Privacy Policy

Last updated: August 2, 2026. Controller: iSCALE LLC.

1. Information We Collect

We collect the following categories of personal information:

  • Account data: name, email address, company name, role, organization membership, and login timestamps.
  • Authentication data: OAuth identifiers (Google), WebAuthn passkey credentials, two-factor authentication secrets, and session tokens.
  • Usage data: IP address, user agent, device type, login timestamps, pages visited, and actions taken in the platform.
  • Lead data you process: if you use Lead Router to route leads, the data subjects' names, contact details, and any custom fields you capture. You are the controller of this data; we process it under your instruction.
  • Billing data: payment card data is handled by our processor (Stripe) and never stored on our systems.

2. How We Use Your Information

We use your information to: authenticate your identity, manage your account, provide access to the Lead Router platform, maintain security through audit logging, process payments, communicate service updates, respond to support requests, and comply with legal obligations. We do not sell your personal information or share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Our use of data for artificial intelligence and machine learning is governed exclusively by Section 3 below.

3. Artificial Intelligence and Model Training

We may use data processed through the platform — including account, usage, and lead data — in de-identified and aggregated form to develop and improve the Service, including training machine-learning and AI models. De-identified data cannot reasonably be linked back to you or to any individual lead, and we do not attempt re-identification. We never use for training: data covered by a Business Associate Agreement or originating from HIPAA-regulated verticals, payment data, authentication secrets, or sensitive personal information as defined by applicable law. We do not sell, license, or otherwise provide your data to third parties for the purpose of training their models. By creating an account you agree to this use, as set out in Section 5 of the Terms of Service.

4. Third-Party Service Providers

We share personal information with the following categories of processors, each under a data processing agreement (DPA):

  • Infrastructure: Vercel (hosting), Neon (Postgres), AWS (file storage).
  • Authentication: Google (OAuth sign-in), when you choose it.
  • Payments: Stripe.
  • Monitoring: Sentry (error tracking).
  • Communications: transactional email and SMS providers configured by you.

We do not share your data with advertising networks, data brokers, or analytics platforms that re-sell it.

5. Data Security

We protect your account using Google OAuth, magic-link email authentication, WebAuthn passkeys, and optional time-based one-time-password (TOTP) two-factor authentication. We do not store user passwords. Additional safeguards include TLS 1.2+ for data in transit, encryption at rest, multi-tenant isolation at the row level, role-based access controls, and audit logging on authenticated actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; we maintain an incident response process and will notify affected customers of a breach as required by applicable law.

6. Data Retention

Account data is retained while your account is active and for a reasonable period after closure to comply with legal, accounting, and dispute-resolution obligations. Audit logs are retained for up to 12 months. Lead data you process through the platform is retained under your configuration; you control deletion windows and can export or purge it at any time. When an account is closed, we begin deleting associated personal data within 30 days, except where retention is required by law; residual copies may persist in encrypted backups for a limited period until purged on our standard backup rotation.

7. International Transfers

Lead Router is operated from the United States. If you access the service from outside the US, your data will be transferred to the US. For data originating from the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism.

8. Your Rights (GDPR, CCPA, and Other Regulations)

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data (subject to legal retention requirements).
  • Object to or restrict certain processing.
  • Port your data in a machine-readable format.
  • Opt out of sale or sharing (we do not sell your data).
  • Withdraw consent previously given.

Submit requests through our Data Subject Request form. We respond within the timeframes required by applicable law (generally 30–45 days), and will not discriminate against you for exercising your rights. If we deny a request, residents of states with appeal rights may appeal by replying to our decision; we will respond as required by the applicable statute. Because we do not sell personal information or share it for cross-context behavioral advertising, universal opt-out signals such as Global Privacy Control do not change how we process your data.

8a. Lead Data — Our Role as Processor

If your information was submitted to Lead Router by one of our customers (for example, you filled out a form on a website operated by a business that uses our platform), that business is the controller of your data and its privacy policy governs the collection. We process the data on that business’s instructions as a service provider and do not use it for our own marketing. To exercise privacy rights over lead data, contact the business that collected it; if you contact us instead via the Data Subject Request form, we will forward your request to the relevant controller and assist them in fulfilling it.

9. Cookies and Tracking

Lead Router uses strictly necessary cookies for authentication and session management. We do not use advertising cookies or third-party trackers on authenticated pages. Our public marketing pages use first-party analytics only to measure aggregate traffic patterns.

10. Children's Privacy

Lead Router is a business-to-business platform and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it.

11. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. Material changes will be announced via email to account administrators at least 30 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy inquiries, data subject requests, or questions about this policy, contact us at privacy@iscale.com or use our Data Subject Request form. Mailing address: iSCALE LLC, United States.