Privacy Policy

This Privacy Policy explains how Leads 2 Build (“Leads 2 Build,” “we,” “us”) collects, uses, shares, keeps and protects information when you use the Leads 2 Build platform (the “Service”) at leads2build.com and any subdomain or custom domain we host on your behalf, our mobile app, and our marketing website.

By creating an account or otherwise using the Service, you confirm that you have read and understood this policy. If you do not agree, do not use the Service.

This policy covers the Service we operate. It does not cover the separate practices of third-party services you connect to your account (such as QuickBooks Online, SmartBuild, your calendar, or your Facebook page). When you connect or use those services through the Service, their own privacy policies also apply, alongside this one.

Leads 2 Build is a product of CYA, a sole proprietorship registered in British Columbia, Canada (BC registry firm number FM1015008, CRA business number 724948328). CYA is the legal entity behind this Service and the registered brand on our A2P 10DLC text-messaging registration; “Leads 2 Build” is the operating name it trades and sends messages under. They are one and the same business.

Mailing and delivery address: 154 Bridlewood Drive SW, Calgary, Alberta T2Y 3T2, Canada.

Our owner is responsible for privacy at Leads 2 Build. For privacy or data-protection inquiries, contact privacy@leads2build.com.

3.1 Information you give us directly

• Account information — your name, business name, email address, phone number, password (handled by our authentication provider; we do not see it), and the role assigned to you within your organization.
• Customer and project data you upload or enter — including customer contact information, mailing/site addresses, project specifications, material lists, photographs, signatures, notes, tasks, and any documents you attach (contracts, change orders, intake forms).
• Crew and payroll information — if your business uses the crew, time-tracking or payroll features, the details you enter about your workers (pay rates, withholding choices, hours) and the time entries they record.
• Billing information — payment card and bank details are collected and handled entirely by Stripe (see Section 5). We do not store full card numbers on our systems.
• Communications — messages you send through the in-app messaging features, support requests, and feedback.

3.2 Calls, recordings and transcripts

• Phone calls and texts placed through the Service’s phone numbers are carried by Twilio. We keep a record of each call and message (the numbers, time, length and content of texts). Where a business turns call recording on, its calls are recorded and may be transcribed, and the caller hears a recording announcement first — the announcement cannot be switched off while recording is on.
• In-app voice and video calls between users of the Service are transcribed while each person speaks, using the speech recognition built into their web browser (in Google Chrome, for example, speech is sent to Google for recognition). A call is recorded only when a participant starts a recording, and everyone on the call is shown that it is recording. Section 6A of our Terms of Service has the detail.
• Meetings with us — when you meet with our team on Google Meet, the meeting may be recorded and transcribed by Google, and we keep the notes with our record of your account. Google Meet shows everyone on the call when recording or transcription is on.

3.3 Location information

Photos taken in the Service keep the location and device details stored in them, so a jobsite photo shows where it was taken. If a business uses crew time tracking, the location where a worker clocks in and out is recorded to confirm they were on site. Scanning an equipment tag records where it was scanned, and you can ask the Service to use your current location to fill in an address. Apart from these moments, and the approximate location that can be inferred from an IP address, the Service does not record your location.

3.4 Information from integrated services

When you connect a third-party service to your Leads 2 Build account, we receive the categories of data listed below. You control what gets connected; you can disconnect any integration at any time from Settings → Integrations.

QuickBooks Online (Intuit)

If you connect QuickBooks Online, we access — through Intuit’s Accounting API — the following data categories:

• Customer records (name, contact, billing/shipping addresses, balance)
• Vendor and supplier records
• Items / Products & Services (your catalog, pricing, income-account mapping)
• Estimates and invoices (line items, totals, status, attachments)
• Payments received and bills paid
• Chart of Accounts (for posting transactions correctly)
• Class / Project / Department records (used for per-job profitability)
• Company information (company name, country, base currency, plan tier)

We do not access bank-account credentials, your QuickBooks Payments merchant settings, or payroll data. We do not access cardholder data (PANs, CVVs, SSNs, EINs) through QuickBooks. We do not share, resell, or re-disclose QuickBooks customer data to any third party, and we do not use it to train artificial intelligence or machine-learning models. Tokens used to access your QuickBooks data are encrypted at rest using AES-256-GCM authenticated encryption.

CRM and messaging service (HighLevel, Inc.)

For some businesses, we run CRM, text and email features on a platform provided by HighLevel, Inc., which we operate and pay for in the background as part of the Service. You do not need your own account with it. For those businesses we read and (in some cases) write the following on their behalf:

• Contacts, opportunities, and pipelines
• Conversations, messages, notes, tasks, and calendar events
• Media library items (when generating documents)
• Pipeline stage assignments (we may move opportunities between stages when configured automations fire — for example, when an estimate is approved)

This is one of two text-message delivery paths we operate; the other is our own direct Twilio account. Section 8 sets out both. The credentials for that platform are stored encrypted with AES-256-GCM.

SmartBuild

SmartBuild is a separate service that you maintain your own account with. When you connect your SmartBuild account, you authorize us to access, read, and retrieve (pull) your SmartBuild data — job specifications, material lists, labor hours, markup, and pricing — in order to display it in the Service and generate customer-facing estimates. Your SmartBuild credentials are stored encrypted with AES-256-GCM. We do not modify your SmartBuild data — the integration is read-only on the SmartBuild side.

Calendars and lead forms

If you connect a Google or Outlook calendar, we sync the events needed to show your schedule and book appointments. If you connect a Facebook page, we receive the details people submit on your Facebook and Instagram lead forms. The access tokens for these connections are stored encrypted with AES-256-GCM.

3.5 Information collected automatically

• Device and browser information — IP address, browser type and version, operating system, screen size, and similar technical signals.
• Usage information — pages viewed, features used, timestamps, referring URLs, error logs.
• Cookies and similar technologies — see Section 12.

3.6 Information about businesses we may contact

If you work for a construction business, we may collect your business contact details — name, role, business phone and email, business website and social profiles — from public sources such as business websites and directories, so that we can tell you about the Service. You can ask us to stop contacting you and to delete these details at any time by replying to any message from us or writing to privacy@leads2build.com.

We use the information described above to:

• Provide, maintain, and improve the Service.
• Authenticate you, prevent unauthorized access, and protect against fraud.
• Process subscription payments and prevent payment fraud.
• Synchronize information with the third-party services you have connected (for example, pushing an invoice you created in Leads 2 Build to QuickBooks Online).
• Send transactional communications (account verification, payment receipts, system alerts).
• Send service updates and, with your consent, marketing communications you can opt out of at any time.
• Diagnose problems, monitor performance, and improve reliability.
• Comply with legal obligations.

Information a business keeps about its own customers. When a construction business uses the Service to keep records about its customers, leads, crews or subcontractors, that business decides what is collected and why, and it is responsible for that information. We process it on the business’s instructions, under our Data Processing Addendum, and only to provide the Service. If you are a customer of one of those businesses, please send privacy requests to the business directly; if you send them to us, we will pass them on.

The legal bases under applicable EU/UK data-protection law are: performance of our contract with you, our legitimate interests (operating and improving the Service, fraud prevention, and telling businesses about the Service), your consent (for optional marketing and analytics cookies), and compliance with legal obligations.

We use other companies (“subprocessors”) to run the Service — for hosting, the database, file storage, sign-in, email, text messages and calls, and payments. Our subprocessor list names every one, what it does, the personal information it receives and where it processes it. We share information with each only to the extent needed for the purpose listed there, under their data-processing or service terms. We update the list, and email account owners, at least 30 days before a new subprocessor starts receiving customer personal information.

Our subprocessors process data in the United States. Leads 2 Build itself is based in Canada; when you provide information to the Service, that information is transferred to and processed in the United States. See Section 13.

We may also disclose information when required by law (subpoena, court order, government request) or to protect the rights, property, or safety of our users or the public. If we are involved in a merger, acquisition, or sale of assets, we may transfer information as part of that transaction; we will provide advance notice in that event.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not share customer financial data with any party other than the subprocessors listed for the purposes stated. We do not allow any subprocessor to use your data for their own marketing.

We run a written information security program, described in our Information Security overview. Key safeguards include:

• Encryption in transit — all traffic between your browser and the Service uses TLS.
• Encryption at rest — our database and file-storage providers encrypt stored data, and the credentials you give us to connect other services are additionally encrypted by the application with AES-256-GCM.
• Separation between accounts — every record is stamped with the account it belongs to, and every read and write is scoped to that account on our servers. Our database is not reachable directly from browsers.
• Sign-in — we use Clerk for sign-in; passwords never reach our servers. Two-step sign-in is required for our staff, and each business can require it for its owners and admins.
• Access controls — what each person can see depends on their role. Our staff access a customer account only to support it, and that access is logged.
• Audit logging — changes to records are written to an audit log that cannot be edited, kept for at least 13 months.
• Private files — photos, documents and recordings are stored privately and opened through short-lived signed links; links shared with your customers expire.

No method of transmission or storage is perfectly secure. We work to apply industry-standard safeguards but cannot guarantee absolute security.

• Active accounts — we keep account information for as long as the account is active and as needed to provide the Service. A business can delete individual records at any time.
• Call recordings, transcripts and crew locations — kept for the period the business chooses in its settings; unless it chooses a shorter period, they are kept while the account is active.
• Disconnecting QuickBooks — when you disconnect QuickBooks Online from your account, we revoke our OAuth tokens with Intuit and delete the stored tokens from our database within 24 hours. Previously synchronized read-only references (such as the QuickBooks ID stamped on a Leads 2 Build invoice) remain on your records for your own audit purposes; no further data is fetched from QuickBooks after disconnect.
• Downloading your data — the account owner can download an export of all of the account’s data from inside the Service at any time while the account exists.
• Cancelling your subscription — we send reminder emails, and the account and its data, including stored files and call recordings, are deleted 60 days after cancellation. You can ask us to delete it sooner.
• Deleting your account — a user’s own deletion is immediate. When the account owner deletes the whole company account, deletion starts after 24 hours, during which it can be called off. See how to delete your account.
• Deleted files — files moved to the trash are permanently removed after 30 days.
• Website and product analytics — visit and usage records are kept for 14 months.
• Audit logs — security audit logs are kept for at least 13 months, and longer where required by law or for a fraud investigation.
• Backups — deleted information can remain in encrypted backups until they expire on their normal cycle: 7 days for our database provider’s backups, and up to 12 months for monthly archive copies. Backups are used only to recover from a disaster.
• Records we must keep — payment and tax records for transactions already made are kept for as long as tax law requires, and used for nothing else.
• Deletion requests — you may request deletion of your personal information at any time by emailing privacy@leads2build.com. We respond to verified requests within 30 days.

8.1 Mobile information is never shared for marketing

We do not share, sell, rent, or provide your mobile phone number or your messaging consent data to third parties or affiliates for marketing or promotional purposes. No mobile opt-in data is shared with third parties or affiliates for marketing or promotional purposes. This is an absolute rule and it has no exceptions.

The only parties that ever handle your mobile number are the messaging vendors described in 8.2, who act solely as our service providers under contract, on our documented instructions, for the sole purpose of delivering the messages you asked to receive. They are not permitted to use your number or your consent for their own marketing, to resell it, or to disclose it to anyone else. Acting as a delivery vendor in that capacity is not sharing for marketing purposes.

8.2 Who actually sends the message

Leads 2 Build is a software platform used by construction businesses. Text messages reach you over one of two delivery paths, and which one applies depends on how the business texting you is configured:

• Direct Twilio — we hold our own account with Twilio and complete our own A2P 10DLC brand and campaign registration with the US carriers. Messages on this path are sent under a registered sender belonging to Leads 2 Build, or to the individual business where that business has completed its own registration through us. This is the path used for our own messages to you, and for businesses we provision directly on Twilio.
• HighLevel, Inc. — for some businesses, messaging runs through a CRM platform provided by HighLevel, Inc., which we operate and pay for in the background on that business’s behalf. You are not required to have your own account with it. HighLevel maintains its own carrier relationships and its own A2P 10DLC registrations, and it uses Twilio as one of its underlying carriers. On this path the registered sender is HighLevel’s rather than ours.

We hold direct commercial relationships with both Twilio and HighLevel, Inc. In both cases they are subprocessors of ours under Section 5 — delivery infrastructure, not independent marketers, and not recipients of your data for any purpose of their own. Whichever path carries the message, the protections in 8.1 and the opt-out rights in 8.4 apply identically.

8.3 How consent is obtained — first party only

Consent to text you is only ever collected by the business that will actually send the message:

• By us — when you tick the SMS consent box on a form on our own website, or turn on text notifications yourself inside your account settings. Those settings are off by default and only you can enable them. The box, its exact wording, and everything the program sends are on our public sign-up page at leads2build.com/sms-signup.
• By a business using our platform — when you give your number directly to that construction business, through their own website form, their own advertising lead form, or in the course of doing business with them. That business is the sender and holds the consent record.

We do not buy, rent, import, or accept purchased marketing lists, affiliate lead-generation lists, or consent collected by anyone other than the business that will send the message. We do not send messages on behalf of third-party advertisers, and we do not permit our platform to be used for affiliate marketing or third-party lead generation by SMS.

8.4 Frequency, rates, and opting out

• Message frequency — message frequency varies. For transactional messages (account alerts, customer-portal notifications, appointment and estimate updates), frequency is event-driven. For any marketing or campaign message, you are told the expected frequency at the time you give consent.
• Standard rates — message and data rates may apply, as set by your carrier.
• Opt out at any time — reply STOP to any message to unsubscribe from further SMS from that sender. Consent is never a condition of purchase or of using any service.
• Help — reply HELP for assistance, or contact the sender directly.
• Restricted content — we do not knowingly transmit SMS content involving sex, hate, alcohol, firearms, or tobacco (SHAFT) without explicit additional consent and carrier approval.

Our SMS terms, including the specific programs we operate and what each one sends, are set out in Section 6 of our Terms of Service.

We send three categories of email:

• Transactional — account verification, password reset, payment receipts, invoices delivered through the Service. You cannot opt out of these while your account is active.
• Service announcements — material changes to the Service, security advisories, downtime notices. Limited and infrequent.
• Marketing — optional. You can opt out at any time from any marketing email’s unsubscribe link, or by emailing privacy@leads2build.com.

We do not offer bank-account linking today. If you connect a bank account through Plaid once we do, the following applies:

• Who handles it — Plaid Inc. connects to your bank on our behalf. You sign in to your bank through Plaid; we never see or store your bank username or password. Plaid’s handling of your information is described in the Plaid End User Privacy Policy.
• What we receive — only what the feature you are using needs, which we tell you on the screen where you agree before the connection starts (for example, the account and routing numbers needed to set up a payment, or the account holder’s name). We show you only the last four digits of an account number.
• Your consent — we ask for your explicit agreement, and record it, before you connect an account. You can disconnect at any time, which removes our access through Plaid and deletes the bank information we hold.
• How we use it — only for the purpose you agreed to. We never sell bank information, and never use it for marketing, advertising, or training artificial-intelligence models.
• How long we keep it — only as long as the purpose needs it, and we delete it when you disconnect the account or delete your Leads 2 Build account.

11.1 General rights

Regardless of where you live, you may:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your personal information (subject to legal exceptions).
• Withdraw consent for processing that relies on consent.
• Opt out of marketing communications.
• Get a copy of your data in a structured, commonly used format — an account owner can download the account’s data from inside the Service, and anyone can ask us by email.

11.2 California and other US states

California residents have additional rights, including the right to know what personal information we have collected, the right to delete it (with exceptions), the right to correct it, the right to opt out of sale or sharing of personal information for cross-context behavioral advertising (we do not sell or share personal information for cross-context behavioral advertising), and the right not to be discriminated against for exercising any of these rights. Residents of other states with comprehensive privacy laws — such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia — have similar rights to access, correct, delete and obtain a copy of their information and to opt out of targeted advertising, sale and profiling, and may appeal our decision on a request by replying to it. We honour Global Privacy Control signals as an opt-out.

11.3 Canada (PIPEDA, Alberta and British Columbia)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, Alberta’s and British Columbia’s Personal Information Protection Acts govern how we handle your personal information. You have the right to access your personal information, request corrections, and withdraw consent to processing (subject to legal or contractual restrictions). If you have an unresolved privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), or, for British Columbia residents, the Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).

11.4 EU / UK / EEA (GDPR)

Where the EU or UK General Data Protection Regulation applies, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on our legitimate interests. You also have the right to lodge a complaint with your local data protection authority. Our lawful bases for processing are described in Section 4. Where processing is based on consent, you can withdraw consent at any time.

11.5 How to exercise your rights

Email privacy@leads2build.com with your request. We will verify your identity before responding, and respond to verified requests within 30 days (or sooner where the law requires). If your request is about information a construction business keeps about you as its customer, we will pass it to that business — it decides how to respond — and help it do so.

We use a small number of cookies and similar technologies:

• Essential cookies — authentication, session management, and security. These cannot be disabled without breaking the Service.
• Functional cookies — remembering your preferences (such as your last-selected pipeline view).
• Our own measurement — inside the Service we record which features are used, to improve them. On our marketing website, random visitor and session identifiers, referral sources and campaign parameters help us measure how people find us. We retain first and most recent acquisition sources in your browser for up to 90 days. If you submit an enquiry, we may associate that history with your enquiry and subsequent software purchases to understand which campaigns produce customers.
• Google Analytics — our marketing website uses Google Analytics to count visits, but it loads only after you accept analytics cookies in the cookie banner. If you decline, or your browser sends a Global Privacy Control signal, it does not load. To change your choice later, clear this site’s cookies and stored data in your browser and the banner will ask again.

We do not use advertising cookies or pixels that follow you across other websites. Most browsers let you delete or block cookies. Doing so for essential cookies will prevent the Service from working.

Leads 2 Build (CYA) is based in Calgary, Alberta, Canada. The Service’s infrastructure and the subprocessors on our subprocessor list operate from the United States (Cloudflare also relays call media through its global network). When you use the Service, your personal information is transferred to, stored in, and processed in the United States. Where required by Canadian (PIPEDA), EU/UK (GDPR), or other applicable law, we rely on standard contractual clauses, the recipient organizations’ privacy commitments, or other lawful transfer mechanisms.

If we confirm a breach of security affecting your personal information, we will notify the account owner of the affected business without undue delay and no later than 72 hours after we confirm it. Where the law requires — for example, where PIPEDA or Alberta’s privacy law finds a real risk of significant harm, or under a US state breach-notification law — we will also notify the people affected and the relevant regulator within the time that law sets, and notify partners such as Intuit where their data is involved. We keep a record of every breach.

The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and post a notice in the Service at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

Questions, requests, or complaints about this Privacy Policy or our data practices:

• Email: privacy@leads2build.com
• Mail: CYA (Leads 2 Build), 154 Bridlewood Drive SW, Calgary, Alberta T2Y 3T2, Canada