1. Introduction
LeadFlow NeuroSophia ("we", "our", "us") is a CRM platform for small and medium businesses in Latin America. We are committed to protecting your personal data and complying with applicable privacy regulations, including Meta's Platform Terms and Developer Policies.
This Privacy Policy explains what data we collect, how we use it, and what rights you have over your data.
2. Data We Collect
We collect the following categories of data:
2.1 Account Data
- Full name and email address (provided at registration)
- Business name and contact details
2.2 Meta Platform Data
When you connect your Meta (Facebook / Instagram) account, we access the following data through Meta's Marketing API — only with your explicit authorization:
- Meta user ID and public profile name
- Ad account IDs and names linked to your Business Manager
- Facebook Pages you administer
- Ad campaigns, ad sets, and ads you create through our platform
- Campaign performance metrics (impressions, clicks, spend, leads)
- OAuth access tokens — stored encrypted, used only to call Meta's API on your behalf
We request only the permissions required to operate the platform: ads_management, ads_read, business_management, pages_show_list, pages_read_engagement.
2.3 CRM Data
- Leads and contacts you import or add manually
- Conversations and messages within the platform
- Appointments and calendar events
2.4 Google Calendar Data
If you connect a Google account, we store the connection data and the calendar events created for CRM appointments. See section 9 for the full detail.
2.5 Usage Data
- Log data: IP address, browser type, pages visited
- Feature usage analytics (aggregated, never sold)
3. How We Use Your Data
We use your data exclusively to:
- Operate the CRM: manage leads, conversations, appointments, and automations on your behalf
- Run Meta Ads campaigns: create and manage campaigns, ad sets, and creatives in your Meta ad account via Marketing API
- Generate AI insights: analyze campaign performance and suggest optimizations using AI
- Send transactional notifications: account alerts, billing receipts, and security notices
- Improve the platform: aggregate usage analytics to develop new features
We do not use your Meta data to target ads for other businesses or for any purpose outside the service you explicitly requested.
4. We Do Not Sell Your Data
We do not sell, rent, or share your personal data or Meta Platform data with third parties for commercial or marketing purposes. Your data is yours — we are only a processor acting on your instructions.
5. Data Retention
- Account data: retained while your account is active and for up to 90 days after deletion
- Meta OAuth tokens: deleted immediately when you disconnect your Meta account or submit a data deletion request
- Campaign data: retained for 12 months after the campaign ends, then purged
- Meta user data received via webhook: deleted within 90 days of receipt unless retained for an active service
6. Security
We implement industry-standard security measures: OAuth tokens are stored encrypted, all traffic uses TLS 1.3, access is role-based, and we conduct regular security reviews. We never log or expose access tokens in application logs.
7. Your Rights
You have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Deletion — request permanent deletion of all your data. See our Data Deletion page
- Portability — receive your data in a structured format
- Objection — object to processing in certain circumstances
To exercise any of these rights, contact us at the email below.
8. Meta Platform Data — Specific Commitments
In compliance with Meta's Platform Terms, we confirm:
- We only request permissions that are necessary for our platform features
- We do not transfer Meta user data to data brokers or advertising networks
- We do not use Meta data to create interest-based profiles for other businesses
- Users can disconnect their Meta account at any time from Settings > Integrations, which immediately revokes our access token
- Users can request deletion of all Meta-related data via our Data Deletion page or through Facebook's App Settings
9. Google User Data — Google Calendar Integration
Connecting a Google account is optional. It happens only when you start the connection from the Calendar section and approve Google's consent screen. Every other feature of the platform works without it.
9.1 Scopes we request
https://www.googleapis.com/auth/calendar.events— to create, update, and delete the calendar events for appointments booked through the CRM.https://www.googleapis.com/auth/userinfo.email— only to show you which Google account is currently connected.
9.2 What we do not request
- We do not request the broad calendar scope (
auth/calendar), so we cannot create, rename, or delete your calendars, and we cannot list the calendars in your account. - We only work with your primary calendar. We do not access secondary calendars or calendars shared with you.
- We do not request access to Gmail, Drive, Contacts, or any other Google service.
9.3 How we use this data
- Create a calendar event for each appointment a prospect books through the CRM, including its time, title, and the contact details of that appointment.
- Update that event when the appointment is rescheduled, and delete it when the appointment is cancelled, so your calendar never keeps a meeting that no longer exists.
- Read the events on your primary calendar for the next 30 days in order to detect scheduling conflicts. We do not read your past history or events beyond that window.
We do not use Google data for any purpose other than those listed above.
9.4 Google API Services User Data Policy and Limited Use
LeadFlow NeuroSophia's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically and explicitly:
- We do not sell data obtained from Google APIs, and we do not transfer it to third parties except as strictly necessary to provide the service you requested, to comply with applicable law, or for security purposes.
- We do not use this data for advertising, targeting, or commercial profiling of any kind.
- We do not use this data to train, fine-tune, or improve artificial intelligence models — neither our own nor those of third parties.
- No human on our team reads this data, except with your explicit permission to troubleshoot a support issue, or where required by law or for security.
9.5 What we store, and for how long
- The access token and refresh token issued by Google, stored encrypted in our database, so we can write to your calendar without prompting you every time.
- The email address of the connected Google account, the connection date, and the last sync date.
- The identifier and link of the Google event we created for each appointment, so we can update or delete it later.
We keep this information for as long as the Google connection remains active. When you request disconnection, or when you delete your account, we delete the tokens and the connection data.
9.6 How to revoke access
You can revoke access at any time:
- From your own Google account at myaccount.google.com/permissions, by removing the access granted to LeadFlow NeuroSophia. From that moment on we can no longer write to your calendar.
- By writing to the address in the Contact section so we delete the tokens and connection data stored on our servers.
For any question about how we handle Google data, write to soporte@leadflowneurosophia.io.
10. Cookies
We use essential cookies only: session tokens and preference storage. We do not use third-party advertising or tracking cookies.
11. Changes to This Policy
We may update this policy. We will notify you of significant changes via the email registered to your account or via a prominent notice on the platform.
12. Contact
For privacy questions or data requests:
We respond within 5 business days.
© 2025 LeadFlow NeuroSophia. All rights reserved.