording + AI recap. You are solely responsible for obtaining any consent to recording that is required by the laws of the states where the participants in your calls are located.
Information from third-party integrations (only if you connect them):
| Category | Examples |
|---|---|
| Google (Gmail) | OAuth access and refresh tokens to send email on your behalf. We do not read or store the content of your inbox. |
| Google Calendar | OAuth tokens to create and manage calendar events on your behalf. |
| Microsoft (Outlook / 365) | OAuth tokens to send email and create or manage calendar events on your behalf. We do not request permission to read or store your inbox contents. |
| Twilio (SMS and voice) | Your Twilio Account SID, Auth Token, and phone number to send and receive SMS messages and to place, receive, and record calls. |
We use the information we collect to:
We do not sell your personal data. We do not use your data to train AI or machine learning models, and our AI providers (Anthropic and OpenAI) process it under commercial API terms that prohibit training on it. We do not use your clients' data for any purpose other than delivering the Service to you.
Your data is stored in Supabase, a managed database platform hosted on AWS infrastructure. All data is encrypted at rest and in transit.
Third-party integration credentials (Google and Microsoft OAuth tokens, Twilio credentials) are stored using Supabase Vault, an encrypted secrets store. These credentials are designed to be decrypted only server-side when executing API calls on your behalf; they are not sent to your browser.
Row Level Security (RLS) policies at the database layer are designed to restrict each authenticated user to their own data and to data deliberately shared with them through Service features (for example, a team's shared lead pool or a lead's designated collaborators) — never to unrelated users' data.
While we take reasonable steps to protect your data, no system is completely secure. We encourage you to use a strong, unique password and to enable two-factor authentication within the Service.
Loan officers may enter nonpublic personal information about consumers — such as loan amounts, loan stages, pre-approval details, and property information — in the course of using the Service. Where LeadHaus processes such information on behalf of a financial institution, we act as a service provider: we maintain administrative, technical, and physical safeguards designed to protect that information (encryption in transit and at rest, row-level access controls, encrypted credential storage, logged administrative actions), we use it solely to provide the Service, and we do not sell it or disclose it to nonaffiliated third parties for their own marketing. These practices are designed to support our customers’ obligations under the Gramm-Leach-Bliley Act and Regulation P.
Sensitive identifiers. The Service is not designed for storing Social Security numbers, full financial account numbers, or government ID numbers, and we ask that you do not enter them. If such information is entered in free-text fields, it receives the same encryption and access controls as all other customer data, and you remain responsible for entering only what your own compliance obligations permit.
Business customers who act as controllers of their own clients’ data may contact us through our secure contact form to discuss data-processing terms for their organization.
If we determine that a security incident has resulted in unauthorized access to your personal information in unencrypted form — or in encrypted form where the encryption key was, or is reasonably believed to have been, compromised — we will notify affected account owners without unreasonable delay — our target is within 30 days of confirming the incident, and sooner where applicable state breach-notification laws require it — unless a law enforcement agency asks us to delay notice. The notice will describe what happened, the categories of data involved, and the steps we are taking.
We work with third-party providers necessary to operate the Service:
| Category | Examples |
|---|---|
| Supabase | Database, authentication, and file storage. Data is stored in US-based AWS data centers. |
| Stripe | Subscription payment processing. Stripe receives your payment details directly; we store only your subscription status, plan, and billing dates. |
| Anthropic | AI features (message drafting, summaries including call summaries, AI responses, translations, and generated marketing content). Relevant contact and message content is processed by the Anthropic API under commercial terms that prohibit using it to train models. |
| OpenAI | Transcription of call recordings (the call audio) and, if you use the voice assistant, the audio of your conversations with it. Processed under commercial API terms that prohibit using it to train models. |
| Resend | Delivery of certain transactional emails, and receipt and parsing of lead-notification emails (e.g., Zillow/Realtor.com forwards) you route to your LeadHaus intake address — those emails’ full content is processed to create leads. |
| Twilio | SMS, voice calling, call recording (recordings are stored in your Twilio account), and missed-call handling (only if you connect your Twilio account). |
| Gmail sending and Google Calendar sync (only if you connect your Google account). | |
| Microsoft | Outlook email sending and Microsoft calendar sync (only if you connect your Microsoft account). |
| Sendblue | iMessage and text message delivery, only if you connect your Sendblue account: recipient phone numbers and message content. |
| ARIVE | Loan-origination data (borrower and loan details, loan status, and milestones) synced between ARIVE and LeadHaus, only if you connect your ARIVE account. |
| Yahoo, AOL, Xfinity/Comcast, or other mailbox providers | Only if you connect a mailbox with an app password (SMTP): the emails you send (recipients and content) are sent through that provider, and a copy is saved to the Sent folder of that mailbox. |
| RentCast | Property addresses, for home-value and equity estimates. |
| Geoapify | Address text you type into address-autocomplete fields, to suggest completions. |
| Sentry | Error and performance monitoring in the app; we minimize personal data sent to Sentry (known identifier patterns are redacted before transmission). |
| Vercel | Hosting of the LeadHaus web app. Vercel receives standard request data (such as IP address, browser type, and the page requested) in its request logs. |
| Open-Meteo and OpenStreetMap (Nominatim) | Only if you use a weather feature and allow location access: your browser sends your location coordinates directly to Open-Meteo (weather forecast) and to OpenStreetMap Nominatim (to look up your city name). |
| Web push services (Google, Apple, Mozilla) | Only if you turn on push notifications: notifications are delivered through the push service of your browser or device, which receives your device push address and the encrypted notification. |
| Make.com | Only if you set up a Make.com scenario that sends leads to your LeadHaus intake webhook: the lead data passes through Make.com under your own Make.com account and its terms. |
These providers receive only the data necessary to perform their specific function for us, and we do not permit them to use it for their own purposes. Where you connect your own accounts (Google, Microsoft, Twilio, Sendblue, ARIVE, Make.com, or an app-password mailbox), your direct relationship and their terms also apply.
LeadHaus’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
AI Connector. You may connect a third-party AI assistant (for example, Claude or ChatGPT) to your LeadHaus account. Data the assistant reads from your account is then processed by that assistant’s provider under its own terms and privacy policy, not ours. Permission for an assistant to send email or text messages is off by default; if you grant it, each message the assistant drafts waits for your approval in LeadHaus before it is sent, unless you change that setting.
In addition to subscription fees, LeadHaus is supported by sponsored listings displayed within the platform from businesses such as title companies, home services providers, and financial service companies.
Sponsor placements appear within the LeadHaus app and are labeled Sponsored.
Sponsors do not receive your personal data or your clients' data. Sponsors pay for visibility (ad placement). They cannot see who views their in-app listing, and their content cannot access your account or data. If you choose to click through to a sponsor's own website, that visit is governed by the sponsor's privacy practices.
We retain your data for as long as your account is active. If you leave or are removed from a team, your account converts to an individual account and your own data remains available to you. If your subscription lapses, we retain your data in read-only form so you can export it or reactivate; we may delete long-inactive lapsed-account data after providing at least 30 days’ notice to your account email.
If you close your account yourself (Settings → Account), your sign-in and all connected integrations are disabled immediately, and after a 7-day grace period — during which the closure can be cancelled by contacting support — your data, including contacts, leads, tasks, emails, call logs, templates, documents, and automation records, is permanently deleted from our production database. We recommend downloading a backup (Settings → Backup) before closing your account.
A small set of records is retained beyond closure for legitimate legal, security, and business purposes, on defined schedules: a closure record with billing references (retained for tax, accounting, and dispute-resolution purposes), a hashed (non-readable) copy of unsubscribe and do-not-contact lists (to honor opt-outs and prove compliance), consent records, and security/audit history. Consent and opt-out records may be retained indefinitely as proof of compliance. Other retained records are deleted or irreversibly anonymized when their retention period ends, unless a legal hold (for example, litigation or an active dispute) requires them to be kept longer.
To request deletion of your account and data, contact your account administrator or use our secure contact form. We will process deletion requests within 30 days.
After deletion from our production database, your data may persist for a limited time in encrypted database backups, which are maintained by our infrastructure provider on a rolling cycle and purged as that cycle completes (approximately 30 days). Server, security, and operational logs (for example, records that a message was sent, sign-in events, and rate-limit counters) are content-minimized and retained on defined rolling windows for security and reliability purposes; your conversation history (message content), call history, call transcripts, and AI call summaries are user-facing CRM content and are retained for the life of the account. Audit log records related to administrative actions (e.g., that an invite was sent or a plan was changed) may be retained for a longer period for compliance and security purposes. Billing records (subscription status, invoices held by Stripe) are retained as required for tax and accounting law.
Copies of messages you sent through your own connected providers live in those accounts and are governed by them, not by us: emails sent through your Gmail or Microsoft account remain in that account’s Sent folder, and text messages sent through your own Twilio or Sendblue account remain in that provider’s logs, and call recordings remain in your Twilio account. Closing your LeadHaus account disconnects these integrations but does not delete those provider-side copies.
If LeadHaus is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of its assets, user data may be transferred to the successor entity as part of that transaction, subject to this Privacy Policy. We will notify account owners (by email or in-app notice) of any such transfer and of any choices you may have, and the successor’s use of your data remains bound by commitments at least as protective as this policy unless you are notified otherwise and given an opportunity to delete your account first.
Depending on your location, you may have rights under applicable privacy law, including:
To exercise any of these rights, use our secure contact form or email privacy@leadhauscrm.com. We do not discriminate against users who exercise their privacy rights.
The Service is intended for use in the United States. Depending on your state of residence, you may have additional rights under state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and the Utah Consumer Privacy Act (UCPA) — including rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to appeal a refusal.
Notice at collection. The categories of personal information we collect and the purposes for which we use them are described in Sections 1 and 2 of this policy. We collect personal information directly from you, from your use of the Service, and from integrations you connect. We retain it as described in Section 6.
Do Not Sell or Share My Personal Information. We do not sell your personal information or your clients’ personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Because there is no sale or sharing, no opt-out is required — but you may still submit any privacy request (including a “do not sell or share” request, which we will honor by confirming that no sale or sharing occurs) through our secure contact form. We will verify and respond to requests within the timeframes required by the applicable state law. If we decline your request, you may appeal by replying to our decision within 30 days; a different reviewer will re-examine the request, and we will respond to your appeal within 45 days.
If you are a client, borrower, or contact of a LeadHaus user (rather than a LeadHaus account holder), we process your information on that user’s behalf as a service provider. Please direct privacy requests to the professional you worked with; if we receive your request directly, we will refer it to them and assist them in fulfilling it as their service provider.
We may access, preserve, and disclose personal information if we believe in good faith that it is required by law or legal process — for example, in response to a subpoena, court order, search warrant, or lawful request from law enforcement or regulators — or where reasonably necessary to protect the rights, property, or safety of LeadHaus, our users, or the public, to enforce our Terms, or to detect and prevent fraud or security incidents. Where legally permitted, we will make reasonable efforts to notify the affected account owner before disclosing their data in response to legal process.
LeadHaus uses browser local storage (not third-party cookies) to persist your authentication session and UI preferences such as dark mode. We do not use advertising cookies or cross-site tracking. We use Sentry for error and performance monitoring within the app (see Section 4); we minimize personal data sent to Sentry (known identifier patterns are redacted before transmission).
Email open and click tracking is performed via a tracking pixel and link rewriting for emails you send through the Service, so you can see engagement from your own outreach. This only affects recipients of emails you send — not general visitors to the Service.
The Service is intended for use by business professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided data to us, please contact us immediately.
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days’ advance notice by email to your account address or by prominent in-app notice, in addition to updating the effective date at the top of this page. Continued use of the Service after the notice period constitutes acceptance of the revised Policy.
LeadHaus users may send SMS messages to their contacts through the Service using Twilio integration. The following disclosures apply to such messaging:
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
LEAD HAUS LLC (LeadHaus)
privacy@leadhauscrm.com
Secure contact form